>> Have we ever actually looked in detail at all of our dependencies' dependencies to see that we're >> actually getting what we/they think we should? I personally haven't (b/c we assume it works rationally). I casually check the IdP's WEB-INF/lib during a release, but not rigorously (i.e. comparing to what Maven says). Tom