build: put all transitive dependencies as provided in the POM as well

Excluded dependencies will not be written into the POM. This is needed
so that dependency analysis on the client side works on the correct set
of dependencies. If clients manually compute transitive dependencies
they do not know about our exclusions.

Author: sergej-koscejev

build.gradle

@@ -421,8 +421,22 @@ ext.additionalPomInfo = {
 }
 
 ext.addBundledDependencies = { MavenPom pom ->
-    bundledDeps.each {
-        addDependency(pom, configurations[it.configName], 'provided')
+    def seen = new HashSet<ResolvedDependency>()
+
+    def queue = new ArrayDeque<ResolvedDependency>()
+
+    // Visit each bundled dependency including its transitive dependencies if they are included, so that the exact set
+    // of used JARs ends up in the POM as provided dependencies.
+    for (bundledDep in bundledDeps) {
+        queue.addAll(configurations[bundledDep.configName].resolvedConfiguration.firstLevelModuleDependencies)
+
+        while (!queue.isEmpty()) {
+            def dep = queue.removeFirst()
+            if (seen.add(dep)) {
+                addDependency(pom, dep.moduleGroup, dep.moduleName, dep.moduleVersion, dep.moduleArtifacts[0].type, 'provided')
+                queue.addAll(dep.children)
+            }
+        }
     }
 }