diff --git a/.github/actions/run-gradle/action.yml b/.github/actions/run-gradle/action.yml
index 5171b2e5d1..85733e1a42 100644
--- a/.github/actions/run-gradle/action.yml
+++ b/.github/actions/run-gradle/action.yml
@@ -64,10 +64,10 @@ runs:
         fi
         echo "JDK_CI=$JAVA_HOME" >> $GITHUB_ENV
         echo "JDK_EA=${{ inputs.early-access == inputs.java }}" >> $GITHUB_ENV
+        echo "JAVA_TOOL_OPTIONS=-Dorg.gradle.workers.max=$((2 * $(nproc)))" >> $GITHUB_ENV
+        echo "ORG_GRADLE_PROJECT_org.gradle.java.installations.auto-download=false" >> $GITHUB_ENV
     - name: Setup Gradle
       uses: gradle/actions/setup-gradle@cc4fc85e6b35bafd578d5ffbc76a5518407e1af0 # v4.2.1
-      env:
-        ORG_GRADLE_PROJECT_org.gradle.java.installations.auto-download: 'false'
       with:
         add-job-summary: never
         cache-read-only: false
@@ -75,8 +75,6 @@ runs:
         cache-encryption-key: ${{ inputs.cache-encryption-key }}
     - name: Run ${{ inputs.arguments }}
       if: ${{ inputs.arguments != '' }}
-      env:
-        ORG_GRADLE_PROJECT_org.gradle.java.installations.auto-download: 'false'
       shell: bash
       run: |
         echo "::add-matcher::.github/problem-matcher.json"
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index da69032b74..f546111133 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -16,7 +16,7 @@ jobs:
             github.com:443
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: actionlint
-        uses: reviewdog/action-actionlint@053981cb135d7a696bbeec6181d9d5fae6e07dae # v1.57.0
+        uses: reviewdog/action-actionlint@08ef4afa963243489a457cca426f705ce4e0d1a5 # v1.60.0
         env:
           SHELLCHECK_OPTS: -e SC2001 -e SC2035 -e SC2046 -e SC2061 -e SC2086 -e SC2156
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ced9f0962..603badb669 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -250,7 +250,7 @@ jobs:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
         continue-on-error: true
       - name: Publish to Codecov
-        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7
+        uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Publish to Codacy
@@ -343,11 +343,11 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             ${{ env.ALLOWED_ENDPOINTS }}
-            checkerframework.org:443
             docs.oracle.com:443
             errorprone.info:443
-            lightbend.github.io:443
             guava.dev:443
+            jspecify.dev:443
+            lightbend.github.io:443
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Publish Snapshot
         uses: ./.github/actions/run-gradle
diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml
index 2dbb1f1eac..9a9c694176 100644
--- a/.github/workflows/codacy.yml
+++ b/.github/workflows/codacy.yml
@@ -47,7 +47,7 @@ jobs:
         if: steps.check_files.outputs.files_exists == 'true'
         run: jq -c '.runs |= unique_by({tool, invocations, results})' < results.sarif > codacy.sarif
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         if: steps.check_files.outputs.files_exists == 'true'
         continue-on-error: true
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 914face297..4a8be9ca03 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,10 +57,10 @@ jobs:
           java: ${{ env.JAVA_VERSION }}
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/init@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           languages: java
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/autobuild@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/analyze@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index 6c1d662476..febc77e218 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           files: build/reports/dependency-check-report.sarif
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         if: steps.check_files.outputs.files_exists == 'true'
         with:
           sarif_file: build/reports/dependency-check-report.sarif
diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml
index faee039b89..605bf17a47 100644
--- a/.github/workflows/devskim.yml
+++ b/.github/workflows/devskim.yml
@@ -31,6 +31,6 @@ jobs:
       - name: Run DevSkim scanner
         uses: microsoft/DevSkim-Action@914fa647b406c387000300b2f09bb28691be2b6d # v1.0.14
       - name: Upload DevSkim scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           sarif_file: devskim-results.sarif
diff --git a/.github/workflows/qodana.yml b/.github/workflows/qodana.yml
index 98c99edc05..a045ce5342 100644
--- a/.github/workflows/qodana.yml
+++ b/.github/workflows/qodana.yml
@@ -29,7 +29,6 @@ jobs:
             api.github.com:443
             auth.docker.io:443
             caffeine.gradle-enterprise.cloud:443
-            checkerframework.org:443
             docs.oracle.com:443
             download.jetbrains.com:443
             download-cdn.jetbrains.com:443
@@ -39,6 +38,7 @@ jobs:
             github.com:443
             guava.dev:443
             jcenter.bintray.com:443
+            jspecify.dev:443
             lightbend.github.io:443
             objects.githubusercontent.com:443
             packages.jetbrains.team:443
@@ -70,6 +70,6 @@ jobs:
           upload-result: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SARIF file for GitHub Advanced Security Dashboard
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           sarif_file: ${{ runner.temp }}/qodana/results/qodana.sarif.json
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 2b8de11d83..05d9b9c6a0 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -58,6 +58,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index d1076abf46..1ac3027da5 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -34,7 +34,7 @@ jobs:
         if: steps.check_files.outputs.files_exists == 'true'
         run: jq -c '.runs[0].tool.driver.rules |= unique_by(.id)' < results.sarif > semgrep.sarif
       - name: Upload SARIF file for GitHub Advanced Security Dashboard
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         if: steps.check_files.outputs.files_exists == 'true'
         continue-on-error: true
         with:
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index 61d0404baa..4f2fd16e5c 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           files: snyk.sarif
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         if: steps.check_files.outputs.files_exists == 'true'
         with:
           sarif_file: snyk.sarif
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index d2a3beff1d..fefb11ccea 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -16,7 +16,7 @@ jobs:
             github.com:443
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Misspell
-        uses: reviewdog/action-misspell@ef8b22c1cca06c8d306fc6be302c3dab0f6ca12f # v1.23.0
+        uses: reviewdog/action-misspell@18ffb61effb93b47e332f185216be7e49592e7e1 # v1.26.1
         with:
           reporter: github-check
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -34,4 +34,4 @@ jobs:
             objects.githubusercontent.com:443
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Typos
-        uses: crate-ci/typos@b74202f74b4346efdbce7801d187ec57b266bac8 # v1.27.3
+        uses: crate-ci/typos@2872c382bb9668d4baa5eade234dcbc0048ca2cf # v1.28.2
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 39e5a4c2e1..5386428435 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -36,7 +36,7 @@ jobs:
         with:
           files: results.sarif
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
         if: steps.check_files.outputs.files_exists == 'true'
         with:
             sarif_file: results.sarif
diff --git a/caffeine/build.gradle.kts b/caffeine/build.gradle.kts
index 0fe16e2c77..b923f49914 100644
--- a/caffeine/build.gradle.kts
+++ b/caffeine/build.gradle.kts
@@ -176,7 +176,7 @@ tasks.register<Test>("isolatedTest") {
 tasks.register<Test>("lincheckTest") {
   group = "Verification"
   description = "Tests that assert linearizability"
-  enabled = (System.getenv("JDK_EA") != "true")
+  enabled = !isEarlyAccess()
   useTestNG {
     testLogging.events("started")
     includeGroups("lincheck")
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/DelegationBenchmark.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/DelegationBenchmark.java
index de30af8889..e01aaafc71 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/DelegationBenchmark.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/DelegationBenchmark.java
@@ -19,6 +19,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ThreadLocalRandom;
 
