Hi Manu, For context, I am not an IPMC member; I am commenting as someone who has used NullAway.
>From a user’s perspective, I am positive about the proposal and believe that ASF incubation could help the project build a more diverse, community-driven governance model. I noticed that the email says 6–24 months, while the proposal page says 2–24 months. I assume the latter is simply a typo, as two months would be inconsistent with the proposal’s own 6–12 month goals. In any case, I would be very happy to see NullAway join the Apache Incubator! Best regards,Shuxin Pan On Tue, Aug 11, 2026 at 5:58 AM Manu Sridharan <[email protected]> wrote: > > Hi everyone, > > I would like to start discussion of a proposal to make NullAway ( > https://github.com/uber/NullAway) an Apache Incubator project. The > proposal is here: > > https://cwiki.apache.org/confluence/spaces/INCUBATOR/pages/440304640/NullAwayProposal > > I’ve pasted a slightly updated version of the proposal below that addresses > some initial feedback (we’ll get the wiki version updated soon). We have > Justin Mclean as a champion, but we are in need of mentors, if you are able > to help. Thanks in advance for your feedback and thoughts! > > Best regards, > Manu > > ---------------------------------------- > > # New Podling Proposal: Apache NullAway (incubating) > > ## Abstract > NullAway is a fast, annotation-based nullness checker for Java that helps > eliminate `NullPointerException`s at build time with minimal overhead. > > ## Proposal > NullAway is a tool designed to eliminate `NullPointerException`s (NPEs) in > Java code. To use NullAway, developers add `@Nullable` annotations to their > code wherever a field, method parameter, or return value may be `null`. > Given these annotations, NullAway performs a series of type-based, local > checks to ensure that any pointer that gets dereferenced in the code cannot > be `null`. NullAway provides similar type-based nullability checking to > languages like Kotlin and Swift, or the Checker Framework nullness checker > for Java. > > NullAway is designed for high-performance production environments. Built as > a plugin to Google's Error Prone framework, it runs on every single local > or CI build of a project. In production measurements, the build-time > overhead of running NullAway is typically less than 10%. NullAway is > practical: it balances absolute soundness with developer productivity, > catching the vast majority of production NPEs while imposing a reasonable > annotation burden. Furthermore, NullAway supports a variety of nullness > annotations, including the newly standardized JSpecify nullability > annotations. > > ## Background > NullAway was initially developed at Uber and open-sourced in 2017. Since > then, NullAway has built a large, passionate community of users, > accumulating approximately 4,000 stars on GitHub. > > Recently, the JSpecify working group released version 1.0 of a standardized > set of Java annotations for nullness properties with well-specified > semantics. NullAway is actively working towards full JSpecify support. With > the increasing adoption of JSpecify across the Java ecosystem, the rate of > new users, community issues, and pull requests for NullAway has increased > significantly. > > ## Rationale > NullAway plays an increasingly critical role for nullness safety in the > Java ecosystem. As JSpecify annotations become widely adopted—both due to > industry standardization and in anticipation of native nullness types being > added to the Java language itself—the ecosystem needs a fast tool to > enforce them. NullAway provides fast consistency and safety checking for > these annotations, making it suitable for both continuous integration > pipelines and local developer workflows. > > We believe shifting NullAway to the Apache Software Foundation as a > community-owned project will decouple it from any single corporate entity, > formalize its governance, attract new enterprise contributors, and ensure > its long-term health and neutrality. > > ## Initial Goals > The NullAway project targets the following milestones during its first 6 to > 12 months of incubation: > > * **Complete IP Clearance and Donation:** Execute an ASF software grant > from the current rights holder (Uber Technologies Inc.), ensure all initial > committers file ICLAs, and import the code into ASF infrastructure. > * **Establish Apache Governance:** Transition from a single-maintainer > model to dev-list-driven decisions, documented voting practices, clear > roles (release managers, triagers), and transparent committer nomination. > * **Produce Apache-Compliant Releases:** Set up automated, source-only > releases with appropriate