How to properly use Maven BOM-s?

I haven't done this in a very long time, so I seem to have forgotten the proper way of doing it. I would like to create BOM file in which I'd like to have a bunch of dependencies defined in a <dependencyManagement/> section and then not have to define them as dependencies in my projects.

Could somebody clarify how this works? Were BOM files just for declaring a set of dependencies in a POM file that could then use versionless, similarly to parents (except you can have as many of these, as you like), or could you also make it declare the dependencies for you?

For example, if my BOM has a <dependencyManagement/> section, do I also need to have it define a <dependencies/> one, if I wanted to make all projects that use the BOM, always use all of the dependencies? In the project using the BOM, I have the following defined in the <dependencyManagement/>:

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>${project.groupId}</groupId>
                <artifactId>foo-bom</artifactId>
                <version>${project.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

Do I still need to manually import the versionless dependencies via explicit declarations in the POM where they are being imported? Is the correct way to also define them as <dependencies/> in the BOM (outside the <dependencyManagement/> section)?

Solution

BOMs are dependencyManagement only. They cannot declare dependencies.

They serve two main purposes:

You can add your dependencies versionless (and the version will come from the BOM).
They override versions of transitive dependencies that you pull (so that you can make sure that you have a recent log4j even if one your dependencies pulls an ancient one).

If you really want to add a bunch of dependencies, write a POM with these dependencies and add it as dependency.