Context

Dependabot PR #4317 bumps NullAway from 0.12.10 to 0.13.1. This upgrade causes 3 compilation errors due to a known NullAway bug.

The problem

NullAway 0.13.0+ has a bug (uber/NullAway#1453) where generic methods with @Contract("null -> fail") no longer work correctly. When calling:

public static <T> T assertNotNull(@Nullable T object) { ... }

NullAway 0.13.x propagates javac's inferred @Nullable on the generic type variable T to the return type — even though the @Contract annotation guarantees non-null return. This means code like:

List<Value> copiedValues = assertNotNull(deepCopy(values));
// NullAway 0.13.x treats copiedValues as @Nullable

fails with: passing @Nullable parameter 'copiedValues' where @NonNull is required.

Affected files

• ArrayValue.java:95 — assertNotNull(deepCopy(values))
• ObjectValue.java:84 — assertNotNull(deepCopy(objectFields))
• MergedField.java:431 — assertNotNull(this.fields, ...)

Upstream fix status

The fix is uber/NullAway#1471 — merged on 2026-02-16 but not yet released. It will be available in NullAway 0.13.2 or later.

Action

• Keep NullAway at 0.12.10 for now
• Close dependabot PR Bump com.uber.nullaway:nullaway from 0.12.10 to 0.13.1 #4317
• Revisit after the next NullAway release containing the fix