diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..88b91390
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,29 @@
+version: 2
+updates:
+- package-ecosystem: "maven"
+  directory: "/"
+  schedule:
+    interval: "monthly"
+  open-pull-requests-limit: 10
+  groups:
+    upstream-libs:
+      patterns:
+      - "*"
+      exclude-patterns:
+      - "*checkerframework*"
+      - "*maven.plugins*"
+    checker-framework:
+      patterns:
+      - "*checkerframework*"
+    maven-plugins:
+      patterns:
+      - "*maven.plugins*"
+
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "monthly"
+  groups:
+    gh-actions:
+      patterns:
+      - "*" # group all GH action upgrades in a single PR
diff --git a/pom.xml b/pom.xml
index 2ec05ce9..e3c2869d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -71,9 +71,9 @@
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <checkerframework.version>3.42.0</checkerframework.version>
-    <junit.version>5.10.2</junit.version>
-    <log4j.version>2.23.0</log4j.version>
+    <checkerframework.version>3.49.2</checkerframework.version>
+    <junit.version>5.12.2</junit.version>
+    <log4j.version>2.24.3</log4j.version>
     <maven.compiler.source>11</maven.compiler.source>
     <maven.compiler.target>11</maven.compiler.target>
   </properties>
@@ -204,7 +204,7 @@
     <dependency>
       <groupId>org.awaitility</groupId>
       <artifactId>awaitility</artifactId>
-      <version>4.2.2</version>
+      <version>4.3.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/src/main/java/engineering/swat/watch/impl/overflows/IndexingRescanner.java b/src/main/java/engineering/swat/watch/impl/overflows/IndexingRescanner.java
index 4dcf2ac5..1d158903 100644
--- a/src/main/java/engineering/swat/watch/impl/overflows/IndexingRescanner.java
+++ b/src/main/java/engineering/swat/watch/impl/overflows/IndexingRescanner.java
@@ -44,6 +44,7 @@
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.checkerframework.checker.nullness.qual.NonNull;
 import org.checkerframework.checker.nullness.qual.Nullable;
 
 import engineering.swat.watch.WatchEvent;
@@ -59,7 +60,7 @@ public IndexingRescanner(Executor exec, Path path, WatchScope scope) {
         new Indexer(path, scope).walkFileTree(); // Make an initial scan to populate the index
     }
 
-    private static class PathMap<V> {
+    private static class PathMap<V extends @NonNull Object > {
         private final Map<Path, Map<Path, V>> values = new ConcurrentHashMap<>();
         //                ^^^^      ^^^^
         //                Parent    File name (regular file or directory)
@@ -85,7 +86,7 @@ public Set<Path> getFileNames(Path parent) {
             return apply(this::remove, p);
         }
 
-        private static <V> @Nullable V apply(BiFunction<Path, Path, @Nullable V> action, Path p) {
+        private static <V extends @Nullable Object> V apply(BiFunction<Path, Path, V> action, Path p) {
             var parent = p.getParent();
             var fileName = p.getFileName();
             if (parent != null && fileName != null) {