Hi Paul, wonderful, thanks for the help! I did not know about the Apache Groovy NullChecker; very interesting! I completely agree there is opportunity for shared testing for interoperability and ensuring mixed language builds work smoothly. I will add this discussion to the proposal. (I’m still unable to edit the proposal on the wiki; I put in a self-serve request for an account and access a couple of days ago.)
Best, Manu On Aug 11, 2026 at 15:33:18, Paul King <[email protected]> wrote: > I can also help out as a mentor. There is also a good point to make > about Apache Groovy in the "Relationships with Other Apache Products" > section. I think you could add something like: > > Apache Groovy ships a JSpecify-aware compile-time nullness checker > (NullChecker, Groovy 6) and supports joint Java/Groovy compilation. > The projects share the JSpecify annotation model, enabling natural > collaboration on annotation semantics, shared conformance/regression > testing, and mixed-language builds where NullAway checks the Java half > and Groovy's tooling checks the Groovy half. > > I wouldn't necessarily see code sharing as a goal but interworking and > cross-checking test suites might be valuable. FYI, here is an AI read > of the fit: > > ---- > Where the two tools sit > > Both are annotation-driven, deliberately-not-fully-sound build-time > nullness checkers that support JSpecify plus other annotation > flavours, and both position themselves against the Checker Framework > on the "practicality over absolute soundness" axis. The differences > are the interesting part: > - NullAway is a javac/Error Prone plugin, checks Java, requires > annotations (its treatment of unannotated code is optimistic), and has > ~8 years of production hardening at Uber plus adoption by Spring, > JUnit, AssertJ, Micronaut. > - NullChecker is a @TypeChecked extension, checks Groovy, > understands Groovy idioms (?., ?:, Groovy truth, @Lazy), has a > no-annotation flow-sensitive strict mode NullAway has no equivalent > of, and integrates with groovy-contracts (@Requires({ x != null }) > read as implicit @NonNull. > - groovy-verify sits a rung above both: null dereference absence is > one of its implicit proof obligations (Phase 1 capability), discharged > by Z3 rather than heuristics, sound within its fragment and loudly > partial outside it. > > That's a coherent three-rung ladder — heuristic checking per language > (NullAway for Java, NullChecker for Groovy), proof for the fragment > that warrants it — and in a joint-compilation build the first two > rungs would literally run in the same build. > ---- > > > On Wed, Aug 12, 2026 at 6:04 AM Manu Sridharan <[email protected]> wrote: > > > Thanks for the initial feedback and encouragement! > > > Shuxin, yes, the email corrected the timeline. I put in a request for edit > > access to the incubator wiki (Justin uploaded the first version). Once I > > get edit access I will update the proposal on the wiki; the version > > attached to the email was the latest version. > > > Calvin, it would be great to have you onboard as a mentor, thanks for the > > offer! > > > Best, > > Manu > > > > On Aug 10, 2026 at 20:40:37, Shuxin Pan <[email protected]> wrote: > > > > Hi Manu, > > > > > > For context, I am not an IPMC member; I am commenting as someone who > > > has used NullAway. > > > > > > From a user’s perspective, I am positive about the proposal and > > > believe that ASF incubation could help the project build a more > > > diverse, community-driven governance model. > > > > > > I noticed that the email says 6–24 months, while the proposal page > > > says 2–24 months. I assume the latter is simply a typo, as two months > > > would be inconsistent with the proposal’s own 6–12 month goals. > > > > > > In any case, I would be very happy to see NullAway join the Apache > > > Incubator! > > > > > > Best regards,Shuxin Pan > > > > > > On Tue, Aug 11, 2026 at 5:58 AM Manu Sridharan <[email protected]> > wrote: > > > > > > > > > Hi everyone, > > > > > > > > > I would like to start discussion of a proposal to make NullAway ( > > > > > > https://github.com/uber/NullAway) an Apache Incubator project. The > > > > > > proposal is here: > > > > > > > > > > > > > https://cwiki.apache.org/confluence/spaces/INCUBATOR/pages/440304640/NullAwayProposal > > > > > > > > > I’ve pasted a slightly updated version of the proposal below that > addresses > > > > > > some initial feedback (we’ll get the wiki version updated soon). We have > > > > > > Justin Mclean as a champion, but we are in need of mentors, if you are > able > > > > > > to help. Thanks in advance for your feedback and thoughts! > > > > > > > > > Best regards, > > > > > > Manu > > > > > > > > > ---------------------------------------- > > > > > > > > > # New Podling Proposal: Apache NullAway (incubating) > > > > > > > > > ## Abstract > > > > > > NullAway is a fast, annotation-based nullness checker for Java that helps > > > > > > eliminate `NullPointerException`s at build time with minimal overhead. > > > > > > > > > ## Proposal > > > > > > NullAway is a tool designed to eliminate `NullPointerException`s (NPEs) > in > > > > > > Java code. To use NullAway, developers add `@Nullable` annotations to > their > > > > > > code wherever a field, method parameter, or return value may be `null`. > > > > > > Given these annotations, NullAway performs a series of type-based, local > > > > > > checks to ensure that any pointer that gets dereferenced in the code > cannot > > > > > > be `null`. NullAway provides similar type-based nullability checking to > > > > > > languages like Kotlin and Swift, or the Checker Framework nullness > checker > > > > > > for Java. > > > > > > > > > NullAway is designed for high-performance production environments. Built > as > > > > > > a plugin to Google's Error Prone framework, it runs on every single local > > > > > > or CI build of a project. In production measurements, the build-time > > > > > > overhead of running NullAway is typically less than 10%. NullAway is > > > > > > practical: it balances absolute soundness with developer productivity, > > > > > > catching the vast majority of production NPEs while imposing a reasonable > > > > > > annotation burden. Furthermore, NullAway supports a variety of nullness > > > > > > annotations, including the newly standardized JSpecify nullability > > > > > > annotations. > > > > > > > > > ## Background > > > > > > NullAway was initially developed at Uber and open-sourced in 2017. Since > > > > > > then, NullAway has built a large, passionate community of users, > > > > > > accumulating approximately 4,000 stars on GitHub. > > > > > > > > > Recently, the JSpecify working group released version 1.0 of a > standardized > > > > > > set of Java annotations for nullness properties with well-specified > > > > > > semantics. NullAway is actively working towards full JSpecify support. > With > > > > > > the increasing adoption of JSpecify across the Java ecosystem, the rate > of > > > > > > new users, community issues, and pull requests for NullAway has increased > > > > > > significantly. > > > > > > > > > ## Rationale > > > > > > NullAway plays an increasingly critical role for nullness safety in the > > > > > > Java ecosystem. As JSpecify annotations become widely adopted—both due to > > > > > > industry standardization and in anticipation of native nullness types > being > > > > > > added to the Java language itself—the ecosystem needs a fast tool to > > > > > > enforce them. NullAway provides fast consistency and safety checking for > > > > > > these annotations, making it suitable for both continuous integration > > > > > > pipelines and local developer workflows. > > > > > > > > > We believe shifting NullAway to the Apache Software Foundation as a > > > > > > community-owned project will decouple it from any single corporate > entity, > > > > > > formalize its governance, attract new enterprise contributors, and ensure > > > > > > its long-term health and neutrality. > > > > > > > > > ## Initial Goals > > > > > > The NullAway project targets the following milestones during its first 6 > to > > > > > > 12 months of incubation: > > > > > > > > > * **Complete IP Clearance and Donation:** Execute an ASF software grant > > > > > > from the current rights holder (Uber Technologies Inc.), ensure all > initial > > > > > > committers file ICLAs, and import the code into ASF infrastructure. > > > > > > * **Establish Apache Governance:** Transition from a single-maintainer > > > > > > model to dev-list-driven decisions, documented voting practices, clear > > > > > > roles (release managers, triagers), and transparent committer nomination. > > > > > > * **Produce Apache-Compliant Releases:** Set up automated, source-only > > > > > > releases with appropriate signatures, checksums, and audited > > > > > > `LICENSE`/`NOTICE` files. > > > > > > * **Strengthen Onboarding Pathways:** Improve contributor documentation > and > > > > > > label "good first issues" to expand the contribution ladder toward > > > > > > maintainership. > > > > > > * **Ecosystem Interoperability:** Enhance documentation and support for > > > > > > common build tool integrations, collaborating closely with the broader > > > > > > nullness annotation ecosystem (e.g., JSpecify). > > > > > > > > > --- > > > > > > > > > ## Current Status > > > > > > > > > ### Meritocracy > > > > > > We fully embrace meritocracy. A core motivation for joining the ASF is to > > > > > > expand the project's leadership. While NullAway has historically been > > > > > > developed in the open with public issue tracking and pull requests, a > > > > > > single developer (Manu Sridharan) has been responsible for the majority > of > > > > > > recent commits. > > > > > > > > > Moving NullAway to the ASF will signal to external contributors that the > > > > > > project welcomes community ownership. We intend to establish clear, > > > > > > merit-based pathways where sustained, high-quality contributions (code, > > > > > > reviews, documentation, or triage) quickly earn commit access and PMC > > > > > > membership. > > > > > > > > > ### Community > > > > > > * **Contributors:** There are currently 70 unique contributors (Source: > > > > > > https://github.com/uber/NullAway/graphs/contributors) > > > > > > * **Downstream Users:** NullAway is widely adopted across high-profile > > > > > > open-source frameworks and massive internal codebases, including: > > > > > > * Core Spring projects (including Spring Framework and Spring Boot) > > > > > > * Micronaut Framework > > > > > > * JUnit unit testing library > > > > > > * AssertJ test assertion library > > > > > > * Uber (internally for all backend and Android Java code) > > > > > > > > > ### Core Developers > > > > > > * **Manu Sridharan:** Primary developer and maintainer since inception in > > > > > > 2017. > > > > > > * **Lazaro Clapp:** Developer and maintainer. > > > > > > * **Yuxin Wang (Uber):** Code reviewer and contributor. > > > > > > * **Stefano Cordio (AssertJ):** Code reviewer and contributor. > > > > > > > > > ### Alignment > > > > > > The ASF hosts the foundational tooling of the Java ecosystem (e.g., > Apache > > > > > > Maven, Apache Commons). NullAway directly complements these projects by > > > > > > offering compile-time code quality checks. > > > > > > > > > The project is currently licensed under the permissive MIT license, and a > > > > > > Contributor License Agreement (CLA) mechanism has been in place since its > > > > > > inception. Transitioning the codebase to the Apache License, Version 2.0 > > > > > > will be straightforward (the sufficiency of the Uber CLA for re-licensing > > > > > > has been confirmed). > > > > > > > > > --- > > > > > > > > > ## Known Risks > > > > > > > > > ### Project Name > > > > > > NullAway does not currently hold a registered trademark. Upon acceptance > > > > > > into incubation, a formal **Podling Name Search (PNS)** will be conducted > > > > > > to ensure the name does not conflict with existing trademarks. Uber will > > > > > > transfer any implicit naming rights or brand equity associated with the > > > > > > project to the ASF. > > > > > > > > > ### Orphaned Products > > > > > > NullAway is heavily relied upon by major enterprises and core open-source > > > > > > projects like Spring and JUnit. The current development team is fully > > > > > > committed to maintaining and improving the tool to support JSpecify and > > > > > > future Java ecosystem updates. The risk of the project becoming orphaned > is > > > > > > incredibly low. > > > > > > > > > ### Length of Incubation > > > > > > We expect NullAway to remain in incubation for between 6 to 24 months. > This > > > > > > timeline will allow the project to fully diversify its contributor base, > > > > > > execute several compliant Apache releases, and demonstrate a > > > > > > self-sustaining community operating under the "Apache Way." > > > > > > > > > ### Homogeneous Developers > > > > > > * **Risk:** The project currently relies heavily on one primary developer > > > > > > for its core logic, representing a bus-factor and architectural > bottleneck > > > > > > risk. > > > > > > * **Mitigation:** We are actively executing a cross-organization > > > > > > recruitment plan targeting: > > > > > > 1. **Large Downstream Adopters:** Inviting active users from > > > > > > organizations deploying NullAway at scale (e.g., Spring, Micronaut) to > > > > > > steward integrations. > > > > > > 2. **JSpecify Working Group Participants:** Recruiting contributors > > > > > > from member organizations involved in the multi-company JSpecify effort > to > > > > > > build out shared nullness semantics. > > > > > > > > > ### Governance > > > > > > * **Risk:** The project could be perceived as centrally controlled or > > > > > > dependent on a Benevolent Dictator for Life (BDFL) model; we're very keen > > > > > > to change this. > > > > > > * **Mitigation:** During an initial public discussion on ` > > > > > > [email protected]` (begun September 23, 2025), the project > > > > > > initiator explicitly welcomed a shift away from a BDFL model to a > > > > > > formalized, stakeholder-driven process. NullAway will adopt Apache > > > > > > governance norms from day one, ensuring all architectural roadmaps and > > > > > > releases are voted on publicly via the mailing list. > > > > > > > > > ### Relationships with Other Apache Products > > > > > > NullAway complements existing build and quality tools used in the Java > > > > > > ecosystem. It does not duplicate or compete with any existing Apache > > > > > > Top-Level Projects; rather, it introduces a highly focused, compile-time > > > > > > nullness analysis layer that can be seamlessly adopted by other Apache > Java > > > > > > projects. > > > > > > > > > ### Inexperience with Open Source > > > > > > > > > NullAway has been open source since 2017 and has had numerous > improvements > > > > > > since its open-source release. All of the initial committers have > > > > > > significant open-source experience; see their GitHub profiles ( > > > > > > https://github.com/msridhar, https://github.com/lazaroclapp, > > > > > > https://github.com/yuxincs, https://github.com/scordio). > > > > > > > > > ### Reliance on Salaried Developers > > > > > > > > > NullAway's current primary developer Manu Sridharan has been maintaining > > > > > > and improving NullAway as both a personal project and as it relates to > his > > > > > > research work as a professor; his salary does not explicitly pay for work > > > > > > for NullAway. Similarly, Lazaro Clapp has continued to contribute to > > > > > > NullAway as a personal project. So, NullAway does not have an > > > > > > over-reliance on salaried developers. We aim for a mix of salaried > > > > > > developers and volunteers as contributors, to be representative of > > > > > > NullAway's user base. > > > > > > > > > --- > > > > > > > > > ## Documentation > > > > > > * **Main README:** > https://github.com/uber/NullAway/blob/master/README.md > > > > > > * **Project Wiki:** https://github.com/uber/NullAway/wiki > > > > > > > > > ## Initial Source > > > > > > * **Source Code Repository:** https://github.com/uber/NullAway > > > > > > > > > ## Source and Intellectual Property Submission Plan > > > > > > 1. **Software Grant:** Obtain an official ASF Software Grant Agreement > > > > > > (SGA) from Uber Technologies Inc. covering the existing NullAway > codebase. > > > > > > 2. **Contributor License Agreements:** Ensure all initial committers > have > > > > > > filed individual CLAs (ICLAs) and, where applicable, Corporate CLAs > (CCLA) > > > > > > with the ASF. > > > > > > 3. **Code Import:** Migrate the repository history into ASF > infrastructure > > > > > > while preserving metadata and clear provenance. > > > > > > 4. **License & Notice Compliance:** Audit all third-party code, remove > any > > > > > > incompatible assets, add standard Apache `LICENSE` and `NOTICE` text, and > > > > > > reheader source files with the standard Apache license block. > > > > > > > > > ### External Dependencies > > > > > > NullAway relies on the following external dependencies at compile or > build > > > > > > time: > > > > > > * **Google Error Prone** (Apache 2.0) > > > > > > * **Google Guava** (Apache 2.0) > > > > > > * **JSpecify Annotations** (Apache 2.0) > > > > > > * **Checker Framework Dataflow Library** (GPLv2 with Classpath Exception) > > > > > > * *Note on Compliance:* NullAway does not bundle or re-distribute any > > > > > > Checker Framework binaries or source code. Users consume this library via > > > > > > standard dynamic linking during the compilation process. This setup > > > > > > complies with ASF third-party licensing policies as a Category B / system > > > > > > runtime requirement (similar to Google Error Prone’s existing structure). > > > > > > > > > ### Cryptography > > > > > > Not applicable. NullAway does not implement, use, or distribute > > > > > > cryptographic software. > > > > > > > > > --- > > > > > > > > > ## Required Resources > > > > > > > > > ### Mailing Lists > > > > > > * `[email protected]` (for community discussion and technical > > > > > > decisions) > > > > > > * `[email protected]` (for repository commit notifications) > > > > > > * `[email protected]` (for issue tracking notifications) > > > > > > * `[email protected]` (for confidential podling matters) > > > > > > > > > ### Repositories > > > > > > The project will utilize the ASF GitBox system to provide > > > > > > write-synchronization between ASF infrastructure and GitHub: > > > > > > * https://gitbox.apache.org/asf/repos/nullaway > > > > > > * https://github.com/apache/nullaway > > > > > > > > > ### Issue Tracking > > > > > > The project requests to continue utilizing **GitHub Issues** integrated > > > > > > with the Apache GitHub repository to maintain continuity for our existing > > > > > > user base. We are open to discuss this further if this is not a preferred > > > > > > way of engagement with our community. > > > > > > > > > ### Other Resources > > > > > > * **Continuous Integration:** GitHub Actions (leveraging standard > > > > > > ASF-provided runners). > > > > > > * **Website:** A standard Apache Incubator hosted website (` > > > > > > http://nullaway.incubator.apache.org/`) managed via Git-backed markdown. > > > > > > > > > --- > > > > > > > > > ## Initial Committers > > > > > > * **Manu Sridharan** (Current Maintainer) — ICLA to be filed. > > > > > > * **Yuxin Wang** (Uber) — ICLA to be filed or utilize Uber CCLA. > > > > > > * **Lazaro Clapp** — ICLA to be filed. > > > > > > * **Stefano Cordio** — ICLA to be filed. > > > > > > > > > > > > There is already an CCLA in place for Uber and ASF which would cover any > > > > > > future Uber inbound contributions. > > > > > > > > > ## Sponsors > > > > > > > > > ### Champion > > > > > > * Justin Mclean > > > > > > > > > ### Nominated Mentors > > > > > > * Justin Mclean > > > > > > * *(Additional mentors to be recruited during the discussion phase)* > > > > > > > > > ### Sponsoring Entity > > > > > > * The Apache Incubator PMC > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
