Hi everyone, I would like to start discussion of a proposal to make NullAway ( https://github.com/uber/NullAway) an Apache Incubator project. The proposal is here:
https://cwiki.apache.org/confluence/spaces/INCUBATOR/pages/440304640/NullAwayProposal I’ve pasted a slightly updated version of the proposal below that addresses some initial feedback (we’ll get the wiki version updated soon). We have Justin Mclean as a champion, but we are in need of mentors, if you are able to help. Thanks in advance for your feedback and thoughts! Best regards, Manu ---------------------------------------- # New Podling Proposal: Apache NullAway (incubating) ## Abstract NullAway is a fast, annotation-based nullness checker for Java that helps eliminate `NullPointerException`s at build time with minimal overhead. ## Proposal NullAway is a tool designed to eliminate `NullPointerException`s (NPEs) in Java code. To use NullAway, developers add `@Nullable` annotations to their code wherever a field, method parameter, or return value may be `null`. Given these annotations, NullAway performs a series of type-based, local checks to ensure that any pointer that gets dereferenced in the code cannot be `null`. NullAway provides similar type-based nullability checking to languages like Kotlin and Swift, or the Checker Framework nullness checker for Java. NullAway is designed for high-performance production environments. Built as a plugin to Google's Error Prone framework, it runs on every single local or CI build of a project. In production measurements, the build-time overhead of running NullAway is typically less than 10%. NullAway is practical: it balances absolute soundness with developer productivity, catching the vast majority of production NPEs while imposing a reasonable annotation burden. Furthermore, NullAway supports a variety of nullness annotations, including the newly standardized JSpecify nullability annotations. ## Background NullAway was initially developed at Uber and open-sourced in 2017. Since then, NullAway has built a large, passionate community of users, accumulating approximately 4,000 stars on GitHub. Recently, the JSpecify working group released version 1.0 of a standardized set of Java annotations for nullness properties with well-specified semantics. NullAway is actively working towards full JSpecify support. With the increasing adoption of JSpecify across the Java ecosystem, the rate of new users, community issues, and pull requests for NullAway has increased significantly. ## Rationale NullAway plays an increasingly critical role for nullness safety in the Java ecosystem. As JSpecify annotations become widely adopted—both due to industry standardization and in anticipation of native nullness types being added to the Java language itself—the ecosystem needs a fast tool to enforce them. NullAway provides fast consistency and safety checking for these annotations, making it suitable for both continuous integration pipelines and local developer workflows. We believe shifting NullAway to the Apache Software Foundation as a community-owned project will decouple it from any single corporate entity, formalize its governance, attract new enterprise contributors, and ensure its long-term health and neutrality. ## Initial Goals The NullAway project targets the following milestones during its first 6 to 12 months of incubation: * **Complete IP Clearance and Donation:** Execute an ASF software grant from the current rights holder (Uber Technologies Inc.), ensure all initial committers file ICLAs, and import the code into ASF infrastructure. * **Establish Apache Governance:** Transition from a single-maintainer model to dev-list-driven decisions, documented voting practices, clear roles (release managers, triagers), and transparent committer nomination. * **Produce Apache-Compliant Releases:** Set up automated, source-only releases with appropriate signatures, checksums, and audited `LICENSE`/`NOTICE` files. * **Strengthen Onboarding Pathways:** Improve contributor documentation and label "good first issues" to expand the contribution ladder toward maintainership. * **Ecosystem Interoperability:** Enhance documentation and support for common build tool integrations, collaborating closely with the broader nullness annotation ecosystem (e.g., JSpecify). --- ## Current Status ### Meritocracy We fully embrace meritocracy. A core motivation for joining the ASF is to expand the project's leadership. While NullAway has historically been developed in the open with public issue tracking and pull requests, a single developer (Manu Sridharan) has been responsible for the majority of recent commits. Moving NullAway to the ASF will signal to external contributors that the project welcomes community ownership. We intend to establish clear, merit-based pathways where sustained, high-quality contributions (code, reviews, documentation, or triage) quickly earn commit access and PMC membership. ### Community * **Contributors:** There are currently 70 unique contributors (Source: https://github.com/uber/NullAway/graphs/contributors) * **Downstream Users:** NullAway is widely adopted across high-profile open-source frameworks and massive internal codebases, including: * Core Spring projects (including Spring Framework and Spring Boot) * Micronaut Framework * JUnit unit testing library * AssertJ test assertion library * Uber (internally for all backend and Android Java code) ### Core Developers * **Manu Sridharan:** Primary developer and maintainer since inception in 2017. * **Lazaro Clapp:** Developer and maintainer. * **Yuxin Wang (Uber):** Code reviewer and contributor. * **Stefano Cordio (AssertJ):** Code reviewer and contributor. ### Alignment The ASF hosts the foundational tooling of the Java ecosystem (e.g., Apache Maven, Apache Commons). NullAway directly complements these projects by offering compile-time code quality checks. The project is currently licensed under the permissive MIT license, and a Contributor License Agreement (CLA) mechanism has been in place since its inception. Transitioning the codebase to the Apache License, Version 2.0 will be straightforward (the sufficiency of the Uber CLA for re-licensing has been confirmed). --- ## Known Risks ### Project Name NullAway does not currently hold a registered trademark. Upon acceptance into incubation, a formal **Podling Name Search (PNS)** will be conducted to ensure the name