maven-enforcer-plugin complains about dependencies that I cannot find in pom.xml files

Question

I am encountering a problem with the maven-enforcer-plugin. It is complaining with the following (simplified) output:

[WARNING] Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:
Failed while enforcing releasability the error(s) are [
Dependency convergence error for com.company.project:interfaces:1.0.4 paths to dependency are:
+-com.company.project:product:1.0.14-SNAPSHOT
  +-com.company.project:some_part_A:1.0.0
    +-com.company.project:interfaces:1.0.4
and
+-com.company.project:product:1.0.14-SNAPSHOT
  +-com.company.project:some_part_B:1.0.0
    +-com.company.project:some_sub_part_BB:1.1.0
      +-com.company.project:interfaces:1.0.4
and
+-com.company.project:product:1.0.14-SNAPSHOT
  +-com.company.project:interfaces:1.0.6

The problem is with some_sub_part_BB:1.1.0. According to the plugin, this part has a dependency on version 1.0.4 of the interfaces. But this is not possible: version 1.0.0 of some_sub_part_BB used interfaces version 1.0.3, and version 1.1.0 of some_sub_part_BB went directly to using interfaces version 1.0.6. I do not have any artifacts of some_sub_part_BB that uses version 1.0.4.

I guess I'm looking at some bug of the plugin, but I would like to debug this issue to make sure what is going wrong. Is this an issue anyone has encountered before, or can someone provide me any pointers on how to debug this problem? (I am fairly new to Maven, and aside from checking all the pom.xml files I have no idea where to look further).

---

Side note: The idea is (was) that the interface version to be used is specified on the project level POM, so that all (sub-) parts agree on which interface to use. However, as you can see, the different parts also specify which interface they use, which I don't think is the correct way of doing this. I haven't figured out how to fix this (yet).

Answer 1

Turns out that this is not a bug: in the pom.xml file, you can overrule versions of artifacts in the section dependencyManagement. In my case, someone enforced version 1.0.4 of the interfaces. The enforcer plugin does not show this; it only became apparent to me after generating the dependency tree with the verbose flag, i.e. mvn dependency:tree -Dverbose.