Bump dependency com.uber.nullaway:nullaway to v0.14.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.uber.nullaway:nullaway	0.13.8 → 0.14.0

---

Release Notes

uber/NullAway (com.uber.nullaway:nullaway)

v0.14.0

Compare Source

This release has significant improvements to JSpecify support, including
improved support for wildcards and integration of the standard library
nullability annotations from https://github.com/jspecify/jdk. Much of this
new support is gated behind a new JSpecifyExperimental flag, which is off by
default. We disable the flag by default since this new support leads to many
new errors in existing projects (mostly from the new JDK models), and because we
need more real-world testing before enabling it by default. We encourage
projects to enable the JSpecifyExperimental flag (alongside JSpecify mode) and
to report any issues that arise. We expect to turn JSpecifyExperimental on
by default in a future release.

Aside from the above, you may observe some newly reported warnings in JSpecify
mode, due to other checking improvements.

This release also removes the LegacyAnnotationLocations flag. Type-use
annotations must now be placed correctly on qualified and array types, even
outside JSpecify mode, see details here:

https://github.com/uber/NullAway/wiki/JSpecify-Support#type-use-annotation-placement

Beyond the above, we had useful changes from a variety of new contributors;
thanks so much!

• Remove LegacyAnnotationLocations flag (#​1640)
• Handle signature-polymorphic calls in InvocationArguments (#​1644)
• Fix handling of reference to method with @Nullable parameter from library model (#​1642)
• Enable JSpecify JDK models (under a flag) (#​1641)
• Enable JSpecify JDK models for regression tests (#​1646)
• Fix bug with lambdas assigned to locals with a wildcard in their type (#​1647)
• Add JSpecifyExperimental configuration flag (#​1648)
• Improve wildcard mismatch diagnostics for identical-looking types (#​1627)
• Enable inference failure warnings in experimental mode, and fix related bug in library models (#​1649)
• Fix inference bug with generic instance methods (#​1654)
• Fixes related to captured types and inference (#​1655)
• Augment NullAway error / fix serialization for Annotator auto fix mode by @​nimakarimipour (#​1322)
• More consistent checks for captured types (#​1662)
• Update to JSpecify 1.0.1 (#​1665)
• Add test for issue 1671 (#​1673)
• Test case and fix for issue 1672 (#​1674)
• Fix subtype checking for nested captured types (#​1663)
• Handle interaction of captured types and library models (#​1666)
• Follow-on fix for restoring annotation on captured type wildcards (#​1667)
• Fix subtle issue with invalid TreePaths (#​1681)
• Honor @​Contract when a @​Nullable method is used as a method reference by @​Eljees (#​1679)
• Defensively thread path into NestedTypeVarSubstitutionRepairVisitor (#​1683)
• More TreePath hardening (#​1684)
• Harden TypeSubstitutionUtils type copies (#​1669)
• Handle unbound wildcards and interactions with captured types better (#​1668)
• Improve error messages involving capture variables (#​1675)
• Update JarInfer to skip synthetic methods (#​1686)
• Fix bug with storing library model type variable upper bounds (#​1687)
• Fixes for processing return array types and multi-dimensional array types in AstubxGenerator (#​1689)
• Pretty-print substituted types in bad-override error messages by @​dbwiddis (#​1697)
• Add test for issue 1693 (#​1698)
• JSpecify: support annotated type arguments from an enclosing class by @​dbwiddis (#​1699)
• Fix crash in @​Contract dataflow init for zero-argument methods by @​dbwiddis (#​1701)
• Support method-based conditional library model postconditions by @​Shankar-v27 (#​1677)
• Update JSpecify JDK astubx (#​1702)
• JSpecify: preserve array element nullability through requireNonNull by @​kamilkrzywanski (#​1645)
• Add positive test cases for annotations on generic method return types by @​dbwiddis (#​1704)
• Add regression test for inner classes inheriting enclosing type arguments by @​dbwiddis (#​1703)
• Fix JSpecify false negative when override narrows method type variable bound by @​arimu1 (#​1682)
• Fix bug with library-modeled return types, method references, and streams (#​1706)
• Rename MethodInferenceResult to CallInferenceResult (#​1692)
• Generalize generic-call inference internals to call expressions (#​1707)
• Basic nullability inference for diamond constructor type arguments (#​1708)
• Handle nested generic diamond call inference (#​1544)
• Rename getExecutableTypeForInference and improve Javadoc (#​1709)
• Maintenance
  • Add policy on AI-generated PRs (#​1635)
  • Enable CodeRabbit reviews for all base branches (#​1650)
  • Fix Javadoc errors and allow future Javadoc errors to fail the build (#​1652)
  • Test on JDK 28 early access (#​1653)
  • Update to latest Shadow plugin (#​1658)
  • Remove duplicate NestedAnnotationInfo source from NullAway module (#​1659)
  • Fix Javadoc warnings (#​1660)
  • Fixes to JarInfer test harness and test inputs (#​1670)
  • Address zizmor findings (#​1676)
  • Update to Checker Dataflow 4.2.2 (#​1678)
  • Convert various classes to records (#​1685)
  • Update script to use snapshot builds in integration tests (#​1691)
  • Replace deprecated addSourceFile calls with addSourceLines in FrameworkTests by @​dbwiddis (#​1695)
  • Migrate InitializationTests to addSourceLines by @​abdeltaehass (#​1694)
  • Migrate anonymous class test to addSourceLines by @​terminalchai (#​1696)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

