diff --git a/dev-support/docker/Dockerfile b/dev-support/docker/Dockerfile
index 3c1423d386c..74ed7508169 100644
--- a/dev-support/docker/Dockerfile
+++ b/dev-support/docker/Dockerfile
@@ -38,14 +38,13 @@ ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8
 # download sundry dependencies
 #
 
-FROM BASE_IMAGE AS FINDBUGS_DOWNLOAD_IMAGE
-# TODO: replace with Spotbugs HBASE-23077, HBASE-22383
-ENV FINDBUGS_VERSION '3.0.1'
-ENV FINDBUGS_URL "https://downloads.sourceforge.net/project/findbugs/findbugs/${FINDBUGS_VERSION}/findbugs-${FINDBUGS_VERSION}.tar.gz"
-ENV FINDBUGS_SHA256 'e80e0da0c213a27504ef3188ef25f107651700ffc66433eac6a7454bbe336419'
+FROM BASE_IMAGE AS SPOTBUGS_DOWNLOAD_IMAGE
+ENV SPOTBUGS_VERSION '3.1.12'
+ENV SPOTBUGS_URL "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SPOTBUGS_VERSION}/spotbugs-${SPOTBUGS_VERSION}.tgz"
+ENV SPOTBUGS_SHA256 '9c475d6c7096ed7af783e04dc2db40462145291de75a80029391600b6eb2d401'
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN curl --location --fail --silent --show-error --output /tmp/findbugs.tar.gz "${FINDBUGS_URL}" && \
-  echo "${FINDBUGS_SHA256} */tmp/findbugs.tar.gz" | sha256sum -c -
+RUN curl --location --fail --silent --show-error --output /tmp/spotbugs.tgz "${SPOTBUGS_URL}" && \
+  echo "${SPOTBUGS_SHA256} */tmp/spotbugs.tgz" | sha256sum -c -
 
 FROM BASE_IMAGE AS HADOLINT_DOWNLOAD_IMAGE
 ENV HADOLINT_VERSION '1.17.5'
@@ -133,10 +132,10 @@ RUN gem install --no-document \
   ruby-lint:2.3.1
 
 # hadolint ignore=DL3010
-COPY --from=FINDBUGS_DOWNLOAD_IMAGE /tmp/findbugs.tar.gz /tmp/findbugs.tar.gz
-RUN tar xzf /tmp/findbugs.tar.gz -C /opt && \
-  ln -s "/opt/$(dirname "$(tar -tf /tmp/findbugs.tar.gz | head -n1)")" /opt/findbugs && \
-  rm /tmp/findbugs.tar.gz
+COPY --from=SPOTBUGS_DOWNLOAD_IMAGE /tmp/spotbugs.tgz /tmp/spotbugs.tgz
+RUN tar xzf /tmp/spotbugs.tgz -C /opt && \
+  ln -s "/opt/$(tar -tf /tmp/spotbugs.tgz | head -n1 | cut -d/ -f1)" /opt/spotbugs && \
+  rm /tmp/spotbugs.tgz
 
 COPY --from=HADOLINT_DOWNLOAD_IMAGE /tmp/hadolint /tmp/hadolint
 RUN mv /tmp/hadolint /usr/local/bin && \
@@ -184,9 +183,9 @@ RUN mkdir -p /usr/lib/jvm && \
 # these values to be specified here; the various --foo-path flags do not
 # propigate as expected, while these are honored.
 # TODO (nd): is this really true? investigate and file a ticket.
-ENV FINDBUGS_HOME '/opt/findbugs'
+ENV SPOTBUGS_HOME '/opt/spotbugs'
 ENV MAVEN_HOME '/opt/maven'
-ENV MAVEN_OPTS '-Xms6G -Xmx6G'
+ENV MAVEN_OPTS '-Xms4G -Xmx4G'
 
 CMD ["/bin/bash"]
 
diff --git a/dev-support/hbase-personality.sh b/dev-support/hbase-personality.sh
index 0e1ae998eb8..ddb204cadaf 100755
--- a/dev-support/hbase-personality.sh
+++ b/dev-support/hbase-personality.sh
@@ -184,18 +184,30 @@ function personality_modules
     done
   fi
 
-  if [[ ${testtype} == findbugs ]]; then
-    # Run findbugs on each module individually to diff pre-patch and post-patch results and
+  if [[ ${testtype} == spotbugs ]]; then
+    # Run spotbugs on each module individually to diff pre-patch and post-patch results and
