fix(apollo): replace jcip annotations dependency

[yshyn-iohk]

Summary

• bump org.bitcoinj:bitcoinj-core from 0.17 to 0.17.1
• exclude net.jcip:jcip-annotations from the bitcoinj dependency
• add com.github.stephenc.jcip:jcip-annotations:1.0-1 as the Apache-licensed replacement for JVM and Android source sets

Why

Apollo issue #192 tracks the licensing problem caused by the transitive runtime dependency on net.jcip:jcip-annotations.

The upstream bitcoinj change referenced in the issue comments exists in commit 8070bd80e6897684d004137a388990b75e946c2f, but the latest published artifact available today, org.bitcoinj:bitcoinj-core:0.17.1, still ships the net.jcip:jcip-annotations:1.0 runtime dependency. This PR fixes Apollo now without waiting for a future bitcoinj release.

Validation

• ./gradlew :apollo:dependencies --configuration jvmRuntimeClasspath
  • confirms org.bitcoinj:bitcoinj-core:0.17.1 is present
  • confirms net.jcip:jcip-annotations is no longer present
  • confirms com.github.stephenc.jcip:jcip-annotations:1.0-1 is present instead
• ./gradlew :apollo:compileKotlinJvm --no-configuration-cache --max-workers=1
  • did not fail in Apollo dependency resolution
  • is currently blocked by an existing unrelated native wrapper failure in :bip32-ed25519:buildRustWrapper (lipo: can't move temporary file ... libuniffi_ed25519_bip32_wrapper.dylib.lipo)

Follow-up

Once bitcoinj publishes a release that includes the upstream removal of net.jcip:jcip-annotations, Apollo should be able to simplify this by dropping the explicit exclusion and replacement dependency.

Fixes #192

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[patextreme]

Verified locally:

• net.jcip:jcip-annotations is completely absent from all dependency configurations ✅
• com.github.stephenc.jcip:jcip-annotations:1.0-1 (Apache 2.0) is present as replacement ✅
• org.bitcoinj:bitcoinj-core bumped to 0.17.1 ✅
• Fix applied consistently to both JVM and Android source sets ✅
• bitcoinjcore catalog entry intentionally retained for future simplification ✅

The only build failure (:bip32-ed25519:buildRustWrapper) is pre-existing and unrelated to this PR.