@Nullable prevents code from being compiled with -Werror

[wilkinsona]

Affects: 5.2.6.RELEASE

Code that uses @Nullable cannot be compiled with -Werror due to the use of When.MAYBE on its @Nonnull meta-annotation. Attempting to compile code that depends on spring-core and that uses @Nullable results in a compilation failure:

warning: unknown enum constant When.MAYBE
  reason: class file for javax.annotation.meta.When not found
error: warnings found and -Werror specified
1 error
1 warning

Unfortunately, there's no way to suppress such warnings so I either have to abandon trying to compile with -Werror or I have to add a dependency on com.google.code.findbugs:jsr305:3.0.2.

[sdeleuze]

Indeed, Java compiler does not trigger warning for missing annotations from the classpath except sadly when it is using such enum attribute, and we must use it. Notice this warning appears only if you are using null-safety annotations in your codebase, so end user projects won't see it until they start using our null-safety annotations in their codebase which has been evaluated as reasonably fine for Spring Framework and Spring Data.

I recommend using com.google.code.findbugs:jsr305:3.0.2 dependency as you suggested for now with provided scope or similar. Be aware that we are working on a proper replacement of JSR 305 that will not have this drawback, feel free to ping me if you want more details about that.

[jhoeller]

Assuming that this is not a regression in a specific place but rather the same general problem since 5.0, there is indeed no way out for the time being. I'd recommend adding the dependency as well since -Werror is worth preserving for other purposes.

[skagedal]

@sdeleuze Is there an issue to follow for this, to not have to have the explicit include?

Be aware that we are working on a proper replacement of JSR 305 that will not have this drawback,

[skagedal]

Ah, I guess it's this?

[sdeleuze]

Yes, but we may update our plans based on a potential nullness future JEP. I will update the issue you linked as we learn more.

[xenoterracide]

I'd like to point out that this issue could be "resolved" to some extent by simply switching findbugs jsr305 dependency to compileOnlyApi (at least for gradle users, not looking at what this creates for maven users at the moment) but that won't solve the problem with JPMS, not certain whether it would make that worse. It's the appropriate fix for this though.