☀️   Quality Monitor

Tests

     Unit Tests: ✅ successful — 87 passed $\textsf{(±0)}$, 2 skipped $\textsf{(±0)}$
   ⛔   Architecture Tests: ✅ successful — 18 passed $\textsf{(±0)}$, 2 skipped $\textsf{(±0)}$

Coverage for New Code

   〰️   Line Coverage: 100.00% — perfect 🎉
   ➰   Branch Coverage: 100.00% — perfect 🎉
     Mutation Coverage: 100.00% — perfect 🎉
   💪   Test Strength: 100.00% — perfect 🎉

Coverage for Whole Project

   〰️   Line Coverage: 92.03% $\textsf{(±0)}$ — 64 missed lines
   ➰   Branch Coverage: 92.04% $\textsf{(±0)}$ — 18 missed branches
     Mutation Coverage: 91.16% $\textsf{(±0)}$ — 29 survived mutations
   💪   Test Strength: 93.15% $\textsf{(±0)}$ — 22 survived mutations in tested code

Style

     CheckStyle: No warnings $\textsf{(±0)}$
     PMD: No warnings $\textsf{(±0)}$
   ☕   Java Compiler: No warnings $\textsf{(±0)}$

Bugs

     SpotBugs: No bugs $\textsf{(±0)}$
   🐛   Error Prone: No bugs $\textsf{(±0)}$

API Problems

   🚫   Revapi: No warnings $\textsf{(±0)}$

Vulnerabilities

   🛡️   OWASP Dependency Check: No vulnerabilities $\textsf{(±0)}$

Software Metrics

   🌀   Cyclomatic Complexity: 397 (total)
   💭   Cognitive Complexity: 173 (total)
   ➿   N-Path Complexity: 361 (total)
   📏   Lines of Code: 4722 (total)
   📝   Non Commenting Source Statements: 1338 (total)
   🔗   Class Cohesion: 71.43% (maximum)
   ⚖️   Weight of Class: 100.00% (maximum)

📌 Reference Results

Delta reports computed against the reference results of 0324aeb in workflow run 32496733584.

🚦 Quality Gates

Overall Status: ✅ SUCCESS

✅ Passed Gates

• ✅ Overall Tests Success Rate: 100.00 >= 100.00
• ✅ Line Coverage in New Code: 100.00 >= 90.00
• ✅ Branch Coverage in New Code: 100.00 >= 90.00
• ✅ Mutation Coverage in New Code: 100.00 >= 90.00
• ✅ Potential Bugs in Whole Project: 0.00 <= 0.00
• ✅ Style Violation in Whole Project: 0.00 <= 0.00

---

Created by Quality Monitor v4.15.0 (#82d77af). More details are shown in the GitHub Checks Result.