ok i figured it out. lein-nvd sets the version of its nvd-clojure dep dynamically and defaults to the maven special keyword "RELEASE" which always gets the latest

i would still be interested to know if there is a way to ask lein to print out what dependencies a plugin is going to pull in

@nickmbailey lein deps :plugin-tree

https://github.com/technomancy/leiningen/blob/2.9.1/src/leiningen/deps.clj#L107 See these doc strings for more details.

thanks!