In https://github.com/spotbugs/spotbugs/releases/tag/4.8.5 under Assets, the spotbugs-4.8.5.zip /lib has the duplicate JARs.