Gradle/Maven/Android: Library-private dependency not found when library is used via maven

I have a SampleApp with a library module attached:

:app
:library

The library is using the following dependency and the following code:

implementation "com.google.android.gms:play-services-safetynet:17.0.1"

----

import android.content.Context
import com.google.android.gms.safetynet.SafetyNet

class ClassUsingSafetynet {
    fun trigger(context: Context) {
        SafetyNet.getClient(context)
    }
}

The SampleApp is calling trigger somewhere:

val triggerClass = ClassUsingSafetynet()
triggerClass.trigger(context)

This works without problems as long as the SampleApp declares its dependency directly on the library module:

implementation project(path: ':library')

But if I deploy the library aar to my local maven and declare the dependency accordingly like this:

implementation ('com.myapplication:library:1.0.3@aar') { transitive = true }

I get the following crash

java.lang.NoClassDefFoundError: Failed resolution of: Lcom/google/android/gms/safetynet/SafetyNet;
        at com.library.ClassUsingSafetynet.trigger(ClassUsingSafetynet.kt:10)
        at com.myapplication.MainActivity.onCreate$lambda-0(MainActivity.kt:38)

---

Here is the publish gradle task:

afterEvaluate {
    publishing {
        publications {
            release(MavenPublication) {

                groupId 'com.myapplication'
                artifactId 'library'
                version '1.0.3'
                artifact 'build/outputs/aar/library-release.aar'

                pom.withXml {
                    def dependenciesNode = asNode().appendNode('dependencies')

                    configurations.api.allDependencies.each {
                        def dependencyNode = dependenciesNode.appendNode('dependency')
                        dependencyNode.appendNode('groupId', it.group)
                        dependencyNode.appendNode('artifactId', it.name)
                        dependencyNode.appendNode('version', it.version)
                    }
                }
            }
        }
        repositories {
            mavenLocal()
        }
    }
}

---

I have tried to use api instead of implementation for the SafetyNet dependency. No difference.

I have tried to set/not set {transitive = true}. No difference.

I have tried to set/not set @aar. No difference.

I have tried to not create the pom file. No difference.

No ProGuard is applied for now.

---

What's especially strange to me is that "SafetyNet" is a private dependency of the library. My app doesn't even need to know about it.

from Gradle/Maven/Android: Library-private dependency not found when library is used via maven