build: add bundled dependencies as provided in pom.xml

Author: sergej-koscejev

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project are documented in this file.
 Format of the log is _loosely_ based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 The project does _not_ follow Semantic Versioning and the changes are documented in reverse chronological order, grouped by calendar month.
 
+## November 2025
+
+### Added
+- The Maven POM now contains all bundled JARs as dependencies with `provided` scope to help with automated license and
+  vulnerability scanning.
+
 ## October 2025
 
 ### Added

build.gradle

@@ -383,7 +383,7 @@ task packageDistroWithDependencies(type: Zip, dependsOn: buildDistroWithDependen
 
 assemble.dependsOn packageLanguages, packageTests
 
-static def addDependency(Object pom, Object groupId, Object artifactId, Object version, Object type = null) {
+static def addDependency(Object pom, Object groupId, Object artifactId, Object version, Object type = null, String scope = null) {
     pom.withXml { XmlProvider prov ->
         Node root = prov.asNode()
         Node deps = root.dependencies[0] ?: root.appendNode("dependencies")
@@ -394,14 +394,16 @@ static def addDependency(Object pom, Object groupId, Object artifactId, Object v
         if (type != null) {
             dep.appendNode("type", type)
         }
+        if (scope != null) {
+            dep.appendNode("scope", scope)
+        }
     }
 }
 
-static def addDependency(Object pom, Configuration config) {
+static def addDependency(MavenPom pom, Configuration config, String scope = null) {
     config.resolvedConfiguration.firstLevelModuleDependencies.each {
-        addDependency(pom, it.moduleGroup, it.moduleName, it.moduleVersion, it.moduleArtifacts[0].type)
+        addDependency(pom, it.moduleGroup, it.moduleName, it.moduleVersion, it.moduleArtifacts[0].type, scope)
     }
-
 }
 
 ext.additionalPomInfo = {
@@ -425,6 +427,12 @@ ext.additionalPomInfo = {
     }
 }
 
+ext.addBundledDependencies = { MavenPom pom ->
+    bundledDeps.each {
+        addDependency(pom, configurations[it.configName], 'provided')
+    }
+}
+
 publishing {
     repositories {
         maven {
@@ -458,6 +466,8 @@ publishing {
 
             addDependency(pom, configurations.languageLibs)
 
+            pom addBundledDependencies
+
             pom additionalPomInfo
         }