I've filed an issue against the Assembly plugin, although the Dependency plugin is also affected.
https://issues.apache.org/jira/browse/MASSEMBLY-848 Maven itself appears to resolve the dependencies correctly, but evidently some plugins don't go via the same mechanism. M
pgpGZ63hG9L65.pgp
Description: OpenPGP digital signature