     # report new warnings for changed modules only.
-    # For some reason, findbugs on root is not working, but running on individual modules is
+    # For some reason, spotbugs on root is not working, but running on individual modules is
     # working. For time being, let it run on original list of CHANGED_MODULES. HBASE-19491
     for module in "${CHANGED_MODULES[@]}"; do
-      # skip findbugs on hbase-shell and hbase-it. hbase-it has nothing
-      # in src/main/java where findbugs goes to look
+      # skip spotbugs on hbase-shell and hbase-it. hbase-it has nothing
+      # in src/main/java where spotbugs goes to look
+      # skip hbase-shaded* as there is no java code in them
+      # skip all modules with no java code or at least, non test java code
       if [[ ${module} == hbase-shell ]]; then
         continue
       elif [[ ${module} == hbase-it ]]; then
         continue
+      elif [[ ${module} == hbase-shaded* ]]; then
+        continue
+      elif [[ ${module} == hbase-build-configuration ]]; then
+        continue
+      elif [[ ${module} == hbase-checkstyle ]]; then
+        continue
+      elif [[ ${module} == hbase-resource-bundle ]]; then
+        continue
+      elif [[ ${module} == hbase-testing-util ]]; then
+        continue
       else
         # shellcheck disable=SC2086
         personality_enqueue_module ${module} ${extra}
@@ -375,7 +387,7 @@ function refguide_rebuild
     $(maven_executor) clean site --batch-mode \
       -pl . \
       -Dtest=NoUnitTests -DHBasePatchProcess -Prelease \
-      -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dfindbugs.skip=true
+      -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dspotbugs.skip=true
 
   count=$(${GREP} -c '\[ERROR\]' "${logfile}")
   if [[ ${count} -gt 0 ]]; then
@@ -458,7 +470,7 @@ function shadedjars_rebuild
     $(maven_executor) clean verify -fae --batch-mode \
       -pl hbase-shaded/hbase-shaded-check-invariants -am \
       -Dtest=NoUnitTests -DHBasePatchProcess -Prelease \
-      -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dfindbugs.skip=true
+      -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dspotbugs.skip=true
 
   count=$(${GREP} -c '\[ERROR\]' "${logfile}")
   if [[ ${count} -gt 0 ]]; then
diff --git a/dev-support/jenkins_precommit_github_yetus.sh b/dev-support/jenkins_precommit_github_yetus.sh
index f88df0af2ad..e0ead27f0ab 100755
--- a/dev-support/jenkins_precommit_github_yetus.sh
+++ b/dev-support/jenkins_precommit_github_yetus.sh
@@ -104,14 +104,14 @@ YETUS_ARGS+=("--reapermode=kill")
 # with other jobs on systemd-enabled machines
 YETUS_ARGS+=("--proclimit=10000")
 YETUS_ARGS+=("--dockermemlimit=20g")
-# -1 findbugs issues that show up prior to the patch being applied
-YETUS_ARGS+=("--findbugs-strict-precheck")
+# -1 spotbugs issues that show up prior to the patch being applied
+YETUS_ARGS+=("--spotbugs-strict-precheck")
 # rsync these files back into the archive dir
 YETUS_ARGS+=("--archive-list=${ARCHIVE_PATTERN_LIST}")
 # URL for user-side presentation in reports and such to our artifacts
 YETUS_ARGS+=("--build-url-artifacts=${BUILD_URL_ARTIFACTS}")
 # plugins to enable
-YETUS_ARGS+=("--plugins=${PLUGINS}")
+YETUS_ARGS+=("--plugins=${PLUGINS},-findbugs")
