I think that’s right, but in practice, I doubt it is really combinatorial. My hypothesis is that there are only certain combinations of jars that cause versions to move. Also, you only need to care about the combinations that dependencies actually use.