A multi-module parent POM declares the following BOM import:
io.s
There are two things. First the output of dependency:tree prints out what the final result is. The question here is why you don't believe it? And why do you manage the version yourself if you are using a BOM...
Apart from that you could use:
mvn help:effective-pom
And if you search a little bit better than you will come to the following pom file which contains the version definition like this:
3.5.5
4.3.11.Final
5.2.4.Final
2.4.3
2.3.13
2.4.7.Final
which are exactly the version which is printed out already by dependency:tree.