 # run in docker mode and specifically point to our
 # Dockerfile since we don't want to use the auto-pulled version.
 YETUS_ARGS+=("--docker")
diff --git a/dev-support/findbugs-exclude.xml b/dev-support/spotbugs-exclude.xml
similarity index 100%
rename from dev-support/findbugs-exclude.xml
rename to dev-support/spotbugs-exclude.xml
diff --git a/hbase-archetypes/pom.xml b/hbase-archetypes/pom.xml
index 6964298f067..03735f56d05 100644
--- a/hbase-archetypes/pom.xml
+++ b/hbase-archetypes/pom.xml
@@ -49,11 +49,11 @@
              configuration of the hbase/pom.xml file. This override specifies that
              the excluded-filter-file is found TWO levels up from a grandchild project. -->
         <plugin>
-          <groupId>org.codehaus.mojo</groupId>
-          <artifactId>findbugs-maven-plugin</artifactId>
+          <groupId>com.github.spotbugs</groupId>
+          <artifactId>spotbugs-maven-plugin</artifactId>
           <configuration>
-            <excludeFilterFile>${project.basedir}/../../dev-support/findbugs-exclude.xml</excludeFilterFile>
-            <findbugsXmlOutput>true</findbugsXmlOutput>
+            <excludeFilterFile>${project.basedir}/../../dev-support/spotbugs-exclude.xml</excludeFilterFile>
+            <spotbugsXmlOutput>true</spotbugsXmlOutput>
             <xmlOutput>true</xmlOutput>
             <effort>Max</effort>
           </configuration>
@@ -64,16 +64,16 @@
       <!-- Special configuration for findbugs just in the parent, emulating the setup in
            hbase/pom.xml. Note that exclude-file-filter is found ONE level up from this project. -->
       <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
         <executions>
           <execution>
             <inherited>false</inherited>
             <goals>
-              <goal>findbugs</goal>
+              <goal>spotbugs</goal>
             </goals>
             <configuration>
-              <excludeFilterFile>${project.basedir}/../dev-support/findbugs-exclude.xml</excludeFilterFile>
+              <excludeFilterFile>${project.basedir}/../dev-support/spotbugs-exclude.xml</excludeFilterFile>
             </configuration>
           </execution>
         </executions>
diff --git a/hbase-client/pom.xml b/hbase-client/pom.xml
index 57b375c506b..ff0e8fbd4ba 100644
--- a/hbase-client/pom.xml
+++ b/hbase-client/pom.xml
@@ -100,6 +100,12 @@
       <artifactId>hbase-protocol</artifactId>
     </dependency>
     <!-- General dependencies -->
+    <dependency>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
@@ -200,11 +206,6 @@
         </property>
       </activation>
       <dependencies>
-        <dependency>
-           <groupId>com.github.stephenc.findbugs</groupId>
-           <artifactId>findbugs-annotations</artifactId>
-           <optional>true</optional>
-        </dependency>
         <dependency>
           <groupId>org.apache.hadoop</groupId>
           <artifactId>hadoop-auth</artifactId>
diff --git a/hbase-common/pom.xml b/hbase-common/pom.xml
index 55395630bd7..f9d039a5ba5 100644
--- a/hbase-common/pom.xml
+++ b/hbase-common/pom.xml
@@ -203,6 +203,8 @@
     <dependency>
       <groupId>com.github.stephenc.findbugs</groupId>
       <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
diff --git a/hbase-examples/pom.xml b/hbase-examples/pom.xml
index b73146b1a7b..99937de964f 100644
--- a/hbase-examples/pom.xml
+++ b/hbase-examples/pom.xml
@@ -159,6 +159,8 @@
     <dependency>
       <groupId>com.github.stephenc.findbugs</groupId>
       <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.apache.hbase</groupId>
diff --git a/hbase-hbtop/pom.xml b/hbase-hbtop/pom.xml
index 73f98c0a970..fb5a6f456b3 100644
--- a/hbase-hbtop/pom.xml
+++ b/hbase-hbtop/pom.xml
@@ -52,6 +52,8 @@
     <dependency>
       <groupId>com.github.stephenc.findbugs</groupId>
       <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
diff --git a/hbase-http/pom.xml b/hbase-http/pom.xml
index 9288ba667b6..0bf21d29270 100644
--- a/hbase-http/pom.xml
