[deredede]

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?

[skywhopper]

Because you can’t know which ones you “need” to lock.

[lenkite]

You can definitely know this. Use

    mvn dependency:tree -Dverbose

Or use maven-enforcer-plugin to fail the build on conflicts.