Matej Novotny: I saw WELD-1893 and thought it was a bit vague on what to do... especially since the linked deltaspike issue has been closed.

But now that I read the deltaspike issue discussion I guess they had the same point to be made:

Also, the weld-core-bom is in fact something like a "depchain" and not a "BOM" (given how the terms are commonly used, AFAIK), since the weld-core-bom declares <dependencies> instead of <dependencyManagement>.

Maybe you want to inform Jozef Hartinger that this issue is a duplicate of his. Given that here is already more information provided I'd suggest to close his issue.