[skywhopper]

Because you can’t know which ones you “need” to lock.

[lenkite]

You can definitely know this. Use

    mvn dependency:tree -Dverbose

Or use maven-enforcer-plugin to fail the build on conflicts.