Hi folks,
Our company’s security scans flagged our custom Jira plugins as using an artifact from 2009 as part of our maven dependencies:
[ERROR] Unresolveable build extension: Plugin com.atlassian.maven.plugins:maven-jira-plugin:6.2.6 or one of its dependencies could not be resolved: The following artifacts could not be resolved: osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05, opensymphony:propertyset:jar:1.3-21Nov03, opensymphony:oscore:jar:2.2.7, com.atlassian.fugue:fugue:jar:1.0, com.dmurph:JGoogleAnalyticsTracker:jar:1.2.1-atlassian, com.atlassian.plugins:atlassian-plugins-osgi-testrunner:jar:1.2.3, com.atlassian.upm:upm-api:jar:2.15: Could not transfer artifact osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 from/to nexus
I don’t see any hardcoded dependency on osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 in our pom files (see attached). I can only tell that the maven-jira-plugin references the AMPS version:
<groupId>com.atlassian.maven.plugins</groupId>
<artifactId>maven-jira-plugin</artifactId>
<version>${amps.version}</version>
<extensions>true</extensions>
....
<properties>
<jira.version>8.5.2</jira.version>
<amps.version>6.2.6</amps.version>
Since the scan flagged dependencies for om.atlassian.maven.plugins:maven-jira-plugin:6.2.6 plugin, which is only mentioned in the excerpt I provided, my assumption is the dependencies might change with a different version of AMPS.
Does anyone know if AMPS 8.10.1 no longer has a dependency on osuser:osuser:jar:1.0-dev-log4j-1.4jdk-7Dec05 or any other way of removing it?
===============================================================
EDIT: After digging a bit deeper I see the latest version of maven-jira-plugin is 6.3.21 as per Index of maven-external/com/atlassian/maven/plugins/maven-jira-plugin (outside of the multiple 6.3.22.x versions).