[HBASE-16321] Ensure findbugs jsr305 jar isn't present

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 1.3.0, 1.1.6, 0.98.21, 1.2.3, 2.0.0
• Component/s: dependencies
• Hadoop Flags: Incompatible change
• Release Note: HBase now ensures the jsr305 implementation from the findbugs project is not included in its binary artifacts or the compile / runtime dependencies of its user facing modules. Downstream users that rely on this jar will need to update their dependencies.
• Assignee: Sean Busbey
• Reporter: Sean Busbey
• Created: 02/Aug/16 06:15
• Updated: 09/Nov/17 01:23
• Resolved: 08/Aug/16 00:50

Description

we should be using

<dependencies>
    <dependency>
      <groupId>com.github.stephenc.findbugs</groupId>
      <artifactId>findbugs-annotations</artifactId>
      <version>${findbugs-annotations}</version>
      <scope>compile</scope>
    </dependency>

to ensure we don't have a prohibited dependency, but it looks like we're still bringing in

<dependency>
         <groupId>com.google.code.findbugs</groupId>
         <artifactId>jsr305</artifactId>
         <version>${jsr305.version}</version>
      </dependency>

remove the findbugs version (even though the maven central pom claims the license is ALv2, that doesn't line up with the referenced project sites).