执行mvn go-offline时下载已移除的log4j-core:2.11.2问题排查求助

执行mvn go-offline时构建失败，原因是Maven尝试下载log4j-core:2.11.2，但该版本因Log4Shell漏洞已被公司Artifactory移除。

目前无法定位项目依赖这个版本的原因：

• 已在pom中显式定义log4j-core:2.17.1依赖
• 执行mvn dependency:tree（含-Dverbose=true参数）完全找不到log4j-core:2.11.2的踪迹
• mvn install执行正常，不会请求该版本，仅mvn go-offline命令会触发下载请求

项目核心配置 #

项目使用Spring Boot父pom，相关配置如下：

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.6.7</version>
    <relativePath/>
</parent>
...
<dependencies>
 <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.17.1</version>
 </dependency>
 ...
</dependencies>

关键命令日志 #

mvn -X dependency:go-offline 执行日志 #

[DEBUG] Resolving artifact org.apache.logging.log4j:log4j-core:pom:2.11.2 from [central (https://artifacts.mycompany.int/artifactory/maven-all, default, releases), snapshots (https://artifacts.mycompany.int/artifactory/maven-all, default, releases+snapshots), apache.snapshots (https://repository.apache.org/snapshots, default, snapshots)]
[INFO] Downloading from central: https://artifacts.mycompany.int/artifactory/maven-all/org/apache/logging/log4j/log4j-core/2.11.2/log4j-core-2.11.2.pom
[DEBUG] Writing tracking file /mybuilddir/.m2/repository/org/apache/logging/log4j/log4j-core/2.11.2/log4j-core-2.11.2.pom.lastUpdated
[WARNING] The POM for org.apache.logging.log4j:log4j-core:jar:2.11.2 is missing, no dependency information available
[DEBUG] Resolving artifact org.apache.logging.log4j:log4j-core:jar:2.11.2 from [central (https://artifacts.mycompany.int/artifactory/maven-all, default, releases), snapshots (https://artifacts.mycompany.int/artifactory/maven-all, default, releases+snapshots)]
[INFO] Downloading from central: https://artifacts.mycompany.int/artifactory/maven-all/org/apache/logging/log4j/log4j-core/2.11.2/log4j-core-2.11.2.jar
[DEBUG] Writing tracking file /mybuilddir/.m2/repository/org/apache/logging/log4j/log4j-core/2.11.2/log4j-core-2.11.2.jar.lastUpdated
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:go-offline (default-cli) on project myproject: org.eclipse.aether.resolution.DependencyResolutionException: Could not find artifact org.apache.logging.log4j:log4j-core:jar:2.11.2 in central (https://artifacts.mycompany.int/artifactory/maven-all) -> [Help 1]

mvn -X org.apache.maven.plugins:maven-dependency-plugin:3.3.0:tree -Dverbose=true 执行结果（关键片段） #

[DEBUG] com.mycompany:myproject:jar:1.7.0
...
[INFO] +- org.apache.logging.log4j:log4j-core:jar:2.17.1:compile
...

求助与疑问 #

无法理解为何依赖树中未列出的版本会被go-offline命令请求，是否存在未被打印的传递依赖？如果是，如何让依赖树显示该版本及其引入构件？求提供具体排查建议。

内容的提问来源于stack exchange，提问作者prodigaltim