And FWIW what I expected from the karaf BOM was that I would get build dependency versions from whatever that version of karaf pulls in as runtime dependencies.
That was what I requested, when I noticed that a lot of my dependencies were ancient compared to what the current version of karaf was using. So I think that maybe what the karaf BOM is today was what I wished for and what I got...? (so maybe I don't want it to change any...?)