+import org.jspecify.annotations.NullUnmarked;
 import org.jspecify.annotations.Nullable;
 import org.openjdk.jmh.annotations.Benchmark;
 import org.openjdk.jmh.annotations.Scope;
@@ -55,12 +56,12 @@ public static class ThreadState {
   }
 
   @Benchmark
-  public Integer inherit_get(ThreadState threadState) {
+  public @Nullable Integer inherit_get(ThreadState threadState) {
     return inherit.get(threadState.index++ & MASK);
   }
 
   @Benchmark
-  public Integer delegate_get(ThreadState threadState) {
+  public @Nullable Integer delegate_get(ThreadState threadState) {
     return delegate.get(threadState.index++ & MASK);
   }
 
@@ -76,6 +77,7 @@ static final class InheritMap extends ConcurrentHashMap<Integer, Integer> {
   static final class DelegateMap extends ForwardingMap<Integer, Integer> {
     final Map<Integer, Integer> delegate = new ConcurrentHashMap<>();
 
+    @NullUnmarked
     @Override public @Nullable Integer get(Object key) {
       Integer value = delegate.get(key);
       return (value == null) ? null : (value - 1);
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/GetPutBenchmark.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/GetPutBenchmark.java
index af9e927fc6..82ca2a8522 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/GetPutBenchmark.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/GetPutBenchmark.java
@@ -17,6 +17,7 @@
 
 import java.util.Random;
 
