The irony is that it even has something like lockfiles as well: The <dependencyManagement> section:

> Dependency management - this allows project authors to directly specify the versions of artifacts to be used when they are encountered in transitive dependencies or in dependencies where no version has been specified.

It's just less convenient because you have to manage it yourself.