Someone brought up that tools.deps can't transitively resolve project.clj dependencies. Is that true?

AFAIK, yes.

Oh, so until all lib upgrade, it could cause some issues there

to add deps.edn

Can it handle pom.xml ?

Or only deps.edn ?

I think Pom is fine, but not 100% sure. I believe Pom is used for maven-things so presumably it works fine.

A usual trick is to fork a git library, at a deps.edn and use your fork with updated dependencies until it’s fixed upstream.

Just to be clear, this only affects git dependencies. Nobody would depend on a git repo with only a project.clj.

It is absolutely fine if you depend on a git repo, which depends on a leiningen-built project on clojars or maven central.