Hacker News Reader

Comment by deredede | Hacker News Reader

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?

Because you can’t know which ones you “need” to lock.

You can definitely know this. Use

    mvn dependency:tree -Dverbose

Or use maven-enforcer-plugin to fail the build on conflicts.