replace all (where stuff doesn't break) api with implementation calls

[maximiliankaul]

• Why do we need to expose the following dependencies (changing to implementation breaks the build)?
  • ibs.apache.commons.lang3
  • libs.neo4j.ogm.core
• Can we restrict cpg stuff? Does the cpg-console / neo4 API have to be exposed?

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 76.13%. Comparing base (66aa2da) to head (8d82ba2).

Additional details and impacted files

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests
• JS Bundle Analysis - Avoid shipping oversized bundles

[oxisto]

The neo4j and console project are exposed in the cog-all module. Users of that module expect all of the CPG functionality to be available, that includes neo4j and console. It should not be exposed in other modules.

[oxisto]

If you add implementation(libs.apache.commons.lang3) to every module that uses it, then it does not need to be exposed as api. I will add this to the buildSrc common convention

[oxisto]

For neo4j it's tricker, it seems we are using a transitive dependency from neo4j (slf4j2) and we did not declare the usage of slf4j2 as a dependency. But we are using slf4j2's Logger as part of our public API, so we should instead specify slf4j2 as public API.

[oxisto]

Ah, and we have a second problem. We are using neo4j's annotation in our public API, so we need to include at least the annotation package as "api", but not the complete core.

[oxisto]

Ah, the annotations are part of core, so we are stuck with exposing OGM core

Update: we can try the same "trick" as with apache commons, we can specify it as implementation of all modules. We just need to check if external programs still work

[oxisto]

Jackson can also be moved to common

[oxisto]

Could probably also moved to common dependencies