Remove spotbugs-annotations dependencies (#3984)

.github/dependabot.yaml

@@ -90,9 +90,6 @@ updates:
     registries:
       - maven-central
     ignore:
-      # `com.github.spotbugs:spotbugs-annotations:4.9.0` and onwards require Java 11
-      - dependency-name: "com.github.spotbugs:spotbugs-annotations"
-        versions: [ "[4.9.0,)" ]
       # Jetty 10.x does not have an internal logging API
       - dependency-name: "org.eclipse.jetty:*"
         versions: [ "[10,)" ]

log4j-1.2-api/src/main/java/org/apache/log4j/DefaultThrowableRenderer.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.io.InterruptedIOException;
 import java.io.LineNumberReader;
@@ -25,6 +24,7 @@
 import java.io.StringWriter;
 import java.util.ArrayList;
 import org.apache.log4j.spi.ThrowableRenderer;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Default implementation of {@link ThrowableRenderer} using {@link Throwable#printStackTrace(PrintWriter)}.

log4j-1.2-api/src/main/java/org/apache/log4j/FileAppender.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.BufferedWriter;
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -27,6 +26,7 @@
 import org.apache.log4j.helpers.LogLog;
 import org.apache.log4j.helpers.QuietWriter;
 import org.apache.log4j.spi.ErrorCode;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * FileAppender appends log events to a file.

log4j-1.2-api/src/main/java/org/apache/log4j/Hierarchy.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.util.Enumeration;
 import java.util.Hashtable;
 import java.util.Vector;
@@ -38,6 +37,7 @@
 import org.apache.logging.log4j.spi.AbstractLoggerAdapter;
 import org.apache.logging.log4j.spi.LoggerContext;
 import org.apache.logging.log4j.util.StackLocatorUtil;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 // WARNING This class MUST not have references to the Category or
 // WARNING RootCategory classes in its static initialization neither

log4j-1.2-api/src/main/java/org/apache/log4j/PropertyConfigurator.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InterruptedIOException;
@@ -51,6 +50,7 @@
 import org.apache.logging.log4j.core.net.UrlConnectionFactory;
 import org.apache.logging.log4j.util.PropertiesUtil;
 import org.apache.logging.log4j.util.StackLocatorUtil;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Configures Log4j from properties.

log4j-1.2-api/src/main/java/org/apache/log4j/RollingFileAppender.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.File;
 import java.io.IOException;
 import java.io.InterruptedIOException;
@@ -25,6 +24,7 @@
 import org.apache.log4j.helpers.LogLog;
 import org.apache.log4j.helpers.OptionConverter;
 import org.apache.log4j.spi.LoggingEvent;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * RollingFileAppender extends FileAppender to backup the log files when they reach a certain size.

log4j-1.2-api/src/main/java/org/apache/log4j/helpers/FileWatchdog.java

@@ -16,8 +16,8 @@
  */
 package org.apache.log4j.helpers;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.File;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Checks every now and then that a certain file has not changed. If it has, then call the {@link #doOnChange} method.

log4j-1.2-api/src/main/java/org/apache/log4j/helpers/UtilLoggingLevel.java

@@ -18,10 +18,10 @@
 
 import static org.apache.logging.log4j.util.Strings.toRootUpperCase;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.log4j.Level;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * An extension of the Level class that provides support for java.util.logging Levels.

log4j-1.2-api/src/main/java/org/apache/log4j/layout/Log4j1XmlLayout.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j.layout;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.nio.charset.StandardCharsets;
@@ -33,6 +32,7 @@
 import org.apache.logging.log4j.core.util.Transform;
 import org.apache.logging.log4j.util.ReadOnlyStringMap;
 import org.apache.logging.log4j.util.Strings;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Port of XMLLayout in Log4j 1.x. Provided for compatibility with existing Log4j 1 configurations.

log4j-1.2-api/src/main/java/org/apache/log4j/xml/DOMConfigurator.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j.xml;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -43,6 +42,7 @@
 import org.apache.logging.log4j.core.net.UrlConnectionFactory;
 import org.apache.logging.log4j.core.util.IOUtils;
 import org.apache.logging.log4j.util.PropertiesUtil;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.w3c.dom.Element;
 
 /**

log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java

@@ -16,7 +16,6 @@
  */
 package org.apache.log4j.xml;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.io.InterruptedIOException;
 import java.util.HashMap;
@@ -50,6 +49,7 @@
 import org.apache.logging.log4j.core.filter.ThresholdFilter;
 import org.apache.logging.log4j.status.StatusLogger;
 import org.apache.logging.log4j.util.LoaderUtil;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NamedNodeMap;

log4j-api-test/src/main/java/org/apache/logging/log4j/test/TestLogger.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.test;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;
 import java.util.ArrayList;
@@ -28,6 +27,7 @@
 import org.apache.logging.log4j.message.Message;
 import org.apache.logging.log4j.message.MessageFactory;
 import org.apache.logging.log4j.spi.AbstractLogger;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  *

log4j-api-test/src/main/java/org/apache/logging/log4j/test/junit/DirectoryCleaner.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.test.junit;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
@@ -26,6 +25,7 @@
 import java.nio.file.attribute.BasicFileAttributes;
 import java.util.Collection;
 import java.util.HashSet;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.junit.jupiter.api.extension.ExtensionContext;
 
 class DirectoryCleaner extends AbstractFileCleaner {

log4j-api-test/src/main/java/org/apache/logging/log4j/test/junit/FileCleaner.java

