What to import to use @SuppressFBWarnings?

Question

What to import to use SuppressFBWarnings? I installed the findbugs plugin via help / install new software When I type import edu., I can't do ctrl space to get the options.

Example

try {
  String t = null;
  @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
    value="NP_ALWAYS_NULL", 
    justification="I know what I'm doing")
  int sl = t.length();
  System.out.printf( "Length is %d", sl );
} catch (Throwable e) {
...
}

Has error "edu cannot be resolved to a type"

Alphonse

Answer 1

In order to use the FindBugs annotations, you need to include annotations.jar and jsr305.jar from the FindBugs distribution on your classpath. If you are sure that you want the @SuppressFBWarnings annotation only (and not the others), then annotations.jar alone would be sufficient.

You can find the two JARs in the lib folder of the FindBugs distribution.

If you are using Maven:

<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>annotations</artifactId>
    <version>3.0.1</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>jsr305</artifactId>
    <version>3.0.1</version>
    <scope>provided</scope>
</dependency>

If you are using Gradle:

dependencies {
    compileOnly 'com.google.code.findbugs:annotations:3.0.1'
    compileOnly 'com.google.code.findbugs:jsr305:3.0.1'
}

compileOnly is the Gradle flavor of what Maven calls provided scope.

---

Update for SpotBugs (2018):

FindBugs has been superseded by SpotBugs. So if you are already using SpotBugs, the migration guide suggests that you use the following dependencies instead:

Please depend on both of spotbugs-annotations and net.jcip:jcip-annotations:1.0 instead.

Maven:

<dependency>
    <groupId>net.jcip</groupId>
    <artifactId>jcip-annotations</artifactId>
    <version>1.0</version>
    <optional>true</optional>
</dependency>
<dependency>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-annotations</artifactId>
    <version>3.1.3</version>
    <optional>true</optional>
</dependency>

Gradle:

dependencies {
    compileOnly 'net.jcip:jcip-annotations:1.0'
    compileOnly 'com.github.spotbugs:spotbugs-annotations:3.1.3'
}

If you also used jsr305, that dependency remains the same as above.

Lundt

why optional and not provided for spotbugs dependencies? – Eugenol

Optional vs. Provided is a nice discussion. Here, it does not matter, as the dependencies are not needed at runtime. However, they must of course be on the classpath of the analysis run. @JakubBochenski – Lundt

I think provided is actually a better fit here. Optional dependencies are not packaged into wars, but some people consider it a bug: issues.apache.org/jira/browse/MWAR-351 However there is no (easy) way to exclude optional dependencies from maven assembly, whereas you can do that easily for provided scoped ones – Eugenol

I agree - which is why I used provided. The bottom part of my answer is a copy from the linked SpotBugs migration guide, and they preferred optional. Still, from a FindBugs/SpotBugs perspective, it doesn't matter, so you can use whatever suits you and your existing build process. – Lundt

In 2020, I used the single dependency: implementation('com.github.spotbugs:spotbugs-annotations:4.0.0-RC3'). I'm not sure if that would cover all cases here, but FWIW. – Ratiocination

In 2021, implementation 'com.github.spotbugs:spotbugs-annotations:4.5.0' from SpotBugs GitHub following @Ratiocination last update. – Sacrifice

Interestingly, one does not need any external jars. If you define your own SuppressFBWarnings annotation with CLASS retention, you can use that instead. The SpotBugs code literally looks only at the name of the annotation class, and it accept any annotation ending with "SuppressWarnings" or "SuppressFBWarnings" regardless of package. The SpotBugs annotations.jar file is small though, and it's simple to include that. – Jeaninejeanlouis