+import org.jspecify.annotations.Nullable;
 import org.openjdk.jmh.annotations.Benchmark;
 import org.openjdk.jmh.annotations.Group;
 import org.openjdk.jmh.annotations.GroupThreads;
@@ -94,7 +95,7 @@ public void tearDown() {
   }
 
   @Benchmark @Group("read_only") @GroupThreads(8)
-  public Boolean readOnly(ThreadState threadState) {
+  public @Nullable Boolean readOnly(ThreadState threadState) {
     return cache.get(ints[threadState.index++ & MASK]);
   }
 
@@ -104,7 +105,7 @@ public void writeOnly(ThreadState threadState) {
   }
 
   @Benchmark @Group("readwrite") @GroupThreads(6)
-  public Boolean readwrite_get(ThreadState threadState) {
+  public @Nullable Boolean readwrite_get(ThreadState threadState) {
     return cache.get(ints[threadState.index++ & MASK]);
   }
 
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/TimerWheelBenchmark.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/TimerWheelBenchmark.java
index aa113f23fa..679f8155d1 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/TimerWheelBenchmark.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/TimerWheelBenchmark.java
@@ -112,8 +112,8 @@ public int descending() {
   }
 
   static final class Timer extends Node<Integer, Integer> {
-    Node<Integer, Integer> prev;
-    Node<Integer, Integer> next;
+    @Nullable Node<Integer, Integer> prev;
+    @Nullable Node<Integer, Integer> next;
     long time;
 
     Timer(long time) {
@@ -126,12 +126,14 @@ static final class Timer extends Node<Integer, Integer> {
     @Override public void setVariableTime(long time) {
       this.time = time;
     }
+    @SuppressWarnings("NullAway")
     @Override public Node<Integer, Integer> getPreviousInVariableOrder() {
       return prev;
     }
     @Override public void setPreviousInVariableOrder(@Nullable Node<Integer, Integer> prev) {
       this.prev = prev;
     }
+    @SuppressWarnings("NullAway")
     @Override public Node<Integer, Integer> getNextInVariableOrder() {
       return next;
     }
@@ -143,7 +145,7 @@ static final class Timer extends Node<Integer, Integer> {
     @Override public Object getKeyReference() { throw new UnsupportedOperationException(); }
     @Override public Integer getValue() { throw new UnsupportedOperationException(); }
     @Override public Object getValueReference() { throw new UnsupportedOperationException(); }
-    @Override public void setValue(Integer value, ReferenceQueue<Integer> referenceQueue) {}
+    @Override public void setValue(Integer value, @Nullable ReferenceQueue<Integer> queue) {}
     @Override public boolean containsValue(Object value) { return false; }
     @Override public boolean isAlive() { return false; }
     @Override public boolean isRetired() { return false; }
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CaffeineCache.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CaffeineCache.java
index 3bc989e1a2..469338f9c2 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CaffeineCache.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CaffeineCache.java
@@ -15,6 +15,8 @@
  */
 package com.github.benmanes.caffeine.cache.impl;
 
+import org.jspecify.annotations.Nullable;
+
 import com.github.benmanes.caffeine.cache.BasicCache;
 import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
@@ -33,7 +35,7 @@ public CaffeineCache(int maximumSize) {
   }
 
   @Override
-  public V get(K key) {
+  public @Nullable V get(K key) {
     return cache.getIfPresent(key);
   }
 
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CoherenceCache.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CoherenceCache.java
index 0b00871560..bbda774ae8 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CoherenceCache.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/CoherenceCache.java
@@ -17,6 +17,8 @@
 
 import java.util.Map;
 
+import org.jspecify.annotations.Nullable;
+
 import com.github.benmanes.caffeine.cache.BasicCache;
 import com.tangosol.net.cache.LocalCache;
 
@@ -34,7 +36,7 @@ public CoherenceCache(int maximumSize, int evictionPolicyType) {
   }
 
   @Override
-  public V get(K key) {
+  public @Nullable V get(K key) {
     return map.get(key);
   }
 
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/ConcurrentMapCache.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/ConcurrentMapCache.java
index 0004592a4d..aec57bed64 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/ConcurrentMapCache.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/ConcurrentMapCache.java
@@ -19,6 +19,8 @@
 
 import java.util.concurrent.ConcurrentMap;
 
