I set up <dependencyManagement> for most of the deps. The advantage of this is that whatever version shows up in <dependencyManagement> is forced on all the transitive dependencies.
This means we don't need to worry about excluding old versions of guava, etc from dependencies - guava version will always be forced to ${guava.version} (unless, of course, the user's pom overrides ours).
This seems to have cleaned up our dependency tree considerably.
Jeff