Sometimes it may be hard to find why in maven project some dependencies are resolved to specific version. In older maven versions there was a
mvn dependency:tree -verbose, but it was developed for Maven 2 and may not correctly work with Maven 3 as described on plugin page.
After looking around for some alternative, it looks like maven-helper-plugin does a great job to generate a very detailed effective pom with rich XML comments describing each dependency version (and each property value) source:
mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:effective-pom -Dverbose=true -Doutput=effective-pom.xml