+import org.jspecify.annotations.Nullable;
+
 import com.github.benmanes.caffeine.cache.BasicCache;
 
 /**
@@ -32,7 +34,7 @@ public ConcurrentMapCache(ConcurrentMap<K, V> map) {
   }
 
   @Override
-  public V get(K key) {
+  public @Nullable V get(K key) {
     return map.get(key);
   }
 
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/GuavaCache.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/GuavaCache.java
index 4c2d8604ff..c02ee809f1 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/GuavaCache.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/GuavaCache.java
@@ -17,6 +17,8 @@
 
 import static com.github.benmanes.caffeine.cache.CacheType.CONCURRENCY_LEVEL;
 
+import org.jspecify.annotations.Nullable;
+
 import com.github.benmanes.caffeine.cache.BasicCache;
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
@@ -36,7 +38,7 @@ public GuavaCache(int maximumSize) {
   }
 
   @Override
-  public V get(K key) {
+  public @Nullable V get(K key) {
     return cache.getIfPresent(key);
   }
 
diff --git a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/LinkedHashMapCache.java b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/LinkedHashMapCache.java
index 245b79ad60..603b90d76b 100644
--- a/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/LinkedHashMapCache.java
+++ b/caffeine/src/jmh/java/com/github/benmanes/caffeine/cache/impl/LinkedHashMapCache.java
@@ -18,6 +18,8 @@
 import java.util.LinkedHashMap;
 import java.util.Map;
 
+import org.jspecify.annotations.Nullable;
+
 import com.github.benmanes.caffeine.cache.BasicCache;
 
 /**
@@ -31,7 +33,7 @@ public LinkedHashMapCache(int maximumSize, boolean accessOrder) {
   }
 
   @Override
-  public V get(K key) {
+  public @Nullable V get(K key) {
     synchronized (map) {
       return map.get(key);
     }
diff --git a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/BoundedLocalCache.java b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/BoundedLocalCache.java
index ef72b5ad60..3d5d2314f2 100644
--- a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/BoundedLocalCache.java
+++ b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/BoundedLocalCache.java
@@ -3961,12 +3961,12 @@ static class BoundedLocalManualCache<K, V> implements LocalManualCache<K, V>, Se
     }
 
     @Override
-    public BoundedLocalCache<K, V> cache() {
+    public final BoundedLocalCache<K, V> cache() {
       return cache;
     }
 
     @Override
-    public Policy<K, V> policy() {
+    public final Policy<K, V> policy() {
       if (policy == null) {
         @SuppressWarnings("NullAway")
         Function<@Nullable V, @Nullable V> identity = identity();
diff --git a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/LocalCache.java b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/LocalCache.java
index c3dc388a31..8b3c291741 100644
--- a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/LocalCache.java
+++ b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/LocalCache.java
@@ -153,7 +153,7 @@ default void notifyOnReplace(K key, @Nullable V oldValue, V newValue) {
     }
   }
 
-  /** Decorates the remapping function to record statistics if enabled. */
+  /** Decorates the mapping function to record statistics if enabled, recording a miss if called. */
   default <T, R> Function<? super T, ? extends R> statsAware(
       Function<? super T, ? extends R> mappingFunction, boolean recordLoad) {
     if (!isRecordingStats()) {
diff --git a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/References.java b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/References.java
index b9d868ed1a..7a4efaaaea 100644
--- a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/References.java
+++ b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/References.java
@@ -190,22 +190,22 @@ public WeakKeyReference(@Nullable K key, @Nullable ReferenceQueue<K> queue) {
     }
 
     @Override
-    public Object getKeyReference() {
+    public final Object getKeyReference() {
       return this;
     }
 
     @Override
-    public boolean equals(@Nullable Object object) {
+    public final boolean equals(@Nullable Object object) {
       return referenceEquals(object);
     }
 
     @Override
-    public int hashCode() {
+    public final int hashCode() {
       return hashCode;
     }
 