+++ b/hbase-http/pom.xml
@@ -105,11 +105,6 @@
           </execution>
         </executions>
       </plugin>
-      <!-- Run findbugs -->
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
-      </plugin>
       <!-- Testing plugins -->
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
@@ -214,7 +209,12 @@
       <groupId>javax.ws.rs</groupId>
       <artifactId>javax.ws.rs-api</artifactId>
     </dependency>
-
+    <dependency>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
     <!-- Test dependencies -->
     <dependency>
       <groupId>org.apache.kerby</groupId>
diff --git a/hbase-mapreduce/pom.xml b/hbase-mapreduce/pom.xml
index 9da2c6fd5fd..97053ef8a1b 100644
--- a/hbase-mapreduce/pom.xml
+++ b/hbase-mapreduce/pom.xml
@@ -199,6 +199,12 @@
       <artifactId>hbase-replication</artifactId>
     </dependency>
     <!-- General dependencies -->
+    <dependency>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-mapreduce-client-jobclient</artifactId>
@@ -272,11 +278,6 @@
         </property>
       </activation>
       <dependencies>
-        <dependency>
-           <groupId>com.github.stephenc.findbugs</groupId>
-           <artifactId>findbugs-annotations</artifactId>
-           <optional>true</optional>
-        </dependency>
         <dependency>
           <groupId>org.apache.hadoop</groupId>
           <artifactId>hadoop-common</artifactId>
diff --git a/hbase-procedure/pom.xml b/hbase-procedure/pom.xml
index 5959036f8e1..d4b993774de 100644
--- a/hbase-procedure/pom.xml
+++ b/hbase-procedure/pom.xml
@@ -97,6 +97,7 @@
       <groupId>com.github.stephenc.findbugs</groupId>
       <artifactId>findbugs-annotations</artifactId>
       <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
diff --git a/hbase-protocol-shaded/pom.xml b/hbase-protocol-shaded/pom.xml
index 6cbc020f626..2b3c7fe9827 100644
--- a/hbase-protocol-shaded/pom.xml
+++ b/hbase-protocol-shaded/pom.xml
@@ -178,7 +178,7 @@
                   <exclude>org.slf4j:slf4j-api</exclude>
                   <exclude>org.apache.yetus:audience-annotations</exclude>
                   <exclude>com.github.stephenc.fingbugs:*</exclude>
-                  <exclude></exclude>
+                  <exclude>com.github.spotbugs:*</exclude>
                 </excludes>
               </artifactSet>
             </configuration>
diff --git a/hbase-rest/pom.xml b/hbase-rest/pom.xml
index 6a0c7e3ab73..39479de2851 100644
--- a/hbase-rest/pom.xml
+++ b/hbase-rest/pom.xml
@@ -362,9 +362,10 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-       <groupId>com.github.stephenc.findbugs</groupId>
-       <artifactId>findbugs-annotations</artifactId>
-       <optional>true</optional>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <!--Test-->
     <dependency>
diff --git a/hbase-server/pom.xml b/hbase-server/pom.xml
index 001ee985603..05813f5b067 100644
--- a/hbase-server/pom.xml
+++ b/hbase-server/pom.xml
@@ -72,6 +72,13 @@
       </testResource>
     </testResources>
     <plugins>
+      <plugin>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
+        <configuration>
+          <maxHeap>2048</maxHeap>
+        </configuration>
+      </plugin>
       <!-- licensing info from our bundled works -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
@@ -210,11 +217,6 @@
           </execution>
         </executions>
       </plugin>
-      <!-- Run findbugs -->
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
-      </plugin>
       <!-- Testing plugins -->
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
@@ -375,9 +377,10 @@
     </dependency>
     <!-- General dependencies -->
     <dependency>
-       <groupId>com.github.stephenc.findbugs</groupId>
-       <artifactId>findbugs-annotations</artifactId>
-       <optional>true</optional>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>com.github.ben-manes.caffeine</groupId>
diff --git a/hbase-shaded/hbase-shaded-check-invariants/pom.xml b/hbase-shaded/hbase-shaded-check-invariants/pom.xml
