Merge pull request ehcache#3290 from myronkscott/fix_dependency_scope

fix dependency scope of core apis

Author: myronkscott

clustered/ehcache-client/build.gradle

@@ -32,14 +32,15 @@ dependencies {
   compileOnlyApi project(':ehcache-xml:ehcache-xml-spi')
 
   api project(':clustered:ehcache-common')
-  implementation "org.terracotta:client-api:$terracottaApisVersion"
+  compileOnly "org.terracotta:client-api:$terracottaApisVersion"
   implementation "org.terracotta:terracotta-runnel:$terracottaPlatformVersion"
   implementation "org.terracotta:terracotta-lease-client:$terracottaPlatformVersion"
   implementation "org.terracotta:terracotta-dynamic-config-entities-topology-client:$terracottaPlatformVersion"
   implementation "org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion"
 
   compileOnly 'org.osgi:org.osgi.service.component.annotations:1.3.0'
 
+  testImplementation "org.terracotta:client-api:$terracottaApisVersion"
   testImplementation "org.terracotta:terracotta-resources-offheap:$terracottaPlatformVersion"
   testImplementation "org.terracotta:terracotta-management-server-api:$terracottaPlatformVersion"
   testImplementation project(':clustered:server:ehcache-service-api')

clustered/ehcache-common-api/build.gradle

@@ -27,5 +27,5 @@ publishing.publications.withType(MavenPublication) {
 }
 
 dependencies {
-  api "org.terracotta:common-api:$terracottaApisVersion"
+  compileOnlyApi "org.terracotta:common-api:$terracottaApisVersion"
 }

clustered/ehcache-common/build.gradle

@@ -30,9 +30,10 @@ dependencies {
   api project(':ehcache-api')
   api project(':clustered:ehcache-common-api')
 
-  implementation "org.terracotta:common-api:$terracottaApisVersion"
+  compileOnly "org.terracotta:common-api:$terracottaApisVersion"
   implementation "org.terracotta:terracotta-runnel:$terracottaPlatformVersion"
   implementation "org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion"
 
+  testImplementation "org.terracotta:client-api:$terracottaApisVersion"
   testImplementation project(':clustered:test-utils')
 }

clustered/osgi-test/build.gradle

@@ -59,6 +59,9 @@ configurations.all {
         .using(module('org.ops4j.pax.url:pax-url-classpath:2.6.11'))
       substitute(module('org.ops4j.pax.url:pax-url-link:2.6.8'))
         .using(module('org.ops4j.pax.url:pax-url-link:2.6.11'))
+      substitute(module('org.ops4j.pax.url:pax-url-aether:2.6.8'))
+      //  the 2 line has CVE-2025-48924 which is preventing build
+        .using(module('org.ops4j.pax.url:pax-url-aether:3.0.1'))
       substitute(module('org.osgi:org.osgi.util.function:1.1.0'))
         .using(module('org.osgi:org.osgi.util.function:1.2.0'))
         .because('Dependency divergence in org.osgi:org.osgi.util.promise:1.2.0')

osgi-test/build.gradle

@@ -34,7 +34,7 @@ dependencies {
 
   runtimeOnly ('org.ops4j.pax.exam:pax-exam-link-mvn:4.13.5') {
     exclude group:'org.slf4j', module:'slf4j-api'
-  }
+}
   runtimeOnly ("org.ops4j.pax.url:pax-url-wrap:2.6.11") {
     exclude group:'org.slf4j', module:'slf4j-api'
   }
@@ -77,6 +77,9 @@ configurations.all {
         .using(module('org.ops4j.pax.url:pax-url-classpath:2.6.11'))
       substitute(module('org.ops4j.pax.url:pax-url-link:2.6.8'))
         .using(module('org.ops4j.pax.url:pax-url-link:2.6.11'))
+      substitute(module('org.ops4j.pax.url:pax-url-aether:2.6.8'))
+      //  the 2 line has CVE-2025-48924 which is preventing build
+        .using(module('org.ops4j.pax.url:pax-url-aether:3.0.1'))
       substitute(module('org.osgi:org.osgi.util.function:1.1.0'))
         .using(module('org.osgi:org.osgi.util.function:1.2.0'))
         .because('Dependency divergence in org.osgi:org.osgi.util.promise:1.2.0')