From 08cc0bed2a73ca3e68e8104ddb3c16f542126d80 Mon Sep 17 00:00:00 2001
From: mihirchandna <mchandna@confluent.io>
Date: Wed, 3 Jun 2026 12:23:50 +0530
Subject: [PATCH] Add provided entry for findbugs so they are not shipped in CP
 packages

---
 pom.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pom.xml b/pom.xml
index d1ff7756a98..a417db69300 100644
--- a/pom.xml
+++ b/pom.xml
@@ -576,6 +576,15 @@
                 <version>${spotbugs.version}</version>
                 <scope>provided</scope>
             </dependency>
+            <!-- CPBR-3642: LGPL-2.1 findbugs annotations are compile-time only and pulled
+                 transitively (jackson-datatype-protobuf). Force provided so they are not
+                 bundled into shipped packages. -->
+            <dependency>
+                <groupId>com.google.code.findbugs</groupId>
+                <artifactId>annotations</artifactId>
+                <version>3.0.1</version>
+                <scope>provided</scope>
+            </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>