This may be more of a general maven question, but I have a question about exclusion management in our POMs: Where do the exclusions need to be listed? For my parts of the system, I have an inconsistent mix of declaring the exclusions in, say, boms/, ee-feature-pack/, and my individual extension modules. That seems like overkill, though, and is certainly not dry. Is it enough to declare the exclusions in the dependencyManagement section of the BOM, then just declare the (versionless) dependency in the other Maven modules that might need it?

I don't want to repeat that large block of XML over and over, but I know we also don't want to ship any jars that we don't explicitly want.