All runtime dependency versions should be explicitly defined in the jboss-as-parent pom. This provides an easy reference for current dep versions and ensures that there are no unexpected dependency upgrades.
The reason this popped up is because a runtime dependency (apache commons-net) which was relying on the external BOM to define its version. This dependency was introduced in a separate commit from the one that added the BOM. 6.x PR: https://github.com/jbossas/jboss-eap/pull/1171
Done in EAP 6.3.0.ER1