     @Override
-    public String toString() {
+    public final String toString() {
       return String.format(US,
           "%s{key=%s, hashCode=%d}", getClass().getSimpleName(), get(), hashCode);
     }
diff --git a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/SnapshotEntry.java b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/SnapshotEntry.java
index da44b7ebda..223e1e21a8 100644
--- a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/SnapshotEntry.java
+++ b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/SnapshotEntry.java
@@ -40,10 +40,10 @@ class SnapshotEntry<K, V> implements CacheEntry<K, V> {
     this.key = requireNonNull(key);
     this.value = requireNonNull(value);
   }
-  @Override public K getKey() {
+  @Override public final K getKey() {
     return key;
   }
-  @Override public V getValue() {
+  @Override public final V getValue() {
     return value;
   }
   @Override public V setValue(V value) {
@@ -58,10 +58,10 @@ class SnapshotEntry<K, V> implements CacheEntry<K, V> {
   @Override public long refreshableAt() {
     return snapshot + Long.MAX_VALUE;
   }
-  @Override public long snapshotAt() {
+  @Override public final long snapshotAt() {
     return snapshot;
   }
-  @Override public boolean equals(@Nullable Object o) {
+  @Override public final boolean equals(@Nullable Object o) {
     if (o == this) {
       return true;
     } else if (!(o instanceof Map.Entry)) {
@@ -70,10 +70,10 @@ class SnapshotEntry<K, V> implements CacheEntry<K, V> {
     var entry = (Map.Entry<?, ?>) o;
     return key.equals(entry.getKey()) && value.equals(entry.getValue());
   }
-  @Override public int hashCode() {
+  @Override public final int hashCode() {
     return key.hashCode() ^ value.hashCode();
   }
-  @Override public String toString() {
+  @Override public final String toString() {
     return key + "=" + value;
   }
 
@@ -111,7 +111,7 @@ static class WeightedEntry<K, V> extends SnapshotEntry<K, V> {
       super(key, value, snapshot);
       this.weight = weight;
     }
-    @Override public int weight() {
+    @Override public final int weight() {
       return weight;
     }
   }
@@ -123,7 +123,7 @@ static class ExpirableEntry<K, V> extends SnapshotEntry<K, V> {
       super(key, value, snapshot);
       this.expiresAt = expiresAt;
     }
-    @Override public long expiresAt() {
+    @Override public final long expiresAt() {
       return expiresAt;
     }
   }
@@ -135,7 +135,7 @@ static class ExpirableWeightedEntry<K, V> extends WeightedEntry<K, V> {
       super(key, value, snapshot, weight);
       this.expiresAt = expiresAt;
     }
-    @Override public long expiresAt() {
+    @Override public final long expiresAt() {
       return expiresAt;
     }
   }
@@ -147,7 +147,7 @@ static class RefreshableExpirableEntry<K, V> extends ExpirableEntry<K, V> {
       super(key, value, snapshot, expiresAt);
       this.refreshableAt = refreshableAt;
     }
-    @Override public long refreshableAt() {
+    @Override public final long refreshableAt() {
       return refreshableAt;
     }
   }
diff --git a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/UnboundedLocalCache.java b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/UnboundedLocalCache.java
index c83e329a91..da02907beb 100644
--- a/caffeine/src/main/java/com/github/benmanes/caffeine/cache/UnboundedLocalCache.java
+++ b/caffeine/src/main/java/com/github/benmanes/caffeine/cache/UnboundedLocalCache.java
@@ -1035,12 +1035,12 @@ static class UnboundedLocalManualCache<K, V> implements LocalManualCache<K, V>,
     }
 
     @Override
-    public UnboundedLocalCache<K, V> cache() {
+    public final UnboundedLocalCache<K, V> cache() {
       return cache;
     }
 
