So I guess I should explicitly exclude joda-time from the dropwizard-core dep and then declare it as an explicit dependency in my pom, thus locking down the version I actually want?
[WARNING]
Dependency convergence error for joda-time:joda-time:2.2 paths to dependency are:
+-my:component:0.0.3-SNAPSHOT
+-com.yammer.dropwizard:dropwizard-core:0.6.2
+-joda-time:joda-time:2.2
and
+-my:component:0.0.3-SNAPSHOT
+-com.yammer.dropwizard:dropwizard-core:0.6.2
+-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.1.2
+-joda-time:joda-time:2.1
Yes, that's what you should do.
(FWIW, Dropwizard 0.7.0 will be enforcer-compliant.)