index 013a5b1ce21..2402029c7bd 100644
--- a/hbase-shaded/hbase-shaded-check-invariants/pom.xml
+++ b/hbase-shaded/hbase-shaded-check-invariants/pom.xml
@@ -119,7 +119,8 @@
                     <exclude>commons-logging:*</exclude>
                     <!-- annotations that never change -->
                     <exclude>com.google.code.findbugs:*</exclude>
-                    <exclude>com.github.stephenc.findbugs:*</exclude>
+                    <exclude>com.github.stephenc.fingbugs:*</exclude>
+                    <exclude>com.github.spotbugs:*</exclude>
                     <!-- We leave HTrace as an unshaded dependnecy on purpose so that tracing within a JVM will work -->
                     <exclude>org.apache.htrace:*</exclude>
                     <!-- Our public API requires Hadoop at runtime to work -->
diff --git a/hbase-shaded/hbase-shaded-client-byo-hadoop/pom.xml b/hbase-shaded/hbase-shaded-client-byo-hadoop/pom.xml
index f011ff1bd09..cb7407d1bcb 100644
--- a/hbase-shaded/hbase-shaded-client-byo-hadoop/pom.xml
+++ b/hbase-shaded/hbase-shaded-client-byo-hadoop/pom.xml
@@ -73,9 +73,10 @@
         </activation>
         <dependencies>
           <dependency>
-             <groupId>com.github.stephenc.findbugs</groupId>
-             <artifactId>findbugs-annotations</artifactId>
-             <optional>true</optional>
+            <groupId>com.github.stephenc.findbugs</groupId>
+            <artifactId>findbugs-annotations</artifactId>
+            <scope>compile</scope>
+            <optional>true</optional>
           </dependency>
           <dependency>
             <groupId>org.apache.hadoop</groupId>
diff --git a/hbase-shaded/hbase-shaded-client/pom.xml b/hbase-shaded/hbase-shaded-client/pom.xml
index 3fedcd61c19..78c947a1205 100644
--- a/hbase-shaded/hbase-shaded-client/pom.xml
+++ b/hbase-shaded/hbase-shaded-client/pom.xml
@@ -67,7 +67,8 @@
                                     <exclude>org.apache.hbase:hbase-resource-bundle</exclude>
                                     <exclude>org.slf4j:*</exclude>
                                     <exclude>com.google.code.findbugs:*</exclude>
-                                    <exclude>com.github.stephenc.findbugs:*</exclude>
+                                    <exclude>com.github.stephenc.fingbugs:*</exclude>
+                                    <exclude>com.github.spotbugs:*</exclude>
                                     <exclude>org.apache.htrace:*</exclude>
                                     <exclude>org.apache.yetus:*</exclude>
                                     <exclude>log4j:*</exclude>
diff --git a/hbase-shaded/hbase-shaded-testing-util/pom.xml b/hbase-shaded/hbase-shaded-testing-util/pom.xml
index 4d7956d56b0..1aa9c6bd07b 100644
--- a/hbase-shaded/hbase-shaded-testing-util/pom.xml
+++ b/hbase-shaded/hbase-shaded-testing-util/pom.xml
@@ -184,7 +184,8 @@
                                     <exclude>org.apache.hbase:hbase-resource-bundle</exclude>
                                     <exclude>org.slf4j:*</exclude>
                                     <exclude>com.google.code.findbugs:*</exclude>
-                                    <exclude>com.github.stephenc.findbugs:*</exclude>
+                                    <exclude>com.github.stephenc.fingbugs:*</exclude>
+                                    <exclude>com.github.spotbugs:*</exclude>
                                     <exclude>org.apache.htrace:*</exclude>
                                     <exclude>org.apache.yetus:*</exclude>
                                     <exclude>log4j:*</exclude>
diff --git a/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/pom.xml b/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/pom.xml
index b59ca1e2d93..d160ca64384 100644
--- a/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/pom.xml
+++ b/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/pom.xml
@@ -108,7 +108,8 @@
                     <exclude>commons-logging:*</exclude>