     @Override
-    public Policy<K, V> policy() {
+    public final Policy<K, V> policy() {
       if (policy == null) {
         @SuppressWarnings("NullAway")
         Function<@Nullable V, @Nullable V> identity = identity();
diff --git a/examples/graal-native/gradle/libs.versions.toml b/examples/graal-native/gradle/libs.versions.toml
index 7f855f3b86..464d9dd31b 100644
--- a/examples/graal-native/gradle/libs.versions.toml
+++ b/examples/graal-native/gradle/libs.versions.toml
@@ -1,6 +1,6 @@
 [versions]
 caffeine = "3.1.8"
-graal = "0.10.3"
+graal = "0.10.4"
 junit = "5.11.3"
 truth = "1.4.4"
 versions = "0.51.0"
diff --git a/examples/hibernate/gradle/libs.versions.toml b/examples/hibernate/gradle/libs.versions.toml
index 7a55326197..d92085be1e 100644
--- a/examples/hibernate/gradle/libs.versions.toml
+++ b/examples/hibernate/gradle/libs.versions.toml
@@ -1,7 +1,7 @@
 [versions]
 caffeine = "3.1.8"
 h2 = "2.3.232"
-hibernate = "7.0.0.Beta2"
+hibernate = "7.0.0.Beta3"
 junit = "5.11.3"
 log4j2 = "3.0.0-beta2"
 truth = "1.4.4"
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index a8754db053..fa913b441d 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -3,11 +3,11 @@ asm = "9.7.1"
 auto-value = "1.11.0"
 awaitility = "4.2.2"
 bcel = "6.10.0"
-bnd = "7.0.0"
+bnd = "7.1.0"
 bouncycastle-jdk18on = "1.79"
 cache2k = "2.6.1.Final"
 caffeine = "3.1.8"
-checkstyle = "10.20.1"
+checkstyle = "10.20.2"
 coherence = "24.09"
 commons-collections4 = "4.4"
 commons-compress = "1.27.1"
@@ -18,7 +18,7 @@ commons-text = "1.12.0"
 concurrentlinkedhashmap = "1.4.2"
 config = "1.4.3"
 coveralls = "2.12.2"
-dependency-check = "11.1.0"
+dependency-check = "11.1.1"
 eclipse-collections = "12.0.0.M3"
 ehcache3 = "3.10.8"
 errorprone = "2.36.0"
@@ -41,7 +41,7 @@ hazelcast = "5.5.0"
 httpclient = "4.5.14"
 idea = "1.1.9"
 jackrabbit = "1.72.0"
-jackson = "2.18.1"
+jackson = "2.18.2"
 jacoco = "0.8.12"
 jakarta-inject = "2.0.1"
 jamm = "0.4.0"
@@ -52,19 +52,19 @@ jcache = "1.1.1"
 jcommander = "1.82"
 jctools = "4.0.5"
 jfreechart = "1.5.5"
-jgit = "7.0.0.202409031743-r"
+jgit = "7.1.0.202411261347-r"
 jmh = "1.37"
 jmh-plugin = "0.7.2"
 jmh-report = "0.9.6"
 joor = "0.9.15"
 jspecify = "1.0.0"
 json-bind = "1.0"
-jsoup = "1.18.1"
+jsoup = "1.18.3"
 junit-testng = "1.0.5"
 junit4 = "4.13.2"
 junit5 = "5.11.3"
 jvm-dependency-conflict-resolution = "2.1.2"
-kotlin = "2.0.21"
+kotlin = "2.1.0"
 lincheck = "2.34"
 mockito = "5.14.2"
 nexus-publish = "2.0.0"
@@ -75,15 +75,15 @@ okio-bom = "3.9.1"
 osgi-annotations = "1.5.1"
 osgi-function = "1.2.0"
 osgi-promise = "1.3.0"
-pax-exam = "4.13.5"
+pax-exam = "4.14.0"
 pax-url = "2.6.14"
 picocli = "4.7.6"
-pmd = "7.7.0"
-protobuf = "4.28.3"
+pmd = "7.8.0"
+protobuf = "4.29.1"
 slf4j = "2.0.16"
 slf4j-test = "3.0.1"
 snakeyaml = "2.3"
-sonarqube = "6.0.0.5145"
+sonarqube = "6.0.1.5171"
 spotbugs = "4.8.6"
 spotbugs-contrib = "7.6.8"
 spotbugs-plugin = "6.0.26"
diff --git a/gradle/plugins/src/main/kotlin/ProjectExtensions.kt b/gradle/plugins/src/main/kotlin/ProjectExtensions.kt
index 09f88e1b92..1a31f1058c 100644
--- a/gradle/plugins/src/main/kotlin/ProjectExtensions.kt
+++ b/gradle/plugins/src/main/kotlin/ProjectExtensions.kt
@@ -23,25 +23,21 @@ fun Project.defaultJvmArgs(): List<String> {
   return jvmArgs
 }
 
-fun caffeineSystemProperties(): Map<String, Any> {
-  return System.getProperties().stringPropertyNames()
+fun caffeineSystemProperties(): Map<String, Any> =
+  System.getProperties()
+    .stringPropertyNames()
     .filter { it.startsWith("caffeine") }
     .associateWith { System.getProperties().getProperty(it) }
-}
+fun isEarlyAccess(): Boolean = System.getenv("JDK_EA") == "true"
+fun isCI(): Boolean = !System.getenv("CI").isNullOrEmpty()
 
