After checking productized fuse-karaf-7.0.0.fuse-000187-redhat-1.zip distribution, I found that some features use productized versions and some - don't.

The versions are:

• mvn:com.sun.mail/javax.mail/1.6.1.redhat-1
• mvn:com.sun.mail/javax.mail/1.6.1
• mvn:commons-lang/commons-lang/2.6.0.redhat-6
• mvn:commons-lang/commons-lang/2.6
• mvn:javax.servlet/javax.servlet-api/3.1.0.redhat-1
• mvn:javax.servlet/javax.servlet-api/3.1.0
• mvn:javax.validation/validation-api/1.1.0.Final-redhat-1
• mvn:javax.validation/validation-api/1.1.0
• mvn:org.apache.geronimo.specs/geronimo-annotation_1.0_spec/1.1.1.redhat-2
• mvn:org.apache.geronimo.specs/geronimo-annotation_1.0_spec/1.1.1
• mvn:org.apache.geronimo.specs/geronimo-jms_1.1_spec/1.1.1.redhat-2
• mvn:org.apache.geronimo.specs/geronimo-jms_1.1_spec/1.1.1
• mvn:org.apache.geronimo.specs/geronimo-jta_1.1_spec/1.1.1.redhat-2
• mvn:org.apache.geronimo.specs/geronimo-jta_1.1_spec/1.1.1

The problem is that the versions are in these layers:

• productization (pom manipulator extension) changes versions in poms to productized ones
• pipeline forces changes to some selected versions (like Jackson)
• there's etc/org.apache.karaf.features.xml file where we can specify overrides of versions (and sometimes even groupId/artifactId pairs) - that's useful if (and we do) we use external/community feature XML files - like pax-web, pax-transx, pax-jms, pax-cdi, pax-jdbc
• and finally POM specifies its own versions (subject to force update from PME and pipeline).

My personal goal is to have all the versions managed at pom level - not via external, last-minute updates.