Pulling in one dependency could end up actually pulling in 3, because the package you want depends on two different packages. If we look at the above picture, it looks like we end up with 3 packages installed in our project, so if we go looking in to the built version, we expect to find 3 dependencies. I can’t update my project with a new log4j until I have a new version of “dep”, so I wait for “dep” version 7.6.16 then I release version 1.4.4