diff --git a/java/fory-core/pom.xml b/java/fory-core/pom.xml
index 09e73814fb..1ed5d5b662 100644
--- a/java/fory-core/pom.xml
+++ b/java/fory-core/pom.xml
@@ -56,6 +56,11 @@
       <artifactId>guava</artifactId>
       <optional>true</optional>
     </dependency>
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>org.codehaus.janino</groupId>
       <artifactId>janino</artifactId>
diff --git a/java/fory-json/pom.xml b/java/fory-json/pom.xml
index e72ed21722..0b35c9e922 100644
--- a/java/fory-json/pom.xml
+++ b/java/fory-json/pom.xml
@@ -63,6 +63,11 @@
       <artifactId>guava</artifactId>
       <optional>true</optional>
     </dependency>
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <scope>provided</scope>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/java/pom.xml b/java/pom.xml
index 579ebddacb..d81cb4810d 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -77,7 +77,7 @@
     <!-- Remote resource NOTICE years use this timestamp, not the build date. -->
     <project.build.outputTimestamp>2026-01-01T00:00:00Z</project.build.outputTimestamp>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-    <guava.version>32.1.2-jre</guava.version>
+    <guava.version>33.7.1-jre</guava.version>
     <janino.version>3.1.12</janino.version>
     <jsr305.version>3.0.2</jsr305.version>
     <slf4j.version>2.0.12</slf4j.version>
@@ -177,6 +177,11 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.code.findbugs</groupId>
+        <artifactId>jsr305</artifactId>
+        <version>${jsr305.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.codehaus.janino</groupId>
         <artifactId>janino</artifactId>