Externalreferences in practice appears to be (temporarily?) nullable, but is not marked as such about ossindex-public HOT 1 CLOSED

Hi @aikebah - thanks for the bug report! I wasn't able to reproduce the issue locally, even by forcing the system to return zero external references. The API endpoint should always return that field, and do so with an empty list if necessary. There are internal tests that verify this case.

I agree though that it's better to add a null check in the getter, which also follows the existing pattern set in other methods not marked with @Nullable. The change that fixes this issue was just released as part of 1.8.1:
https://github.com/sonatype/ossindex-public/releases/tag/release-1.8.1

from ossindex-public.