-fun isCI(): Boolean {
-  return !System.getenv("CI").isNullOrEmpty()
+val DisableStrongEncapsulationJvmArgs = buildList {
+  listOf("api", "code", "file", "main", "parser", "processing", "tree", "util").forEach {
+    add("--add-exports")
+    add("jdk.compiler/com.sun.tools.javac.$it=ALL-UNNAMED")
+  }
+  listOf("code", "comp", "parser").forEach {
+    add("--add-opens")
+    add("jdk.compiler/com.sun.tools.javac.$it=ALL-UNNAMED")
+  }
 }
-
-val DisableStrongEncapsulationJvmArgs = listOf(
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED",
-  "--add-exports", "jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED",
-  "--add-opens", "jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED",
-  "--add-opens", "jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
-  "--add-opens", "jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED")
diff --git a/gradle/plugins/src/main/kotlin/analyze/jmh.caffeine.gradle.kts b/gradle/plugins/src/main/kotlin/analyze/jmh.caffeine.gradle.kts
index 2fae57d274..f6aa9dee46 100644
--- a/gradle/plugins/src/main/kotlin/analyze/jmh.caffeine.gradle.kts
+++ b/gradle/plugins/src/main/kotlin/analyze/jmh.caffeine.gradle.kts
@@ -3,6 +3,8 @@ import org.gradle.plugins.ide.eclipse.model.Classpath
 import org.gradle.plugins.ide.eclipse.model.Library
 import me.champeau.jmh.JmhBytecodeGeneratorTask
 import me.champeau.jmh.JMHTask as JmhTask
+import net.ltgt.gradle.errorprone.errorprone
+import net.ltgt.gradle.nullaway.nullaway
 
 plugins {
   idea
@@ -92,6 +94,12 @@ tasks.withType<JmhBytecodeGeneratorTask>().configureEach {
   }
 }
 
+tasks.named<JavaCompile>("compileJmhJava").configure {
+  options.errorprone.nullaway {
+    externalInitAnnotations.add("org.openjdk.jmh.annotations.State")
+  }
+}
+
 tasks.named("jmhJar").configure {
   incompatibleWithConfigurationCache()
   outputs.cacheIf { true }
diff --git a/gradle/plugins/src/main/kotlin/lifecycle/java-library.caffeine.gradle.kts b/gradle/plugins/src/main/kotlin/lifecycle/java-library.caffeine.gradle.kts
index 5729dd717b..eeb0e7902a 100644
--- a/gradle/plugins/src/main/kotlin/lifecycle/java-library.caffeine.gradle.kts
+++ b/gradle/plugins/src/main/kotlin/lifecycle/java-library.caffeine.gradle.kts
@@ -37,16 +37,19 @@ tasks.withType<JavaCompile>().configureEach {
     languageVersion = javaRuntimeVersion
   }
 
-  options.compilerArgs.addAll(listOf("-Xlint:all", "-Xlint:-auxiliaryclass", "-Xlint:-classfile",
-    "-Xlint:-exports", "-Xlint:-processing", "-Xlint:-removal", "-Xlint:-requires-automatic",
-    "-parameters"))
-  if (isCI()) {
-    options.compilerArgs.add("-Werror")
-  }
-  if (javaVersion.canCompileOrRun(21)) {
-    options.compilerArgs.add("-proc:full")
+  options.apply {
+    javaModuleVersion = provider { version as String }
+    compilerArgs.addAll(listOf("-Xlint:all", "-Xlint:-auxiliaryclass", "-Xlint:-classfile",
+      "-Xlint:-exports", "-Xlint:-processing", "-Xlint:-removal", "-Xlint:-requires-automatic",
+      "-parameters"))
+    if (isCI()) {
+      compilerArgs.add("-Werror")
+    }
+    if (javaVersion.canCompileOrRun(21)) {
+      compilerArgs.add("-proc:full")
+    }
+    encoding = "UTF-8"
   }
-  options.encoding = "UTF-8"
 }
 
 tasks.withType<JavaExec>().configureEach {
diff --git a/gradle/plugins/src/main/kotlin/quality/errorprone.caffeine.gradle.kts b/gradle/plugins/src/main/kotlin/quality/errorprone.caffeine.gradle.kts
index 8324b83edc..115c71bedc 100644
--- a/gradle/plugins/src/main/kotlin/quality/errorprone.caffeine.gradle.kts
+++ b/gradle/plugins/src/main/kotlin/quality/errorprone.caffeine.gradle.kts
@@ -43,35 +43,38 @@ val downloadCaffeine by tasks.registering {
 tasks.withType<JavaCompile>().configureEach {
   dependsOn(downloadCaffeine)
 
