[tonsky]

It’s totally fine in Maven, no need to rebuild or repackage anything. You just override version of libinsecure in your pom.xml and it uses the version you told it to

[zahlman]

So you... manually re-lock the parts you need to?

[aidenn0]

Don't forget the part where Maven silently picks one version for you when there are transitive dependency conflicts (and no, it's not always the newest one).

[deredede]

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?