FindBugs upstream has been dead since 2016 and I would like to retire it from Fedora [1].

libidn currently has this dependency:

  BuildRequires: mvn(com.google.code.findbugs:annotations)

This seems to be because the libidn POM in java/pom.xml.in has this dependency:

      <dependency>
          <groupId>com.google.code.findbugs</groupId>
          <artifactId>annotations</artifactId>
          <version>2.0.1</version>
          <scope>provided</scope>
      </dependency>

That dependency can be downloaded here:

  https://search.maven.org/artifact/com.google.code.findbugs/annotations/2.0.1/jar

It provides classes in these packages:

  * edu.umd.cs.findbugs.annotations
  * javax.annotation (and subpackages)
  * net.jcip.annotations

All these packages contain the word "annotation". I can't see any reference to these packages in the libidn Java code:

  $ fedpkg sources
  
  $ tar -xf libidn-1.37.tar.gz
  
  $ cd libidn-1.37
  
  $ fgrep annotation $(find -name "*.java") | wc -l
  0

I think it's safe to remove the findbugs annotations dependency from libidn.

[1] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/YI723NBFFXAOQSRMYIEFAD6CYGX7S6MM/