Not sure where this question goes.
At the moment Eclipse Platform consumes ASM directly from Maven, which means the version it has in its I-builds is 9.3.0 - GPG signed.
Orbit also has ASM 9.3.0, made in the same way as 9.2.0 and previous releases. This means Orbit contributes version 9.3.0.v20220409-0157 - jar signed.
I am concerned this means we can end up with both versions in SimRel a bit too easily.
What, if anything, should we do about this? Is this the expected outcome?