signatures, checksums, and audited > `LICENSE`/`NOTICE` files. > * **Strengthen Onboarding Pathways:** Improve contributor documentation and > label "good first issues" to expand the contribution ladder toward > maintainership. > * **Ecosystem Interoperability:** Enhance documentation and support for > common build tool integrations, collaborating closely with the broader > nullness annotation ecosystem (e.g., JSpecify). > > --- > > ## Current Status > > ### Meritocracy > We fully embrace meritocracy. A core motivation for joining the ASF is to > expand the project's leadership. While NullAway has historically been > developed in the open with public issue tracking and pull requests, a > single developer (Manu Sridharan) has been responsible for the majority of > recent commits. > > Moving NullAway to the ASF will signal to external contributors that the > project welcomes community ownership. We intend to establish clear, > merit-based pathways where sustained, high-quality contributions (code, > reviews, documentation, or triage) quickly earn commit access and PMC > membership. > > ### Community > * **Contributors:** There are currently 70 unique contributors (Source: > https://github.com/uber/NullAway/graphs/contributors) > * **Downstream Users:** NullAway is widely adopted across high-profile > open-source frameworks and massive internal codebases, including: > * Core Spring projects (including Spring Framework and Spring Boot) > * Micronaut Framework > * JUnit unit testing library > * AssertJ test assertion library > * Uber (internally for all backend and Android Java code) > > ### Core Developers > * **Manu Sridharan:** Primary developer and maintainer since inception in > 2017. > * **Lazaro Clapp:** Developer and maintainer. > * **Yuxin Wang (Uber):** Code reviewer and contributor. > * **Stefano Cordio (AssertJ):** Code reviewer and contributor. > > ### Alignment > The ASF hosts the foundational tooling of the Java ecosystem (e.g., Apache > Maven, Apache Commons). NullAway directly complements these projects by > offering compile-time code quality checks. > > The project is currently licensed under the permissive MIT license, and a > Contributor License Agreement (CLA) mechanism has been in place since its > inception. Transitioning the codebase to the Apache License, Version 2.0 > will be straightforward (the sufficiency of the Uber CLA for re-licensing > has been confirmed). > > --- > > ## Known Risks > > ### Project Name > NullAway does not currently hold a registered trademark. Upon acceptance > into incubation, a formal **Podling Name Search (PNS)** will be conducted > to ensure the name does not conflict with existing trademarks. Uber will > transfer any implicit naming rights or brand equity associated with the > project to the ASF. > > ### Orphaned Products > NullAway is heavily relied upon by major enterprises and core open-source > projects like Spring and JUnit. The current development team is fully > committed to maintaining and improving the tool to support JSpecify and > future Java ecosystem updates. The risk of the project becoming orphaned is > incredibly low. > > ### Length of Incubation > We expect NullAway to remain in incubation for between 6 to 24 months. This > timeline will allow the project to fully diversify its contributor base, > execute several compliant Apache releases, and demonstrate a > self-sustaining community operating under the "Apache Way." > > ### Homogeneous Developers > * **Risk:** The project currently relies heavily on one primary developer > for its core logic, representing a bus-factor and architectural bottleneck > risk. > * **Mitigation:** We are actively executing a cross-organization > recruitment plan targeting: > 1. **Large Downstream Adopters:** Inviting active users from > organizations deploying NullAway at scale (e.g., Spring, Micronaut) to > steward integrations. > 2. **JSpecify Working Group Participants:** Recruiting contributors > from member organizations involved in the multi-company JSpecify effort to > build out shared nullness semantics. > > ### Governance > * **Risk:** The project could be perceived as centrally controlled or > dependent on a Benevolent Dictator for Life (BDFL) model; we're very keen > to change this. > * **Mitigation:** During an initial public discussion on ` > [email protected]` (begun September 23, 2025), the project > initiator explicitly welcomed a shift away from a BDFL model to a > formalized, stakeholder-driven process. NullAway will adopt Apache > governance norms from day one, ensuring all architectural roadmaps and > releases are voted on publicly via the mailing list. > > ### Relationships with Other Apache Products > NullAway complements