Bump Guava to 33.7.2 and declare Jackson 2.22.4 directly

Guava 33.4.8 is affected by GHSA-xxph-c9ww-hj94 (CVE-2026-102554:
uncontrolled memory allocation when deserializing CompactHashMap,
CompactHashSet or MapMakerInternalMap); 33.7.2 is the first patched
version. The project compiles against Jackson directly (ObjectMapper,
@JsonProperty) but only received it through feign-jackson, which pins
jackson-databind 2.13.4, affected by CVE-2022-42003 (and jackson-core
2.13.4 by CVE-2025-52999). jackson-databind 2.22.4 and
jackson-annotations 2.22 (annotations are released once per minor line
since 2.20) are now declared as direct dependencies, which also makes
them visible to the repository's dependency graph.

The new versions deprecate two calls in IpdataServiceBuilder; they are
replaced by their documented equivalents, available since Jackson 2.7
and Guava 25: ObjectMapper.setDefaultPropertyInclusion(Include) for
setSerializationInclusion(Include), and
CacheBuilder.expireAfterWrite(Duration) for expireAfterWrite(long,
TimeUnit).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: claude

pom.xml

@@ -40,6 +40,9 @@
     <version.build.jacoco>0.8.14</version.build.jacoco>
     <version.build.surefire>3.5.5</version.build.surefire>
     <version.client.feign>11.10</version.client.feign>
+    <version.client.jackson>2.22.4</version.client.jackson>
+    <!-- jackson-annotations is released once per minor line (2.20, 2.21, 2.22, ...) -->
+    <version.client.jackson.annotations>2.22</version.client.jackson.annotations>
   </properties>
   <dependencies>
     <dependency>
@@ -57,6 +60,16 @@
       <artifactId>feign-java11</artifactId>
       <version>${version.client.feign}</version>
     </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+      <version>${version.client.jackson}</version>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-annotations</artifactId>
+      <version>${version.client.jackson.annotations}</version>
+    </dependency>
     <dependency>
       <groupId>io.github.openfeign</groupId>
       <artifactId>feign-httpclient</artifactId>
@@ -66,7 +79,7 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
-      <version>33.4.8-jre</version>
+      <version>33.7.2-jre</version>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>

src/main/java/io/ipdata/client/service/IpdataServiceBuilder.java

@@ -19,6 +19,7 @@
 import org.slf4j.LoggerFactory;
 
 import java.net.URL;
+import java.time.Duration;
 
 import static com.fasterxml.jackson.databind.PropertyNamingStrategies.SNAKE_CASE;
 
@@ -64,7 +65,7 @@ public static IpdataServiceBuilder of(URL url, String key, CacheConfig cacheConf
   public IpdataService build() {
     final ObjectMapper mapper = new ObjectMapper();
     mapper.setPropertyNamingStrategy(SNAKE_CASE);
-    mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
+    mapper.setDefaultPropertyInclusion(JsonInclude.Include.NON_NULL);
     mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
     mapper.setVisibility(PropertyAccessor.FIELD, JsonAutoDetect.Visibility.ANY);
 
@@ -98,13 +99,14 @@ public IpdataService build() {
       .target(IpdataInternalSingleFieldClient.class, url.toString());
 
     if (cacheConfig != null) {
+      final Duration expiry = Duration.of(cacheConfig.timeout(), cacheConfig.unit().toChronoUnit());
       CachingInternalClient cachingInternalClient = CachingInternalClient.builder()
         .expiry(cacheConfig.timeout())
         .unit(cacheConfig.unit())
         .maxSize(cacheConfig.maxSize())
         .ipdataCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<String, IpdataModel>() {
               @Override
@@ -115,7 +117,7 @@ public IpdataModel load(String key) throws Exception {
         )
         .fieldsCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<HashPair<String, String>, IpdataModel>() {
               @Override
@@ -126,7 +128,7 @@ public IpdataModel load(HashPair<String, String> key) throws Exception {
         )
         .asnCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<String, AsnModel>() {
               @Override
@@ -137,7 +139,7 @@ public AsnModel load(String key) throws Exception {
         )
         .tzCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<String, TimeZone>() {
               @Override
@@ -148,7 +150,7 @@ public TimeZone load(String key) throws Exception {
         )
         .currencyCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<String, Currency>() {
               @Override
@@ -159,7 +161,7 @@ public Currency load(String key) throws Exception {
         )
         .threatCache(
           CacheBuilder.newBuilder()
-            .expireAfterWrite(cacheConfig.timeout(), cacheConfig.unit())
+            .expireAfterWrite(expiry)
             .maximumSize(cacheConfig.maxSize())
             .build(new CacheLoader<String, ThreatModel>() {
               @Override