In 2.x branch, we have findbugs check on core/impl which is pretty much sufficient as the whole codebase resides there.

In 3.x the check remains, yet we have modules (JTA, EJB, JSF, Web) which are therefore excluded. I believe we should include them - will send a PR with that.

I was also thinking about checking Probe this way (neither branch does that ATM).
Do you think it makes sense? From my pov it's "optional".

Furthermore, as a part of this issue, we should upgrade findbugs annotation dependency. We are currently using net.sourceforge.findbugs:annotations:1.3.2 whereas the latest version is com.google.code.findbugs:annotations:3.0.1. Note that the artifact GAV has changed significantly.