the support core plugin has a non optional transitive dependency on com.google.code.findbugs:jsr305.

Regardless of the ins and outs of the validity of this the library is provided by jenkins, and is an annotation so should not be provided.

This causes the library to be included in plugins that depend on support-core