We are currently using the JSR305 annotations ( https://mvnrepository.com/artifact/com.google.code.findbugs/jsr305 ) which has an Apache 2.0 license. What it /looks/ like to me is that someone decided that everything in the javax/annotation directory had a CC-BY-2.5 license. I wasn't able to find any information on that via a quick search, but maybe you have more context on that.
Thanks, Taylor