does not conflict with existing trademarks. Uber will transfer any implicit naming rights or brand equity associated with the project to the ASF. ### Orphaned Products NullAway is heavily relied upon by major enterprises and core open-source projects like Spring and JUnit. The current development team is fully committed to maintaining and improving the tool to support JSpecify and future Java ecosystem updates. The risk of the project becoming orphaned is incredibly low. ### Length of Incubation We expect NullAway to remain in incubation for between 6 to 24 months. This timeline will allow the project to fully diversify its contributor base, execute several compliant Apache releases, and demonstrate a self-sustaining community operating under the "Apache Way." ### Homogeneous Developers * **Risk:** The project currently relies heavily on one primary developer for its core logic, representing a bus-factor and architectural bottleneck risk. * **Mitigation:** We are actively executing a cross-organization recruitment plan targeting: 1. **Large Downstream Adopters:** Inviting active users from organizations deploying NullAway at scale (e.g., Spring, Micronaut) to steward integrations. 2. **JSpecify Working Group Participants:** Recruiting contributors from member organizations involved in the multi-company JSpecify effort to build out shared nullness semantics. ### Governance * **Risk:** The project could be perceived as centrally controlled or dependent on a Benevolent Dictator for Life (BDFL) model; we're very keen to change this. * **Mitigation:** During an initial public discussion on ` [email protected]` (begun September 23, 2025), the project initiator explicitly welcomed a shift away from a BDFL model to a formalized, stakeholder-driven process. NullAway will adopt Apache governance norms from day one, ensuring all architectural roadmaps and releases are voted on publicly via the mailing list. ### Relationships with Other Apache Products NullAway complements existing build and quality tools used in the Java ecosystem. It does not duplicate or compete with any existing Apache Top-Level Projects; rather, it introduces a highly focused, compile-time nullness analysis layer that can be seamlessly adopted by other Apache Java projects. ### Inexperience with Open Source NullAway has been open source since 2017 and has had numerous improvements since its open-source release. All of the initial committers have significant open-source experience; see their GitHub profiles ( https://github.com/msridhar, https://github.com/lazaroclapp, https://github.com/yuxincs, https://github.com/scordio). ### Reliance on Salaried Developers NullAway's current primary developer Manu Sridharan has been maintaining and improving NullAway as both a personal project and as it relates to his research work as a professor; his salary does not explicitly pay for work for NullAway. Similarly, Lazaro Clapp has continued to contribute to NullAway as a personal project. So, NullAway does not have an over-reliance on salaried developers. We aim for a mix of salaried developers and volunteers as contributors, to be representative of NullAway's user base. --- ## Documentation * **Main README:** https://github.com/uber/NullAway/blob/master/README.md * **Project Wiki:** https://github.com/uber/NullAway/wiki ## Initial Source * **Source Code Repository:** https://github.com/uber/NullAway ## Source and Intellectual Property Submission Plan 1. **Software Grant:** Obtain an official ASF Software Grant Agreement (SGA) from Uber Technologies Inc. covering the existing NullAway codebase. 2. **Contributor License Agreements:** Ensure all initial committers have filed individual CLAs (ICLAs) and, where applicable, Corporate CLAs (CCLA) with the ASF. 3. **Code Import:** Migrate the repository history into ASF infrastructure while preserving metadata and clear provenance. 4. **License & Notice Compliance:** Audit all third-party code, remove any incompatible assets, add standard Apache `LICENSE` and `NOTICE` text, and reheader source files with the standard Apache license block. ### External Dependencies NullAway relies on the following external dependencies at compile or build time: * **Google Error Prone** (Apache 2.0) * **Google Guava** (Apache 2.0) * **JSpecify Annotations** (Apache 2.0) * **Checker Framework Dataflow Library** (GPLv2 with Classpath Exception) * *Note on Compliance:* NullAway does not bundle or re-distribute any Checker Framework binaries or source code. Users consume this library via standard dynamic linking during the compilation process. This setup complies with ASF third-party licensing policies as a Category B / system runtime requirement (similar to Google Error Prone’s existing structure). ### Cryptography Not applicable. NullAway does not implement, use, or distribute cryptographic software. --- ## Required Resources ### Mailing Lists * `[email protected]` (for community discussion and technical decisions) * `[email protected]` (for repository commit notifications) * `[email protected]` (for issue tracking notifications) * `[email protected]` (for confidential podling matters) ### Repositories The project will utilize the ASF GitBox system to provide write-synchronization between ASF infrastructure and GitHub: * https://gitbox.apache.org/asf/repos/nullaway * https://github.com/apache/nullaway ### Issue Tracking The project requests to continue utilizing **GitHub Issues** integrated with the Apache GitHub repository to maintain continuity for our existing user base. We are open to discuss this further if this is not a preferred way of engagement with our community. ### Other Resources * **Continuous Integration:** GitHub Actions (leveraging standard ASF-provided runners). * **Website:** A standard Apache Incubator hosted website (` http://nullaway.incubator.apache.org/`) managed via Git-backed markdown. --- ## Initial Committers * **Manu Sridharan** (Current Maintainer) — ICLA to be filed. * **Yuxin Wang** (Uber) — ICLA to be filed or utilize Uber CCLA. * **Lazaro Clapp** — ICLA to be filed. * **Stefano Cordio** — ICLA to be filed. There is already an CCLA in place for Uber and ASF which would cover any future Uber inbound contributions. ## Sponsors ### Champion * Justin Mclean ### Nominated Mentors * Justin Mclean * *(Additional mentors to be recruited during the discussion phase)* ### Sponsoring Entity * The Apache Incubator PMC
