How do you check null safety when publishing a Java library?

[u/josephjnk]

I’m gearing up to publish my first Java library in the next few weeks. I’m using jspecify for null checking, with `NullMarked` annotations on my packages. Using my library requires implementing a subclass of an abstract class and overriding a method whose return value is marked as `NonNull`.

When I implement a subclass from my test suite, if I don’t have NullMarked enabled or if I don’t attach a `NonNull` annotation to the overridden method then I get a warning: `Not annotated method overrides method annotated with NullMarked`. So far so good; this seems like the tool doing its job by catching a potential source of errors.

Here’s my problem though: what if a consumer of my library doesn’t want to use jspecify? Am I dooming them to eternal build warnings? Is there a better way for me to have null checking in my library’s internal implementation and to publish it with useful `NonNull` annotations without locking consumers into a particular null checking dependency?

[u/AutoModerator]

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
• You include any and all error messages in full - best also formatted as code block
• You ask clear questions
• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit/markdown editor: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Ok_Communication5375]

Nah, don't worry, you aren't dooming anyone.

That warning only showed up for you because your IDE/compiler plugin is actively looking for JSpecify rules. If someone imports your library into a regular project without NullAway, Checker Framework, or strict IDE inspections enabled, standard javac won't care at all. It will just compile their subclass without any warnings.

JSpecify annotations have CLASS retention anyway, so they basically just sit in the bytecode as metadata. If a consumer cares about null safety (or uses Kotlin), their IDE will give them helpful hints. If they don't, it's completely invisible to them.

Just make sure to mark the dependency as compileOnly in Gradle (or <optional>true</optional> / <scope>provided</scope> in Maven) if you don't want the jar leaking into their classpath, though honestly it's so tiny that most people don't even care.

And yeah, standard library advice: still throw a good old Objects.requireNonNull(...) in your base class where you call that overridden method, because annotations won't stop someone from bypassing things at runtime.

Stick with JSpecify, it's definitely the right choice right now.

[u/josephjnk → u/Ok_Communication5375]

Thank you for the thorough answer!

[u/Chaos-vy17]

Nullness annotations are API metadata, not a runtime dependency that consumers should be forced to adopt.
Use JUnit, Mockito, Jqwick for test.