Do version numbers specified in managed dependencies apply to transitive dependencies? That is, if I specify [foo "0.2.0"] in :managed-dependencies in my project, and also have a dependency on a third-party library bar which depends on [foo "0.1.0"], will Leiningen/Maven use 0.1.0 or 0.2.0?

@enn I believe that is the case, but have to dig a bit to see that

should be a really easy test case to try out though

@enn

(defproject mikerod/demo-it "0.1.0-SNAPSHOT"
  :managed-dependencies [[commons-codec "1.13"]] ;; clj-http uses `[commons-codec "1.10"]` transitively
  :dependencies [[clj-http "3.7.0"]])

[clj-http "3.7.0"]
   [commons-codec "1.13" :exclusions [[org.clojure/clojure]]]

(defproject mikerod/demo-it "0.1.0-SNAPSHOT"
  ;;:managed-dependencies [[commons-codec "1.13"]] ;; <---- commented this out to show diff

  :dependencies [[clj-http "3.7.0"]])

[clj-http "3.7.0"]
   [commons-codec "1.10" :exclusions [[org.clojure/clojure]]]

Leiningen 2.8.3 on Java 1.8.0_112 Java HotSpot(TM) 64-Bit Server VM

it mostly comes down to the com.cemerick/pomegranate impl’s use of the underlying org.eclipse.aether/aether lib

I do wish this was documented more clearly

or had a test case in leiningen-core tests, but I don’t see one

Nice, thank you. That's what I was hoping.