I just noticed that Confluence is accidentally including two versions of JTA dependencies. If you look in (confluence-std-2.6.0)/confluence/WEB-INF/lib/ there are:

rw-rr- 8809 Aug 16 03:13 jta-1.0.1.jar
rw-rr- 8382 Aug 16 03:10 jta-1.0.1B.jar

In addition there are dependencies where the newer version of the jar could likely be used instead of the older version like:

rw-rr- 247021 Aug 16 03:13 jtidy-r8-20050104.jar
rw-rr- 246990 Aug 16 03:09 jtidy-r8-21122004.jar

And (although this one looks a little scarier since it decreased in size):

rw-rr- 63992 Aug 16 03:07 mockobjects-j1.3-j2ee1.3-0.07.jar
rw-rr- 57598 Aug 16 03:07 mockobjects-jdk1.3-j2ee1.2-0.09.jar

And ofbcore which according to a different ticket isn't even being used:

rw-rr- 236334 Aug 16 03:17 ofbcore-entity-2.1.1-atlassian-21Mar06.jar
rw-rr- 150255 Aug 16 03:10 ofbcore-ofbcore-share-2.1.1.jar

Duplicate jars:

rw-rr- 6672 Aug 16 03:13 pell-multipart-2.1.5.jar
rw-rr- 6672 Aug 16 03:09 pell-multipart.jar

And mixtures of duplicate and different versions like:

rw-rr- 12318 Aug 16 03:13 alt-0.07-j1.3-j2ee1.3.jar
rw-rr- 8116 Aug 16 03:11 alt-0.07-jdk1.3.jar
rw-rr- 8116 Aug 16 03:08 alt-jdk1.3-0.07.jar

Since there was also a dependency issue in 2.5.7, it would seem as if Atlassian might want to implement some sort of process in which someone reviews the list of dependencies included with all of the developers to make sure it is sane before releasing a final build.

Dependencies of a dependency can be excluded in a Maven 2 pom by using the exclusions element, for example:

<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
<exclusion>
<groupId>logkit</groupId>
<artifactId>logkit</artifactId>
</exclusion>
<exclusion>
<groupId>avalon-framework</groupId>
<artifactId>avalon-framework</artifactId>
</exclusion>
<exclusion>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
</exclusion>
</exclusions>
</dependency>

I know that if you have two different versions of dependencies each built against some other version of the same dependency, that it is tricky to remove one or the other and in some cases perhaps it would make sense to have two different versions of the same jar and hope that the JVM can figure it all out. However, when you see duplicate dependencies in the list, to me that just looks a little sloppy.

Hope this helps.