Let the Boot BOM manage dependency versions

Spring Boot ships a bill of materials that pins versions of hundreds of libraries known to work together: Jackson, Hibernate, Tomcat, Micrometer, the database drivers and more. Declaring your own version for one of them breaks that tested combination.

• Leave versions off dependencies that Boot manages.
• If you must override one, for example to get a security fix early, use the version property (such as spring-security.version), not a hard-coded version on the dependency, and remove it after the next Boot release.
• Use the Maven or Gradle wrapper checked into the repository, so every machine builds with the same tool version.

Run a dependency scanner in CI so you hear about vulnerable transitive libraries before an attacker does.