Re: Idea: remove spotbugs-annotations dependency, PR 3985

I think we should be able to get rid of the spotbugs annotations now that we use JSpecify.

> On Nov 19, 2025, at 5:53 AM, Volkan Yazıcı <[email protected]> wrote:
> 
> Hello Vladimir,
> 
> Thanks for reaching out to us. I've seen the Issue (#3984
> <https://github.com/apache/logging-log4j2/issues/3984>) and PR (#3985
> <https://github.com/apache/logging-log4j2/pull/3985>) you submitted, and
> I've very briefly discussed it with Piotr. We try to meet with him every
> Friday and do some Issue/PR triage, if not earlier. Please allow us some
> time.
> 
> Kind regards.
> 
> 
> 
> 
> On Wed, Nov 19, 2025 at 11:05 AM Vladimir Sitnikov <
> [email protected]> wrote:
> 
>> Hi,
>> 
>> Currently, log4j2 brings spotbugs-annotations and its
>> transitive com.google.code.findbugs:jsr305 to compile classpath
>> for log4j2 users.
>> 
>> In the Apache JMeter project, log4j brings those annotation dependencies
>> which are completely unwanted as they
>> bring a couple of new @Nullable annotations to the classpath.
>> 
>> For log4j2 spotbugs-annotations are harmful as well: log4j2 mistakingly
>> uses "findbugs.annotations.Nullable"
>> instead of jspecify's nullability annotations.
>> 
>> Could you please drop spotbugs-annotations dependency from log4j2?
>> 
>> PS I see there are lots of checks in PR that fail, and I find log4j2 CI
>> hard to contribute to.
>> Hope it won't take long for the committers to make CI happy.
>> 
>> Vladimir
>>