Thanks, Jason and Vit, for your replies. Unfortunately it looks like
many of findbugs-contrib's Java dependencies are being retired at the
moment, so I need to decide what to do about that first...
Let me suggest joining the Java SIG (if you haven't already), taking over the orphaned / retired packages your own packages depend on, and adding them to the set of packages maintained by the SIG.
That's probably the most productive way forward, provided you even want to continue maintaining findbugs-contrib.
Fabio