Don't know where a SBT dependency comes from - sbt

Question

I have a SBT project with many dependencies.
It complains it cannot download a dependency.
I have not listed explicitly. It could be a transitive dependency.
The commands dependencyList or dependencyTree doesn't list it, whereas the update task fails. I'm quite used to use these tasks for guessing things.
> update
[info] Updating
[info] Resolved dependencies
[warn]
[warn] Note: Unresolved dependencies path:
[error] stack trace is suppressed; run last servision / update for the full output
[error] (servision / update) sbt.librarymanagement.ResolveException: Error downloading javax.media:jai_codec:1.1.3
[error] Not found
[error] Not found
[error] not found: /home/.ivy2/localjavax.media/jai_codec/1.1.3/ivys/ivy.xml
[error] not found: https://repo1.maven.org/maven2/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] not found: https://ec.europa.eu/cefdigital/artifact/content/groups/public/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] download error: Caught javax.net.ssl.SSLHandshakeException (No subject alternative DNS name matching nexus.osgeo.org found.) while downloading https://nexus.osgeo.org/repository/Geoserver-releases/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] not found: http://maven.geo-solutions.it/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] not found: http://jbig2-imageio.googlecode.com/svn/maven-repository/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] not found: http://www.billylieurance.net/maven2/javax/media/jai_codec/1.1.3/jai_codec-1.1.3.pom
[error] No fallback URL found
I've tried to list the dependency with a from clause, but it doesn't work either.
The whatDependsOn command doesn't recognize the dependency.
n> whatDependsOn javax.media jai_core
[error] Expected whitespace character
[error] Expected 'commons-pool'
[error] Expected 'commons-beanutils'
[error] Expected 'xml-apis'
[error] Expected 'oro'
[error] Expected 'org.postgresql'
[error] Expected 'org.checkerframework'
[error] Expected 'commons-digester'
[error] Expected 'commons-codec'
[error] Expected 'commons-betwixt'
[error] Expected 'commons-collections'
[error] Expected 'commons-logging'
[error] Expected 'ddlutils'
[error] Expected 'commons-dbcp'
[error] Expected 'net.postgis'
[error] Expected 'commons-lang'
[error] Expected 'org.slf4j'
[error] Expected 'io.circe'
[error] Expected 'org.typelevel'
[error] Expected 'com.chuusai'
[error] Expected 'todovision'
[error] Expected 'jakarta-regexp'
[error] Expected 'javax.servlet'
[error] Expected 'javax.activation'
[error] Expected 'javax.xml.bind'
[error] Expected 'javax.measure'
[error] whatDependsOn javax.media jai_core
This worksaround doesn't work either (I've placed previously the offending .jar in lib/):
projectDependencies += "javax.media" % "jai_core" % "1.1.3" from s"file://${baseDirectory.value}/lib/jai_core-1.1.3.jar"
This one does work:
projectDependencies += "javax.media" % "jai_codec" % "1.1.3" from "https://mywebserver.com/jai_codec-1.1.3.jar"
but it makes me upload the .jar to a web server.
I think this is a bug in SBT or Coursier.