                     <!-- annotations that never change -->
                     <exclude>com.google.code.findbugs:*</exclude>
-                    <exclude>com.github.stephenc.findbugs:*</exclude>
+                    <exclude>com.github.stephenc.fingbugs:*</exclude>
+                    <exclude>com.github.spotbugs:*</exclude>
                     <!-- We leave HTrace as an unshaded dependnecy on purpose so that tracing within a JVM will work -->
                     <exclude>org.apache.htrace:*</exclude>
                     <!-- NB we don't exclude Hadoop from this check here, because the assumption is any needed classes
diff --git a/hbase-shaded/pom.xml b/hbase-shaded/pom.xml
index 6a748ba6209..6676ea242d1 100644
--- a/hbase-shaded/pom.xml
+++ b/hbase-shaded/pom.xml
@@ -147,7 +147,8 @@
                                         <exclude>org.apache.hbase:hbase-resource-bundle</exclude>
                                         <exclude>org.slf4j:*</exclude>
                                         <exclude>com.google.code.findbugs:*</exclude>
-                                        <exclude>com.github.stephenc.findbugs:*</exclude>
+                                        <exclude>com.github.stephenc.fingbugs:*</exclude>
+                                        <exclude>com.github.spotbugs:*</exclude>
                                         <exclude>org.apache.htrace:*</exclude>
                                         <exclude>org.apache.yetus:*</exclude>
                                         <exclude>log4j:*</exclude>
diff --git a/hbase-shell/pom.xml b/hbase-shell/pom.xml
index a6b62ad5895..b6df6812067 100644
--- a/hbase-shell/pom.xml
+++ b/hbase-shell/pom.xml
@@ -111,11 +111,6 @@
         </executions>
       </plugin>
       <!-- General plugins -->
-      <!-- Run findbugs -->
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
-      </plugin>
       <plugin>
         <groupId>net.revelc.code</groupId>
         <artifactId>warbucks-maven-plugin</artifactId>
diff --git a/hbase-thrift/pom.xml b/hbase-thrift/pom.xml
index 2de14efcec5..943a7a29494 100644
--- a/hbase-thrift/pom.xml
+++ b/hbase-thrift/pom.xml
@@ -232,6 +232,12 @@
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-util</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
     <dependency>
       <!--For JspC used in ant task-->
       <groupId>org.glassfish.web</groupId>
diff --git a/hbase-zookeeper/pom.xml b/hbase-zookeeper/pom.xml
index 7f8f2aaf656..198e13a4325 100644
--- a/hbase-zookeeper/pom.xml
+++ b/hbase-zookeeper/pom.xml
@@ -61,11 +61,6 @@
           <skipAssembly>true</skipAssembly>
         </configuration>
       </plugin>
-      <!-- Run findbugs -->
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
-      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
@@ -130,9 +125,10 @@
     </dependency>
     <!-- General dependencies -->
     <dependency>
-       <groupId>com.github.stephenc.findbugs</groupId>
-       <artifactId>findbugs-annotations</artifactId>
-       <optional>true</optional>
+      <groupId>com.github.stephenc.findbugs</groupId>
+      <artifactId>findbugs-annotations</artifactId>
+      <scope>compile</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.apache.commons</groupId>
diff --git a/pom.xml b/pom.xml
index 6276d46359f..2effd75b53c 100755
--- a/pom.xml
+++ b/pom.xml
@@ -791,13 +791,12 @@
           <version>${buildnumber.maven.version}</version>
         </plugin>
         <plugin>
-          <groupId>org.codehaus.mojo</groupId>
-          <artifactId>findbugs-maven-plugin</artifactId>
-          <version>${findbugs.maven.version}</version>
-          <!--NOTE: Findbugs 3.0.0 requires jdk7-->
+          <groupId>com.github.spotbugs</groupId>
+          <artifactId>spotbugs-maven-plugin</artifactId>
+          <version>${spotbugs.maven.version}</version>
           <configuration>
-            <excludeFilterFile>${project.basedir}/../dev-support/findbugs-exclude.xml</excludeFilterFile>
