Custom Jira Plugins Rely on osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 Dated to 2009

Hi folks,
Our company’s security scans flagged our custom Jira plugins as using an artifact from 2009 as part of our maven dependencies:

[ERROR] Unresolveable build extension: Plugin com.atlassian.maven.plugins:maven-jira-plugin:6.2.6 or one of its dependencies could not be resolved: The following artifacts could not be resolved: osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05, opensymphony:propertyset:jar:1.3-21Nov03, opensymphony:oscore:jar:2.2.7, com.atlassian.fugue:fugue:jar:1.0, com.dmurph:JGoogleAnalyticsTracker:jar:1.2.1-atlassian, com.atlassian.plugins:atlassian-plugins-osgi-testrunner:jar:1.2.3, com.atlassian.upm:upm-api:jar:2.15: Could not transfer artifact osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 from/to nexus

I don’t see any hardcoded dependency on osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 in our pom files (see attached). I can only tell that the maven-jira-plugin references the AMPS version:


Since the scan flagged dependencies for om.atlassian.maven.plugins:maven-jira-plugin:6.2.6 plugin, which is only mentioned in the excerpt I provided, my assumption is the dependencies might change with a different version of AMPS.

Does anyone know if AMPS 8.10.1 no longer has a dependency on osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 or any other way of removing it?


EDIT: After digging a bit deeper I see the latest version of maven-jira-plugin is 6.3.21 as per Index of maven-external/com/atlassian/maven/plugins/maven-jira-plugin (outside of the multiple 6.3.22.x versions).