existing build and quality tools used in the Java > ecosystem. It does not duplicate or compete with any existing Apache > Top-Level Projects; rather, it introduces a highly focused, compile-time > nullness analysis layer that can be seamlessly adopted by other Apache Java > projects. > > ### Inexperience with Open Source > > NullAway has been open source since 2017 and has had numerous improvements > since its open-source release. All of the initial committers have > significant open-source experience; see their GitHub profiles ( > https://github.com/msridhar, https://github.com/lazaroclapp, > https://github.com/yuxincs, https://github.com/scordio). > > ### Reliance on Salaried Developers > > NullAway's current primary developer Manu Sridharan has been maintaining > and improving NullAway as both a personal project and as it relates to his > research work as a professor; his salary does not explicitly pay for work > for NullAway. Similarly, Lazaro Clapp has continued to contribute to > NullAway as a personal project. So, NullAway does not have an > over-reliance on salaried developers. We aim for a mix of salaried > developers and volunteers as contributors, to be representative of > NullAway's user base. > > --- > > ## Documentation > * **Main README:** https://github.com/uber/NullAway/blob/master/README.md > * **Project Wiki:** https://github.com/uber/NullAway/wiki > > ## Initial Source > * **Source Code Repository:** https://github.com/uber/NullAway > > ## Source and Intellectual Property Submission Plan > 1. **Software Grant:** Obtain an official ASF Software Grant Agreement > (SGA) from Uber Technologies Inc. covering the existing NullAway codebase. > 2. **Contributor License Agreements:** Ensure all initial committers have > filed individual CLAs (ICLAs) and, where applicable, Corporate CLAs (CCLA) > with the ASF. > 3. **Code Import:** Migrate the repository history into ASF infrastructure > while preserving metadata and clear provenance. > 4. **License & Notice Compliance:** Audit all third-party code, remove any > incompatible assets, add standard Apache `LICENSE` and `NOTICE` text, and > reheader source files with the standard Apache license block. > > ### External Dependencies > NullAway relies on the following external dependencies at compile or build > time: > * **Google Error Prone** (Apache 2.0) > * **Google Guava** (Apache 2.0) > * **JSpecify Annotations** (Apache 2.0) > * **Checker Framework Dataflow Library** (GPLv2 with Classpath Exception) > * *Note on Compliance:* NullAway does not bundle or re-distribute any > Checker Framework binaries or source code. Users consume this library via > standard dynamic linking during the compilation process. This setup > complies with ASF third-party licensing policies as a Category B / system > runtime requirement (similar to Google Error Prone’s existing structure). > > ### Cryptography > Not applicable. NullAway does not implement, use, or distribute > cryptographic software. > > --- > > ## Required Resources > > ### Mailing Lists > * `[email protected]` (for community discussion and technical > decisions) > * `[email protected]` (for repository commit notifications) > * `[email protected]` (for issue tracking notifications) > * `[email protected]` (for confidential podling matters) > > ### Repositories > The project will utilize the ASF GitBox system to provide > write-synchronization between ASF infrastructure and GitHub: > * https://gitbox.apache.org/asf/repos/nullaway > * https://github.com/apache/nullaway > > ### Issue Tracking > The project requests to continue utilizing **GitHub Issues** integrated > with the Apache GitHub repository to maintain continuity for our existing > user base. We are open to discuss this further if this is not a preferred > way of engagement with our community. > > ### Other Resources > * **Continuous Integration:** GitHub Actions (leveraging standard > ASF-provided runners). > * **Website:** A standard Apache Incubator hosted website (` > http://nullaway.incubator.apache.org/`) managed via Git-backed markdown. > > --- > > ## Initial Committers > * **Manu Sridharan** (Current Maintainer) — ICLA to be filed. > * **Yuxin Wang** (Uber) — ICLA to be filed or utilize Uber CCLA. > * **Lazaro Clapp** — ICLA to be filed. > * **Stefano Cordio** — ICLA to be filed. > > > There is already an CCLA in place for Uber and ASF which would cover any > future Uber inbound contributions. > > ## Sponsors > > ### Champion > * Justin Mclean > > ### Nominated Mentors > * Justin Mclean > * *(Additional mentors to be recruited during the discussion phase)* > > ### Sponsoring Entity > * The Apache Incubator PMC --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
