com.google.guava:guava:3.x contains the dependency com.google.code.findbugs:jsr305:compile, The scope should be provider?

At runtime, it is of little use.

https://repo1.maven.org/maven2/com/google/guava/guava/32.0.1-jre/guava-32.0.1-jre.pom