ok i figured it out. lein-nvd sets the version of its nvd-clojure dep dynamically and defaults to the maven special keyword "RELEASE" which always gets the latest
i would still be interested to know if there is a way to ask lein to print out what dependencies a plugin is going to pull in
@nickmbailey
lein deps :plugin-tree
https://github.com/technomancy/leiningen/blob/2.9.1/src/leiningen/deps.clj#L107 See these doc strings for more details.
thanks!