[tonsky]

It’s totally fine in Maven, no need to rebuild or repackage anything. You just override version of libinsecure in your pom.xml and it uses the version you told it to

[zahlman]

So you... manually re-lock the parts you need to?

[aidenn0]

Don't forget the part where Maven silently picks one version for you when there are transitive dependency conflicts (and no, it's not always the newest one).

[deredede]

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?

[skywhopper]

Because you can’t know which ones you “need” to lock.

[lenkite]

You can definitely know this. Use

    mvn dependency:tree -Dverbose

Or use maven-enforcer-plugin to fail the build on conflicts.