spotbugs

[dkwakkel]

Is it possible that you move to spotbugs? This because findbugs seems no longer maintained. (also e.g. if a security issue is found it will be fixed in spotbugs)

https://sourceforge.net/p/findbugs/bugs/1487/

[AgraVator]

Hi,
Thanks for pointing out. Would you be willing to raise a PR for the same ?

[ejona86]

We aren't really using findbugs. We're only using annotations in jsr305 from findbugs, which isn't part of spotbugs. Spotbugs does have its own copy (with different name) of some of the annotations, but not the ones we'd actually want to use.

I already cleaned up some of the jsr305 references in:
7b5d069
70825ad

Nullable will need to change to JSpecify, although we're already seeing compatibility issues caused by JSpecify before we started migrating. We'll have to plan it out.

We'll need to carefully consider migrating the concurrent annotations to errorprone, as their semantics aren't necessarily identical. Anyone could take a stab at that, as long as they check for semantic differences first.