The issue is what happens when libX@latest is updated and uses [email protected] but your other dependency libA@latest uses [email protected]? In maven, crazy things happen. Sometimes it’s fine but if you have any kind of security, the version mismatch has different signatures and blows up. Ask any spring developer what happens when they have more than 1 slf4j in their classpath.