Upgrade findbugs:jsr305 and stop providing from container-dev

- Version is linked to guava version (see guava-parent)

6 files changed, 13 insertions, 17 deletions

diff --git a/cloud-tenant-base-dependencies-enforcer/pom.xml b/cloud-tenant-base-dependencies-enforcer/pom.xml
index 1e0a87ef86e..56da8c20922 100644
--- a/cloud-tenant-base-dependencies-enforcer/pom.xml
+++ b/cloud-tenant-base-dependencies-enforcer/pom.xml
@@ -35,7 +35,6 @@
         <bouncycastle.version>1.68</bouncycastle.version>
         <felix.version>7.0.1</felix.version>
         <felix.log.version>1.0.1</felix.log.version>
-        <findbugs.version>1.3.9</findbugs.version>
         <guava.version>27.1-jre</guava.version>
         <guice.version>4.2.3</guice.version>
         <javax.inject.version>1</javax.inject.version>
@@ -94,7 +93,6 @@
                                         <include>com.fasterxml.jackson.module:jackson-module-jaxb-annotations:[2.5.4, ${jackson2.version}]:jar:provided</include>
 
                                         <!-- guava with dependencies -->
-                                        <include>com.google.code.findbugs:jsr305:[${findbugs.version}]:jar:provided</include>
                                         <include>com.google.guava:guava:[${guava.version}]:jar:provided</include>
                                         <include>com.google.errorprone:error_prone_annotations:[2.2.0]:jar:provided</include>
                                         <include>com.google.guava:failureaccess:[1.0.1]:jar:provided</include>
diff --git a/component/pom.xml b/component/pom.xml
index d4d8400f397..40837457b17 100755
--- a/component/pom.xml
+++ b/component/pom.xml
@@ -44,12 +44,6 @@
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <!-- Needed by guava, which has an optional dependency on jsr305.
-      Not optional here, to avoid the need to add it to a lot of dependent modules. -->
-      <groupId>com.google.code.findbugs</groupId>
-      <artifactId>jsr305</artifactId>
-    </dependency>
-    <dependency>
       <groupId>com.yahoo.vespa</groupId>
       <artifactId>config-lib</artifactId>
       <version>${project.version}</version>
diff --git a/container-dependencies-enforcer/pom.xml b/container-dependencies-enforcer/pom.xml
index d716bba60ae..10105245c6b 100644
--- a/container-dependencies-enforcer/pom.xml
+++ b/container-dependencies-enforcer/pom.xml
@@ -72,7 +72,6 @@
                                         <include>com.fasterxml.jackson.module:jackson-module-jaxb-annotations:[2.5.4, ${jackson2.version}]:jar:provided</include>
 
                                         <!-- guava with dependencies -->
-                                        <include>com.google.code.findbugs:jsr305:[${findbugs.version}]:jar:provided</include>
                                         <include>com.google.guava:guava:[${guava.version}]:jar:provided</include>
                                         <include>com.google.errorprone:error_prone_annotations:[2.2.0]:jar:provided</include>
                                         <include>com.google.guava:failureaccess:[1.0.1]:jar:provided</include>
diff --git a/container-dependency-versions/pom.xml b/container-dependency-versions/pom.xml
index d4dc8d026de..6788e3530b2 100644
--- a/container-dependency-versions/pom.xml
+++ b/container-dependency-versions/pom.xml
@@ -78,13 +78,6 @@
                 <version>${jackson2.version}</version>
             </dependency>
             <dependency>
-                <!-- Not provided runtime, but necessary to build with guava in many cases.
-                     Guava has an optional dep on this and uses the annotations in some classes. -->
-                <groupId>com.google.code.findbugs</groupId>
-                <artifactId>jsr305</artifactId>
-                <version>${findbugs.version}</version>
-            </dependency>
-            <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
                 <version>${guava.version}</version>
@@ -400,7 +393,6 @@
         <bouncycastle.version>1.68</bouncycastle.version>
         <felix.version>7.0.1</felix.version>
         <felix.log.version>1.0.1</felix.log.version>
-        <findbugs.version>1.3.9</findbugs.version>
         <guava.version>27.1-jre</guava.version>
         <guice.version>4.2.3</guice.version>
         <javax.inject.version>1</javax.inject.version>
diff --git a/container-dev/pom.xml b/container-dev/pom.xml
index 6268e1e6fb4..1c889448a40 100644
--- a/container-dev/pom.xml
+++ b/container-dev/pom.xml
@@ -42,6 +42,13 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
+      <exclusions>
+        <exclusion>
+          <!-- Annotations with retention Runtime. Remove exclusion and provide from jdisc_core if needed. -->
+          <groupId>com.google.code.findbugs</groupId>
+          <artifactId>jsr305</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>javax.servlet</groupId>
diff --git a/parent/pom.xml b/parent/pom.xml
index c53fbf8f394..398af664de7 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -474,6 +474,11 @@
                 <version>2.6.0</version>
             </dependency>
             <dependency>
+                <groupId>com.google.code.findbugs</groupId>
+                <artifactId>jsr305</artifactId>
+                <version>${findbugs.version}</version>
+            </dependency>
+            <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava-testlib</artifactId>
                 <version>${guava.version}</version>
@@ -951,6 +956,7 @@
         <commons.codec.version>1.15</commons.codec.version>
         <commons.math3.version>3.6.1</commons.math3.version>
         <eclipse-collections.version>11.0.0</eclipse-collections.version>
+        <findbugs.version>3.0.2</findbugs.version> <!-- Should be kept in sync with guava -->
         <gson.version>2.8.9</gson.version>
         <hdrhistogram.version>2.1.12</hdrhistogram.version>
         <jna.version>5.11.0</jna.version>