Ideally you update the bom and you're done, however in Vaadin's case not all module requiring the dependency are in sync with the latest bom (see e.g. BUILD-441). Still, I guess at least ui, widgetset, widgetset-pro and pages could just use the version in bom. So that the dependency bot can update Vaadin and test it like any other dependency. Also fgrilli says the various versions of Vaadin & maven-vaadin-plugin used to diverge, which is no longer relevant.

—
DEV NOTES:
Unfortunately there’s no way to import pluginManagement (nor properties) from a BOM the same way we import depMgmt from a BOM. Removing a project-specific vaadinVersion property and relying on the version set in BOM results in an error. For instance, in UI

[INFO] --- maven-enforcer-plugin:3.0.0-M1:enforce (enforce-basics) @ magnolia-ui-vaadin-common-widgets ---
[WARNING] Rule 1: org.apache.maven.plugins.enforcer.RequirePluginVersions failed with message:
Some plugins are missing valid versions:(LATEST RELEASE SNAPSHOT are not allowed )
com.vaadin:vaadin-maven-plugin. 	The version currently in use is 21.0.2

Some input from Mika:
Anything pipelines could do? (script a stage to update local project config?)
or should we consider build-time vs. runtime concerns separately?

• merge widgetset into webapp(s) so we don't have to maintain an extra vaadinVersion there, maybe merge both widgetsets together again for simplicity's sake
• API compatibility checks in client (GWT) and server sources against latest managed Vaadin version (could still compile w/ an older one if no incompatibiliy surfaces)