I can see the module in the repo, but it doesn't appear to be published making the dependency management redundant. It also complicates validation of the bom as not all of its managed dependencies are resolvable.