ModeShape should provide a BOM that make it far easier for clients that use Maven to configure their POMs. A BOM is essentially a Maven POM that just defines a "dependenciesManagement" section containing the version and scope for each of the project's modules. And usually the BOM is considered the parent POM of the project's parent POM.

Clients' POM files would simply add a "dependency" to the ModeShape BOM in the POM's "dependencyManagement" section, and would then simply add dependencies on the ModeShape components (or other optional components) without having to specify the versions. For example:

<project ...
  <!-- ... -->
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.modeshape</groupId>
        <artifactId>bom</artifactId>
        <version>3.0.0.Final</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <!-- ... -->
  <dependencies>
    <dependency>
      <groupId>org.modeshape</groupId>
      <artifactId>modeshape-jcr</artifactId>
    </dependency>
  </dependencies>
  <!-- ... -->
</project>

If our BOM also included other optional components (e.g., PicketBox's JAAS implementation), then they could just use that as well. (Not sure if that's a good idea or not, considering ModeShape excludes several of PicketBox's dependencies.)