33

What to import to use SuppressFBWarnings? I installed the findbugs plugin via help / install new software When I type import edu., I can't do ctrl space to get the options.

Example

try {
  String t = null;
  @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
    value="NP_ALWAYS_NULL", 
    justification="I know what I'm doing")
  int sl = t.length();
  System.out.printf( "Length is %d", sl );
} catch (Throwable e) {
...
}

Has error "edu cannot be resolved to a type"

barfuin
  • 16,865
  • 10
  • 85
  • 132

1 Answers1

34

In order to use the FindBugs annotations, you need to include annotations.jar and jsr305.jar from the FindBugs distribution on your classpath. If you are sure that you want the @SuppressFBWarnings annotation only (and not the others), then annotations.jar alone would be sufficient.

You can find the two JARs in the lib folder of the FindBugs distribution.

If you are using Maven:

<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>annotations</artifactId>
    <version>3.0.1</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>jsr305</artifactId>
    <version>3.0.1</version>
    <scope>provided</scope>
</dependency>

If you are using Gradle:

dependencies {
    compileOnly 'com.google.code.findbugs:annotations:3.0.1'
    compileOnly 'com.google.code.findbugs:jsr305:3.0.1'
}

compileOnly is the Gradle flavor of what Maven calls provided scope.

Update for SpotBugs (2018):

FindBugs has been superseded by SpotBugs. So if you are already using SpotBugs, the migration guide suggests that you use the following dependencies instead:

Please depend on both of spotbugs-annotations and net.jcip:jcip-annotations:1.0 instead.

Maven:

<dependency>
    <groupId>net.jcip</groupId>
    <artifactId>jcip-annotations</artifactId>
    <version>1.0</version>
    <optional>true</optional>
</dependency>
<dependency>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-annotations</artifactId>
    <version>3.1.3</version>
    <optional>true</optional>
</dependency>

Gradle:

dependencies {
    compileOnly 'net.jcip:jcip-annotations:1.0'
    compileOnly 'com.github.spotbugs:spotbugs-annotations:3.1.3'
}

If you also used jsr305, that dependency remains the same as above.

barfuin
  • 16,865
  • 10
  • 85
  • 132
  • why `optional` and not `provided` for spotbugs dependencies? – Jakub Bochenski Jul 04 '18 at 08:35
  • [Optional vs. Provided](https://stackoverflow.com/q/40393098/1005481) is a nice discussion. Here, it does not matter, as the dependencies are not needed at runtime. However, they must of course be on the classpath of the analysis run. @JakubBochenski – barfuin Jul 05 '18 at 10:54
  • I think `provided` is actually a better fit here. Optional dependencies are not packaged into wars, but some people consider it a bug: https://issues.apache.org/jira/browse/MWAR-351 However there is no (easy) way to exclude optional dependencies from maven assembly, whereas you can do that easily for `provided` scoped ones – Jakub Bochenski Jul 05 '18 at 14:30
  • 1
    I agree - which is why I used `provided`. The bottom part of my answer is a copy from the linked SpotBugs migration guide, and *they* preferred `optional`. Still, from a FindBugs/SpotBugs perspective, it doesn't matter, so you can use whatever suits you and your existing build process. – barfuin Jul 05 '18 at 14:54
  • 2
    In 2020, I used the single dependency: `implementation('com.github.spotbugs:spotbugs-annotations:4.0.0-RC3')`. I'm not sure if that would cover all cases here, but FWIW. – mm2001 Apr 25 '20 at 07:26
  • 1
    In 2021, ```implementation 'com.github.spotbugs:spotbugs-annotations:4.5.0'``` from [SpotBugs GitHub](https://github.com/spotbugs/spotbugs) following @mm2001 last update. – mikethe Nov 16 '21 at 23:27
  • Interestingly, one does not need any external jars. If you define your own SuppressFBWarnings annotation with CLASS retention, you can use that instead. The SpotBugs code literally looks only at the name of the annotation class, and it accept any annotation ending with "SuppressWarnings" or "SuppressFBWarnings" regardless of package. The SpotBugs annotations.jar file is small though, and it's simple to include that. – jbindel Apr 20 '22 at 23:54