title: How to make Maven warn about an arbitrary version choice?
body: <p>In a Maven project we used a third-party artifact (specifically, spring-data-jpa 1.1.0.RELEASE) which depends on another artifact (spring-core) allowing any version in a range (to be precise: [3.0.7.RELEASE,4.0.0.RELEASE), see <a href="http://repo1.maven.org/maven2/org/springframework/data/spring-data-jpa/1.1.0.RELEASE/spring-data-jpa-1.1.0.RELEASE.pom" rel="nofollow">its pom-file</a>).  We had no direct dependency on spring-core.</p>
  
  <p>So one day our build chose 3.1.2.RELEASE, but when 3.2.0.RC1 was released then our build suddenly picked up that version.</p>
  
  <p>However, we would like to have <em>repeatable builds</em>: when we deliver a patch in a year's time, we don't want to pull in an updated version of spring-core, or any other indirect dependency, without at least knowing about it.</p>
  
  <p>(I know that we can guide Maven to choose one specific version for spring-core, e.g., using <code>&lt;dependencyManagement&gt;</code>, but my point here is that there may be arbitrary choices hidden in indirect dependencies, and I'd like Maven to tell us about those, without having to manually check this regularly.)</p>
  
  <p><em>Question:</em> How can we make Maven warn us if it makes an arbitrary version choice for any indirect dependency?</p>