Why does "mvn dependency:tree" list one version, but "mvn clean install" try to download another version? - maven

Question

I've got a Maven (3.2.5) project which is failing due to a missing dependency. The relevant part of the mvn clean install output:
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5:single (package-jar-with-dependencies) on project splitter: Failed to create assembly: Failed to resolve dependencies for project: groupId1:splitter:jar:2.12.3: Missing:
[ERROR] ----------
[ERROR] 1) groupId2:location-service:jar:2.12.3
However, mvn depdency:tree claims that the 2.12.3 version is not necessary:
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # splitter ---
[INFO] groupId1:splitter:jar:2.12.3
[INFO] +- groupId2:location-service:jar:2.12.1:compile
There is no other location-service dependency listed.
The pom.xml explicitly calls out the 2.12.1 dependency:
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd>
<parent>
<groupId>groupId2</groupId>
<artifactId>artifactId</artifactId>
<version>2.12.0</version>
</parent>
...
<groupId>groupId1</groupId>
<artifactId>splitter</artifactId>
<packaging>jar</packaging>
<version>2.12.3</version>
<name>splitter</name>
<url>http://maven.apache.org</url>
...
<dependencies>
<dependency>
<groupId>groupId2</groupId>
<artifactId>location-service</artifactId>
<version>2.12.1</version>
</dependency>
...
Interestingly, the parent pom.xml is not available in this directory structure (the person that created the SVN branch branched a portion of the repository that didn't include the parent pom.xml). However, Maven does not complain about it missing, so it's getting it from my~/.m2/repository directory.

Answer 1

Sorry reputation seekers, yet again I found the solution to my question while composing it. But it's complicated enough to go ahead and post the question and answer, in case anyone else runs into a similar problem.
The problem turned out to be that the parent pom.xml in my ~/.m2/repository directory set the location-service dependency to ${project.version}. Apparently this was enough for the maven-assembly-plugin to want to download it, despite the explicit dependency in the module pom.xml. This is a bug in maven-assembly-plugin:2.2-beta-5. Neither the module nor the parent pom.xml name an explicit version of the maven-assembly-plugin. I haven't the foggiest idea why maven is selecting the 2.2-beta-5 version to download, as it isn't even close to the latest version. mvn dependency:tree -Dverbose doesn't even mention maven-assembly-plugin. Explicitly using maven-assembly-plugin:2.5.5 solves the problem.