This message was deleted.

"managed by" is very relative. The BOM just adds constraints, that are taken into consideration together with explicit versions in normal conflict resolution. You can search for dependency declarations without version (with some effort), but that also does not mean the version is taken from a BOM, it could also be taken from a different dependency on that library somewhere else in the dependency tree.

Ah OK. thanks @Vampire