Hi,
The officially recognized and supported plugin by Atlassian for Jira plugin development is jira-maven-plugin (so the latest). Therefore, for developing plugins for Jira, you should use jira-maven-plugin.
As for log4j, you can pull log4j version 2.x via jira-core in provided scope.
Be careful, log4j will be removed from Jira 10 : Announcing Data Center Platform 7.0. Next step to improve our security posture
May be start to pull the latest log4j on maven