When building custom REST resources in Drupal 8 or 9, requests using POST, PUT or PATCH do not necessarily require cache metadata.

A common error that may be returned by Drupal is the following:

LogicException: The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\rest\ResourceResponse. in Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext()

The error's pretty self-explanatory, but you may be puzzled as to why your specific implementation triggers it.

The fix is simple.

use Drupal\rest\ModifiedResourceResponse;

And simply switch out "ResourceResponse" for "ModifiedResourceResponse":

return new ModifiedResourceResponse($response, 200);