how does maven determine the version of transitive dependencies?

If a dependency is added in multiple places, Maven takes the one that:

• Is closer to your pom.xml in the hierarchy (transitive dependency vs. transitive dependency of a transitive dependency)
• If the depth is the same - it takes the first occurrence.

In order to guarantee which version is taken you need to declare it in your <dependencyManagement> section. This overrides whatever is declared in transitive dependencies.

if a component version is not explicitly defined in POM, maven would default to latest

No, you can't define a dependency without an explicit version. Maven supports ranges though, but they are considered bad practice as this would lead to non-repeatable builds.

I guess that you have somewhere a dependency that requires jackson-databind 2.10. The higher version forces maven to override the jackson-databind 2.8.2 required by jsonwebtoken.

But, if you include the jackson-databind explicitly in your project in another version, than that version overrides the version from the transitive dependency.

If you use eclipse, you can check the "Dependency Hierarchy.". Here as an example, if you include jackson-databind explicitly:

.. and here if you have two dependencies, that both include a transitive dependency with different versions (in this case spring-aop: spring-boot-starter-security wants 5.0.4.RELEASE, but gets "updated" due to spring-boot-starter-weg to 5.1.5.RELEASE):