-  options.forkOptions.jvmArgs!!.addAll(DisableStrongEncapsulationJvmArgs)
-  options.errorprone {
-    if (System.getenv("JDK_EA") == "true") {
-      isEnabled = false
-    }
-    allDisabledChecksAsWarnings = true
-
-    errorproneArgs.add(buildString {
-      append("-XepOpt:Refaster:NamePattern=^")
-      disabledRules().forEach { rule ->
-        append("(?!")
-        append(rule)
-        append(".*)")
+  options.apply {
+    forkOptions.jvmArgs!!.addAll(DisableStrongEncapsulationJvmArgs)
+    errorprone {
+      if (isEarlyAccess()) {
+        isEnabled = false
       }
-      append(".*")
-    })
-    disabledChecks().forEach { disable(it) }
-    errorChecks().forEach { error(it) }
+      allDisabledChecksAsWarnings = true
+
+      errorproneArgs.add(buildString {
+        append("-XepOpt:Refaster:NamePattern=^")
+        disabledRules().forEach { rule ->
+          append("(?!")
+          append(rule)
+          append(".*)")
+        }
+        append(".*")
+      })
+      disabledChecks().forEach { disable(it) }
+      errorChecks().forEach { error(it) }
 
-    nullaway {
-      if (name.contains("Test") || name.contains("Jmh")) {
-        disable()
+      nullaway {
+        if (name.contains("Test")) {
+          disable()
+        }
+        annotatedPackages.add("com.github.benmanes.caffeine")
+        annotatedPackages.add("com.google.common")
+        handleTestAssertionLibraries = true
+        checkOptionalEmptiness = true
+        suggestSuppressions = true
+        checkContracts = true
+        isJSpecifyMode = true
       }
-      annotatedPackages.add("com.github.benmanes.caffeine")
-      annotatedPackages.add("com.google.common")
-      checkOptionalEmptiness = true
-      suggestSuppressions = true
-      checkContracts = true
-      isJSpecifyMode = true
     }
   }
 }
diff --git a/gradle/plugins/src/main/kotlin/quality/jacoco.caffeine.gradle.kts b/gradle/plugins/src/main/kotlin/quality/jacoco.caffeine.gradle.kts
index fb0acc154e..6b518acc5e 100644
--- a/gradle/plugins/src/main/kotlin/quality/jacoco.caffeine.gradle.kts
+++ b/gradle/plugins/src/main/kotlin/quality/jacoco.caffeine.gradle.kts
@@ -22,7 +22,7 @@ tasks.withType<JacocoReport>().configureEach {
 }
 
 tasks.withType<Test>().configureEach {
-  if (System.getenv("JDK_EA") == "true") {
+  if (isEarlyAccess()) {
     systemProperty("net.bytebuddy.experimental", true)
     configure<JacocoTaskExtension> {
       isEnabled = false
diff --git a/jcache/src/test/java/com/github/benmanes/caffeine/jcache/configuration/TypesafeConfigurationTest.java b/jcache/src/test/java/com/github/benmanes/caffeine/jcache/configuration/TypesafeConfigurationTest.java
index 03ba869052..dceeda997a 100644
--- a/jcache/src/test/java/com/github/benmanes/caffeine/jcache/configuration/TypesafeConfigurationTest.java
+++ b/jcache/src/test/java/com/github/benmanes/caffeine/jcache/configuration/TypesafeConfigurationTest.java
@@ -56,6 +56,7 @@ public void before() {
   }
 
   @Test
+  @SuppressWarnings("NullAway")
   public void setConfigSource_supplier() {
     TypesafeConfigurator.setConfigSource(() -> null);
     assertThat(configSource()).isNotSameInstanceAs(defaultConfigSource);
@@ -65,6 +66,7 @@ public void setConfigSource_supplier() {
   }
 
   @Test
+  @SuppressWarnings("NullAway")
   public void setConfigSource_function() {
     TypesafeConfigurator.setConfigSource((uri, loader) -> null);
     assertThat(configSource()).isNotSameInstanceAs(defaultConfigSource);
@@ -74,6 +76,7 @@ public void setConfigSource_function() {
   }
 
   @Test
+  @SuppressWarnings("NullAway")
   public void configSource_null() {
     assertThrows(NullPointerException.class, () -> configSource().get(null, null));
     assertThrows(NullPointerException.class, () -> configSource().get(null, classloader));