@@ -16,13 +16,13 @@
  */
 package org.apache.logging.log4j.test.junit;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Collection;
 import java.util.HashSet;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.junit.jupiter.api.extension.ExtensionContext;
 
 class FileCleaner extends AbstractFileCleaner {

log4j-api-test/src/main/java/org/apache/logging/log4j/test/junit/SerialUtil.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.test.junit;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -27,6 +26,7 @@
 import java.io.Serializable;
 import org.apache.logging.log4j.util.Constants;
 import org.apache.logging.log4j.util.FilteredObjectInputStream;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Utility class to facilitate serializing and deserializing objects.

log4j-api-test/src/test/java/org/apache/logging/log4j/status/StatusLoggerDateTest.java

@@ -18,11 +18,11 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
-import edu.umd.cs.findbugs.annotations.Nullable;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.time.format.DateTimeFormatter;
 import java.util.Properties;
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.CsvSource;

log4j-api/src/main/java/org/apache/logging/log4j/simple/SimpleLogger.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.simple;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.PrintStream;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
@@ -30,6 +29,7 @@
 import org.apache.logging.log4j.spi.AbstractLogger;
 import org.apache.logging.log4j.util.PropertiesUtil;
 import org.apache.logging.log4j.util.Strings;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * This is the default logger that is used when no suitable logging implementation is available.

log4j-api/src/main/java/org/apache/logging/log4j/simple/SimpleLoggerContext.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.simple;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.PrintStream;
 import org.apache.logging.log4j.Level;
 import org.apache.logging.log4j.message.MessageFactory;
@@ -26,6 +25,7 @@
 import org.apache.logging.log4j.spi.LoggerContext;
 import org.apache.logging.log4j.spi.LoggerRegistry;
 import org.apache.logging.log4j.util.PropertiesUtil;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.jspecify.annotations.Nullable;
 
 /**

log4j-api/src/main/java/org/apache/logging/log4j/status/StatusConsoleListener.java

@@ -18,13 +18,13 @@
 
 import static java.util.Objects.requireNonNull;
 
-import edu.umd.cs.findbugs.annotations.Nullable;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.PrintStream;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
 import org.apache.logging.log4j.Level;
+import org.jspecify.annotations.Nullable;
 
 /**
  * A {@link StatusListener} that writes to the console.

log4j-api/src/main/java/org/apache/logging/log4j/status/StatusData.java

@@ -19,15 +19,15 @@
 import static java.util.Objects.requireNonNull;
 import static org.apache.logging.log4j.util.Chars.SPACE;
 
-import edu.umd.cs.findbugs.annotations.Nullable;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;
 import java.io.Serializable;
 import java.time.Instant;
 import java.time.format.DateTimeFormatter;
 import org.apache.logging.log4j.Level;
 import org.apache.logging.log4j.message.Message;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
+import org.jspecify.annotations.Nullable;
 
 /**
  * The Status data.

log4j-api/src/main/java/org/apache/logging/log4j/status/StatusLogger.java

@@ -18,8 +18,6 @@
 
 import static java.util.Objects.requireNonNull;
 
-import edu.umd.cs.findbugs.annotations.Nullable;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
@@ -46,6 +44,8 @@
 import org.apache.logging.log4j.message.ParameterizedNoReferenceMessageFactory;
 import org.apache.logging.log4j.spi.AbstractLogger;
 import org.apache.logging.log4j.util.Constants;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Records events that occur in the logging system.

log4j-api/src/main/java/org/apache/logging/log4j/util/PropertyFilePropertySource.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.util;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;

log4j-api/src/main/java/org/apache/logging/log4j/util/ProviderUtil.java

@@ -21,7 +21,6 @@
 import aQute.bnd.annotation.Cardinality;
 import aQute.bnd.annotation.Resolution;
 import aQute.bnd.annotation.spi.ServiceConsumer;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.net.URL;
 import java.util.Collection;

log4j-api/src/main/java/org/apache/logging/log4j/util/SuppressFBWarnings.java

@@ -0,0 +1,33 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.util;
+
+/**
+ * Annotation to suppress SpotBugs warnings.
+ */
+@InternalApi
+public @interface SuppressFBWarnings {
+    /**
+     * @return specific pattern names to suppress
+     */
+    String[] value() default {};
+
+    /**
+     * @return optional comment why it should be suppressed
+     */
+    String justification() default "";
+}

log4j-api/src/main/java/org/apache/logging/log4j/util/internal/SerializationUtil.java

@@ -16,7 +16,6 @@
  */
 package org.apache.logging.log4j.util.internal;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -31,6 +30,7 @@
 import java.util.List;
 import org.apache.logging.log4j.status.StatusLogger;
 import org.apache.logging.log4j.util.FilteredObjectInputStream;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 
 /**
  * Provides methods to increase the safety of object serialization/deserialization.

log4j-appserver/src/main/java/org/apache/logging/log4j/appserver/jetty/Log4j2Logger.java

@@ -16,11 +16,11 @@
  */
 package org.apache.logging.log4j.appserver.jetty;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.logging.log4j.Level;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.spi.ExtendedLogger;
 import org.apache.logging.log4j.spi.LoggerContext;
+import org.apache.logging.log4j.util.SuppressFBWarnings;
 import org.eclipse.jetty.util.log.AbstractLogger;
 import org.eclipse.jetty.util.log.Logger;