I don’t have a good answer here; this is the same issue that @mogoodrich has brought up recently (though I can’t find the thread).
Basically, we started taking an unsafe shortcut a few years ago, by having a bunch of modules all share their dependency versions by importing the distro pom, but it seemed to not cause any real-world problems for years, though recently more issues have come up.
So, yes, the dependency on distro.version=LATEST is the problem, because it will try to build against always-incrementing versions of other modules. If setting it to 2.3 solves the problem, then go ahead and do that.
OK.
Well, I tried to set the distro.version to 2.3 and it doesn’t solve the problem. After reading @mogoodrich thread you points me to, I understand now why.