deps(deps): bump com.uber.nullaway:nullaway from 0.13.8 to 0.14.1

[dependabot]

Bumps com.uber.nullaway:nullaway from 0.13.8 to 0.14.1.

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.1

Several bug fixes in this release, particularly for JSpecifyExperimental. Thanks to all who tested out this mode, reported bugs, and contributed! Please continue to test and send feedback. See the 0.14.0 release notes below for more information on JSpecifyExperimental.

• Fix restoring nullness annotations from an unbounded wildcard to a captured type (#1717)
• JSpecify: support anonymous diamond classes by @​subhramit (#1710)
• Fix attribute errors reported during dataflow (#1736)
• Apply library models to an overridden method type when checking overrides (#1722)
• Deduplicate generic inference failure warnings (#1741)
• Preserve nested nullness annotations through inheritance (#1742)
• Fix crash for generic qualifiers in method references (#1744)
• Cache immutable stubx library models (#1745)
• Allow nullable method references for void functions (#1747)
• Preserve nested nullness in enhanced-for variable types (#1748)
• Track nullable elements in enhanced-for dataflow (#1749)
• Honor ignored methods in null-marked library models (#1753)
• Avoid crashes on malformed @Contract arity (fixes #1726) (#1756)
• Inherit null-implies-null models across overrides (#1758)
• Fix inference for annotated type variable uses (#1759)
• Preserve contract unreachability across store joins (#1761)
• Prevent recursion on self-referential wildcard bounds (#1763)
• Work around pre-JDK-25 limitations in reading upper bounds from wildcard arguments in bytecode (#1764)
• Improve diagnostics for non-null type variable bounds (#1770)
• Fix override checks for method type variables bounded by a class type variable by @​pivovarit (#1775)
• Maintenance
  • Migrate FrameworkTests to addSourceLines by @​abdeltaehass (#1712)
  • Attribute errors reported during dataflow to the right file by @​vlsi (#1734)
  • Disable CodeRabbit summaries (#1755)
  • Add tests for overrides of Collection.toArray (#1757)
  • Assert the full set of diagnostics for annotated type-variable uses by @​vlsi (#1768)
  • Document that a nullImpliesNull model applies to overriding methods by @​vlsi (#1771)
  • Add tests for the JSpecify nullness operator by @​vlsi (#1767)

NullAway 0.14.0

This release has significant improvements to JSpecify support, including improved support for wildcards and integration of the standard library nullability annotations from https://github.com/jspecify/jdk. Much of this new support is gated behind a new JSpecifyExperimental flag, which is off by default. We disable the flag by default since this new support leads to many new errors in existing projects (mostly from the new JDK models), and because we need more real-world testing before enabling it by default. We encourage projects to enable the JSpecifyExperimental flag (alongside JSpecify mode) and to report any issues that arise. We expect to turn JSpecifyExperimental on by default in a future release.

Aside from the above, you may observe some newly reported warnings in JSpecify mode, due to other checking improvements.

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.1

Several bug fixes in this release, particularly for JSpecifyExperimental. Thanks to all who tested out this mode, reported bugs, and contributed! Please continue to test and send feedback. See the 0.14.0 release notes below for more information on JSpecifyExperimental.

• Fix restoring nullness annotations from an unbounded wildcard to a captured type (#1717)
• JSpecify: support anonymous diamond classes by @​subhramit (#1710)
• Fix attribute errors reported during dataflow (#1736)
• Apply library models to an overridden method type when checking overrides (#1722)
• Deduplicate generic inference failure warnings (#1741)
• Preserve nested nullness annotations through inheritance (#1742)
• Fix crash for generic qualifiers in method references (#1744)
• Cache immutable stubx library models (#1745)
• Allow nullable method references for void functions (#1747)
• Preserve nested nullness in enhanced-for variable types (#1748)
• Track nullable elements in enhanced-for dataflow (#1749)
• Honor ignored methods in null-marked library models (#1753)
• Avoid crashes on malformed @Contract arity (fixes #1726) (#1756)
• Inherit null-implies-null models across overrides (#1758)
• Fix inference for annotated type variable uses (#1759)
• Preserve contract unreachability across store joins (#1761)
• Prevent recursion on self-referential wildcard bounds (#1763)
• Work around pre-JDK-25 limitations in reading upper bounds from wildcard arguments in bytecode (#1764)
• Improve diagnostics for non-null type variable bounds (#1770)
• Fix override checks for method type variables bounded by a class type variable by @​pivovarit (#1775)
• Maintenance
  • Migrate FrameworkTests to addSourceLines by @​abdeltaehass (#1712)
  • Attribute errors reported during dataflow to the right file by @​vlsi (#1734)
  • Disable CodeRabbit summaries (#1755)
  • Add tests for overrides of Collection.toArray (#1757)
  • Assert the full set of diagnostics for annotated type-variable uses by @​vlsi (#1768)
  • Document that a nullImpliesNull model applies to overriding methods by @​vlsi (#1771)
  • Add tests for the JSpecify nullness operator by @​vlsi (#1767)

Version 0.14.0

This release has significant improvements to JSpecify support, including improved support for wildcards and integration of the standard library nullability annotations from https://github.com/jspecify/jdk. Much of this new support is gated behind a new JSpecifyExperimental flag, which is off by default. We disable the flag by default since this new support leads to many new errors in existing projects (mostly from the new JDK models), and because we need more real-world testing before enabling it by default. We encourage projects to enable the JSpecifyExperimental flag (alongside JSpecify mode) and to report any issues that arise. We expect to turn JSpecifyExperimental on by default in a future release.

... (truncated)

Commits

• b3d442a Prepare for release 0.14.1.
• d6df98b Release notes for 0.14.1 (#1784)
• ecb763e fix override checks for method type variables bounded by a class type variabl...
• 915b287 Add tests for the JSpecify nullness operator (#1767)
• f142e85 Improve diagnostics for non-null type variable bounds (#1770)
• bb5cf51 Work around pre-JDK-25 limitations in reading upper bounds from wildcard argu...
• 17d7ca7 Document that a nullImpliesNull model applies to overriding methods (#1771)
• cc156e4 Assert the full set of diagnostics for annotated type-variable uses (#1768)
• b9efa0f Prevent recursion on self-referential wildcard bounds (#1763)
• 177ad18 Preserve contract unreachability across store joins (#1761)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, java. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None