JSR-305 annotations replacement for Java 9

So far we have been using the Findbugs JSR-305 annotations (com.google.code.findbugs:jsr305) and everything including tool support (Sonar, Eclipse, Findbugs, …) has been working fine.

However it is our understanding that Jigsaw in Java 9 is going to break JSR-305 annotations (one package in two modules is not allowed). This was confirmed at JavaOne 2015. Oracle's reasoning is JSR-305 never happened and JSR-250 would have to endorse these annotations.

We're looking for replacements for JSR-305 annotations that work in both Java 8 and Java 9. If history is any guide the time between Java 9 GA and Java 8 EOL will be rather short and we would like to fix any incompatibilities in our code in advance. In theory we could upgrade the annotations module of the JDK but doing this across our toolchain seems like a lot of work.

It’s true that two modules cannot, ordinarily, define types in the same package. Until recently, putting jsr305.jar on the class path of a JDK 9 build would have no effect: That JAR file defines types in the javax.annotation package but that package is defined in the platform’s built-in java.annotations.common module, and the latter takes precedence.

Owing in part to the widespread use of jsr305.jar, however, and also to make it easier for existing application servers to migrate to JDK 9, we changed the default set of root modules to exclude the annotations module, among others. Putting jsr305.jar on the JDK 9 class path works out-of-the-box with both JDK 9 and JDK 10; details are available in JEP 261. It will continue to work out-of-the-box with later releases since the annotations module, along with all the other Java EE and CORBA modules, were removed in JDK 11 per JEP 320.