The good news is the version ranges do actually work.
The problem I described related to JBossAS doesn't exist if you use ranges.
i.e.
common-core has 1.0.1 and 1.0.2
jboss-aop 1.0.1 uses common-core 1.0.1
microcontainer 1.0.1 uses common-core 1.0.2
jboss-deployers 1.0.1 uses microcontainer 1.0.1
jbossas uses jboss-aop 1.0.1 and jboss-deployers 1.0.1
With only suggestions the older common-core 1.0.1 gets used
because jboss-aop's dependency is closer to the root of jbossas.
With the constraints i.e. replace 1.0.2 with
[1.0.2,)
[1.0.1]