Migrate from JSR-305 to JSpecify

[erik-meuwese-topicus]

Migrate from JSR-305 tot JSpecify

Maven Build Cache Extension depends on JSR-250: Common Annotations for the Java Platform (javax.annotation) which exports the javax.annotation package. The JSR-305: Annotations for Software Defect Detection (jsr305) part of Google Findbugs also exports the javax.annotation package. With JPMS it's not possible to compile having both dependencies.

JSpecify standerdizes the @Nullable and @NonNull annotations.

Changes

• Replaced the dependency jsr305 with jspecify
• Replaced the @javax.annotation.Nonnull and @javax.annotation.Nullable annotation to the @org.jspecify.annotations.NonNull and @org.jspecify.annotations.Nullable annotations
• Added @Nullable to return values and parameters which could be null
• Added checks to PluginScanConfigImpl isSkip() and accept(tagName) to prevent NullPointenException when dto is null
• Added @NonNull to return values of CacheContext and CacheResult for values set with requireNonNull(value)
• Changed @NonNull to @Nullable in RemoteCacheRepository getResourceUrl(context, filename) because implementation RemoteCacheRepositoryNoOp returned null so it's nullable

Further improvement

When Maven Build Cache Extesion changes <javaVersion>8</javaVersion> in the pom.xml to Java 9+. Then it would become possible to remove all @NonNull annotations and annotate the packages with @NullMarked. Because @NullMarked targets MODULE which has been added in Java 9 so MODULE is not compatible with Java 8. With @NullMarked every return value and parameter is considered @NonNull unless annotated with @Nullable. This reduces the amount of annotations needed.

[olamy]

YAS :)

[olamy]

why it's not compile scope?

[erik-meuwese-topicus]

Compile is the default scope, used if none is specified. I added the scope to the dependency.

[olamy]

why not.
But to be honest, I do not see this as very useful as this doesn't fail the build if eventually the code returns null while there is an @Nonnull annotation.
And yes I agree it's already the case with current build as spotbugs plugin is not used :)
I find those annotations useful if they really check code and fail the build rather than simple documentation (nobody will really read)

[elharo]

@olamy beat me to it with my favorite xkcd

I don't want to add yet another new random dependency. If we're not majorly using these, and I don't think we are, and it's really causing an otherwise unfixable problem, let's just remove the nullability annotations

[elharo]

Maven Build Cache Extension depends on JSR-250: Common Annotations for the Java Platform (javax.annotation) which exports the javax.annotation package. The JSR-305: Annotations for Software Defect Detection (jsr305) part of Google Findbugs also exports the javax.annotation package. With JPMS it's not possible to compile having both dependencies.

Do we in fact have both dependencies? Why? Can we just get rid of findbugs?

If this is an actual problem, why are we not seeing it in the CI?