[MNG-7066] Dependency resolution in multimodule project

**[Vasyl Danyliuk](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=vdanyliuk)** opened **[MNG-7066](https://issues.apache.org/jira/browse/MNG-7066?redirect=false)** and commented

I have a bunch of modules under parent pom. In the parent pom, there is a dependency management section that defines the 2.12.0 version of the Jackson library. However, in one of the modules (Module One), I need to downgrade the version to 2.10.5 due to compatibility issues. For this module, it works well. There is a second module(Module Two) that has a dependency on Module One. And for this dependency maven resolves the version of Jackson to 2.12.0. But Module Two actually doesn't declare a dependency on Jackson at all, just dependency on Module One. In the end, I'm getting compatibility issues here.

It can be resolved by explicitly specifying a dependency on Jackson 2.10.5 in Module Two, but it still looks like a bug.

I've created a very small project to demonstrate the problem. You can check out it here https://github.com/DrBAXA/maven-test or just download the attached archive.

In maven-test-lib and maven-test-app there are just two test files. One of them fails as expecting 2.10.5 version

---

**Affects:** 3.6.3

**Attachments:**
- [maven-test.zip](https://issues.apache.org/jira/secure/attachment/13018188/maven-test.zip) (_4.38 kB_)

Start with the small reproducer in the maven-test repository or the attached maven-test.zip, particularly the maven-test-lib and maven-test-app modules. Run the two test files and compare the Jackson version resolved for the transitive Module One dependency with the expected 2.10.5 result. Done means the reproducer passes without explicitly declaring Jackson in Module Two.

Written by the indexing model from the issue text.