So far we have been using the Findbugs JSR-305 annotations (com.google.code.findbugs:jsr305) and everything including tool support (Sonar, Eclipse, Findbugs, …) has been working fine.
However it is our understanding that Jigsaw in Java 9 is going to break JSR-305 annotations (one package in two modules is not allowed). This was confirmed at JavaOne 2015. Oracle's reasoning is JSR-305 never happened and JSR-250 would have to endorse these annotations.
We're looking for replacements for JSR-305 annotations that work in both Java 8 and Java 9. If history is any guide the time between Java 9 GA and Java 8 EOL will be rather short and we would like to fix any incompatibilities in our code in advance. In theory we could upgrade the annotations module of the JDK but doing this across our toolchain seems like a lot of work.