BOM is not usable with spring-boot-starter-parent

[MelleD]

When adding feign-bom to a Maven paren pom project , the Spring managed version is overriden e.g. jackson .
This makes the current BOM/parent setup effectively unusable in any project that needs to control its own jackson version.

Steps to Reproduce:

Create a maven project and import the bom

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

   <modelVersion>4.0.0</modelVersion>

   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>4.1.0</version>
   </parent>

   <groupId>feign-bom-test</groupId>
   <artifactId>feign-bom-test</artifactId>
   <version>DEV-SNAPSHOT</version>
   <packaging>pom</packaging>

   <modules>
      <module>feign-bom-test-module</module>
   </modules>
   
   <properties>
         <feign-bom.version>13.13</feign-bom.version>
   </properties>

   <dependencyManagement>
      <dependencies>
         <dependency>
            <groupId>io.github.openfeign</groupId>
            <artifactId>feign-bom</artifactId>
            <version>${feign-bom.version}</version>
            <type>pom</type>
            <scope>import</scope>
         </dependency>
      </dependencies>
   </dependencyManagement>
</project>

Run mvn dependency:tree or mvn help:effective-pom.

          <artifactId>jackson-core</artifactId>
          <version>2.22.0</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>3.1.4</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>2.22.0</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>3.1.4</version>
        </dependency>
--
        <artifactId>jackson-core</artifactId>
        <version>2.22.0</version>
        <scope>compile</scope>

and see that jackson core is 2.22.0 instead of 2.21.4

Without bom import looks like

          <artifactId>jackson-core</artifactId>
          <version>2.21.4</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>3.1.4</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>2.21.4</version>
        </dependency>
--
          <artifactId>jackson-core</artifactId>
          <version>3.1.4</version>
        </dependency>
--
        <artifactId>jackson-core</artifactId>
        <version>2.21.4</version>
        <scope>compile</scope>

Created a MRE here to reproduce the issue:
https://github.com/MelleD/feign-bom-test

Had a similar issue with apache jena bom: apache/jena#4107 (comment)

Solution was there to use the maven flatten plugin:
https://github.com/apache/jena/blob/main/jena-bom/pom.xml#L41

Maybe this is also here the solution