I think we should be able to get rid of the spotbugs annotations now that we use JSpecify.
> On Nov 19, 2025, at 5:53 AM, Volkan Yazıcı <[email protected]> wrote: > > Hello Vladimir, > > Thanks for reaching out to us. I've seen the Issue (#3984 > <https://github.com/apache/logging-log4j2/issues/3984>) and PR (#3985 > <https://github.com/apache/logging-log4j2/pull/3985>) you submitted, and > I've very briefly discussed it with Piotr. We try to meet with him every > Friday and do some Issue/PR triage, if not earlier. Please allow us some > time. > > Kind regards. > > > > > On Wed, Nov 19, 2025 at 11:05 AM Vladimir Sitnikov < > [email protected]> wrote: > >> Hi, >> >> Currently, log4j2 brings spotbugs-annotations and its >> transitive com.google.code.findbugs:jsr305 to compile classpath >> for log4j2 users. >> >> In the Apache JMeter project, log4j brings those annotation dependencies >> which are completely unwanted as they >> bring a couple of new @Nullable annotations to the classpath. >> >> For log4j2 spotbugs-annotations are harmful as well: log4j2 mistakingly >> uses "findbugs.annotations.Nullable" >> instead of jspecify's nullability annotations. >> >> Could you please drop spotbugs-annotations dependency from log4j2? >> >> PS I see there are lots of checks in PR that fail, and I find log4j2 CI >> hard to contribute to. >> Hope it won't take long for the committers to make CI happy. >> >> Vladimir >>
