The jboss-as-parent pom currently depends on an external BOM (apacheds-parent) to get some dependency versions. This means that it's not obvious which version is used for some dependencies. And it's possible that a version could be unintentionally upgraded.