starting with spring-boot-2.3.0 dependencies seem to be enforced even without applying `spring-boot` plugin / dependency management. I couldn't find any changes documented in that respect.