-            <findbugsXmlOutput>true</findbugsXmlOutput>
+            <excludeFilterFile>${project.basedir}/../dev-support/spotbugs-exclude.xml</excludeFilterFile>
+            <spotbugsXmlOutput>true</spotbugsXmlOutput>
             <xmlOutput>true</xmlOutput>
             <effort>Max</effort>
           </configuration>
@@ -1256,19 +1255,19 @@
           </transformationSets>
         </configuration>
       </plugin>
-      <!-- Special configuration for findbugs just in the parent so
+      <!-- Special configuration for spotbugs just in the parent so
       the filter file location can be more general (see definition in pluginManagement) -->
       <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
         <executions>
           <execution>
             <inherited>false</inherited>
             <goals>
-              <goal>findbugs</goal>
+              <goal>spotbugs</goal>
             </goals>
             <configuration>
-              <excludeFilterFile>${basedir}/dev-support/findbugs-exclude.xml</excludeFilterFile>
+              <excludeFilterFile>${basedir}/dev-support/spotbugs-exclude.xml</excludeFilterFile>
             </configuration>
           </execution>
         </executions>
@@ -1548,8 +1547,6 @@
     <checkstyle.version>8.28</checkstyle.version>
     <exec.maven.version>1.6.0</exec.maven.version>
     <error-prone.version>2.3.4</error-prone.version>
-    <findbugs-annotations>1.3.9-1</findbugs-annotations>
-    <findbugs.maven.version>3.0.4</findbugs.maven.version>
     <jamon.plugin.version>2.4.2</jamon.plugin.version>
     <lifecycle.mapping.version>1.0.0</lifecycle.mapping.version>
     <maven.antrun.version>1.8</maven.antrun.version>
@@ -1559,7 +1556,9 @@
     <maven.warbucks.version>1.1.0</maven.warbucks.version>
     <maven.project.info.report.version>2.9</maven.project.info.report.version>
     <os.maven.version>1.5.0.Final</os.maven.version>
-    <spotbugs.version>3.1.11</spotbugs.version>
+    <findbugs-annotations.version>1.3.9-1</findbugs-annotations.version>
+    <spotbugs.version>3.1.12</spotbugs.version>
+    <spotbugs.maven.version>3.1.12.2</spotbugs.maven.version>
     <surefire.version>3.0.0-M4</surefire.version>
     <wagon.ssh.version>2.12</wagon.ssh.version>
     <xml.maven.version>1.0.1</xml.maven.version>
@@ -1890,7 +1889,7 @@
       <dependency>
         <groupId>com.github.stephenc.findbugs</groupId>
         <artifactId>findbugs-annotations</artifactId>
-        <version>${findbugs-annotations}</version>
+        <version>${findbugs-annotations.version}</version>
       </dependency>
       <!-- General dependencies -->
       <dependency>
@@ -2382,25 +2381,6 @@
       <build>
         <pluginManagement>
           <plugins>
-            <plugin>
-              <groupId>org.codehaus.mojo</groupId>
-              <artifactId>findbugs-maven-plugin</artifactId>
-              <version>${findbugs.maven.version}</version>
-              <!--NOTE: Findbugs 3.0.0 requires jdk7-->
-              <configuration>
-                <excludeFilterFile>${project.basedir}/../dev-support/findbugs-exclude.xml</excludeFilterFile>
-                <findbugsXmlOutput>true</findbugsXmlOutput>
-                <xmlOutput>true</xmlOutput>
-                <effort>Max</effort>
-              </configuration>
-              <dependencies>
-                <dependency>
-                  <groupId>com.github.spotbugs</groupId>
-                  <artifactId>spotbugs</artifactId>
-                  <version>${spotbugs.version}</version>
-                </dependency>
-              </dependencies>
-            </plugin>
           </plugins>
         </pluginManagement>
       </build>
@@ -3772,7 +3752,7 @@
         <maven.javadoc.skip>true</maven.javadoc.skip>
         <enforcer.skip>true</enforcer.skip>
         <checkstyle.skip>true</checkstyle.skip>
-        <findbugs.skip>true</findbugs.skip>
+        <spotbugs.skip>true</spotbugs.skip>
         <warbucks.skip>true</warbucks.skip>
       </properties>
     </profile>