How most basic pom file get pluginManagement in Effective pom - maven

Question

Just the most basic pom.xml file
Effective pom shows that it has pluginManagement with reference to maven-antrun-plugin
From where is it taken ?
How to avoid this ?
In bigger context such dependencies are shown as outdated by versions at "mvn clean versions:dependency-updates-report versions:plugin-updates-report", and they are outdated
$ mvn --version
Apache Maven 3.5.2 (138edd61fd100ec658bfa2d307c43b76940a5d7d; 2017-10-18T00:58:13-07:00)
Maven home: /opt/maven/default
Java version: 1.8.0_152, vendor: Oracle Corporation
Java home: /opt/jdk/jdk1.8.0_152/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "3.10.0-693.2.2.el7.x86_64", arch: "amd64", family: "unix"
$ cat pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.my</groupId>
<artifactId>myproject</artifactId>
<version>0.0-SNAPSHOT</version>
<name>myname</name>
</project>
$ mvn help:effective-pom | grep -A 20 "<pluginManagement"
<pluginManagement>
<plugins>
<plugin>
<artifactId>maven-antrun-plugin</artifactId>
<version>1.3</version>
</plugin>
<plugin>
<artifactId>maven-assembly-plugin</artifactId>
<version>2.2-beta-5</version>
</plugin>
<plugin>
<artifactId>maven-dependency-plugin</artifactId>
<version>2.8</version>
</plugin>
<plugin>
<artifactId>maven-release-plugin</artifactId>
<version>2.3.2</version>
</plugin>
</plugins>
</pluginManagement>
<plugins>
$ mvn versions:plugin-updates-report -DpluginUpdatesReportFormats=xml && cat target/plugin-updates-report.xml | grep -A 10 "<pluginManagements"
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building myname 0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.5:plugin-updates-report (default-cli) # myproject ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.704 s
[INFO] Finished at: 2017-12-13T14:35:15-08:00
[INFO] Final Memory: 19M/304M
[INFO] ------------------------------------------------------------------------
<pluginManagements>
<pluginManagement>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-antrun-plugin</artifactId>
<currentVersion>1.3</currentVersion>
<nextVersion>1.4</nextVersion>
<minors>
<minor>1.4</minor>
<minor>1.5</minor>
<minor>1.6</minor>
<minor>1.7</minor>

Answer 1

all such versions are from super pom
http://maven.apache.org/ref/3.5.2/maven-model-builder/super-pom.html , pluginManagement should be copied to pom.xml and version are upgraded in pom.xml to latest versions.