i.e. if someone depended on your code, they would not see the 3rd party lib or GSON

it does not control if the 3rd party lib leaks its transitive dependencies to your compile classpath, which it clearly does. there's not much you can do to fix this besides asking them to properly separate their transitive dependencies (I don't recommend blindling excluding transitive dependencies since they won't end up on your runtime classpath without careful handling)

but if

B

is e.g. a maven project and declares a normal dependency on

C

, then

A

having

implementation(B)

would still allow it to see

C

if C.implementation(Gson)

(C is the 3rd party lib)

and in my build.gradle ,

implementation "com.exponea.sdk:sdk:2.4.0"}

typically using

implementation

will result in the published pom.xml having a scope of

runtime

for those dependencies, but maybe that only happens if the

java-library

plugin is applied to the project

(if all went well, just to clarify)