I had a similar issue while upgrading from 3.6 to 3.7.3; the fbcontrib-plugin depends on the findbugs-plugin which is part of the sonar java-ecosystem.
In this case it is safe (and documented, point 6) to take a backup of the database and of the extensions directory before updating; then update and restart sonar having moved away any external contribution plugin, so that sonar can manage the update and come up back successfully. Another good tip is to not overwrite new configuration files with the old ones, instead manually editing them to bring over the old settings.
Then, add the plugins back and restart again; happy static analysis.