Implement @jglick's idea: move implicit dependency modifications to

UpdateSite, when reading plugin metadata

core/src/main/java/hudson/ClassicPluginStrategy.java

@@ -275,6 +275,7 @@ public class ClassicPluginStrategy implements PluginStrategy {
     /**
      * Returns all the plugin dependencies that are implicit based on a particular Jenkins version
      */
+    @Nonnull
     public static List<PluginWrapper.Dependency> getImpliedDependencies(String pluginName, String jenkinsVersion) {
         List<PluginWrapper.Dependency> out = new ArrayList<>();
         for (DetachedPlugin detached : DETACHED_LIST) {

core/src/main/java/hudson/PluginManager.java

@@ -1156,19 +1156,6 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
             if (p == null) {
                 throw new Failure("No such plugin: " + n);
             }
-            
-            // JENKINS-33308 - automatically install implied/previously bundled dependencies for older plugins that may need them
-            for(PluginWrapper.Dependency previouslyBundledDependency : ClassicPluginStrategy.getImpliedDependencies(p.name, p.requiredCore)) {
-                // if they aren't already installed, note the dependencies show 'need restart' messages if installed multiple times
-                // but it can't be prevented here
-                if(getPlugin(previouslyBundledDependency.shortName) == null) {
-                    // as these are basically jenkins core, these should always be installed from the default update center
-                    UpdateSite.Plugin previouslyBundledPlugin = getPlugin(previouslyBundledDependency.shortName, UpdateCenter.ID_DEFAULT);
-                    Future<UpdateCenter.UpdateCenterJob> jobFuture = previouslyBundledPlugin.deploy(dynamicLoad, correlationId);
-                    installJobs.add(jobFuture);
-                }
-            }
-            
             Future<UpdateCenter.UpdateCenterJob> jobFuture = p.deploy(dynamicLoad, correlationId);
             installJobs.add(jobFuture);
         }

core/src/main/java/hudson/model/UpdateSite.java

@@ -25,6 +25,7 @@
 
 package hudson.model;
 
+import hudson.ClassicPluginStrategy;
 import hudson.PluginManager;
 import hudson.PluginWrapper;
 import hudson.Util;
@@ -467,7 +468,17 @@ public class UpdateSite {
                 core = null;
             }
             for(Map.Entry<String,JSONObject> e : (Set<Map.Entry<String,JSONObject>>)o.getJSONObject("plugins").entrySet()) {
-                plugins.put(e.getKey(),new Plugin(sourceId, e.getValue()));
+                Plugin p = new Plugin(sourceId, e.getValue());
+                // JENKINS-33308 - include implied dependencies for older plugins that may need them
+                List<PluginWrapper.Dependency> implicitDeps = ClassicPluginStrategy.getImpliedDependencies(p.name, p.requiredCore);
+                if(!implicitDeps.isEmpty()) {
+                    for(PluginWrapper.Dependency dep : implicitDeps) {
+                        if(!p.dependencies.containsKey(dep.shortName)) {
+                            p.dependencies.put(dep.shortName, dep.version);
+                        }
+                    }
+                }
+                plugins.put(e.getKey(), p);
             }
 
             connectionCheckUrl = (String)o.get("connectionCheckUrl");
@@ -612,7 +623,7 @@ public class UpdateSite {
         public final String[] categories;
 
         /**
-         * Dependencies of this plugin.
+         * Dependencies of this plugin, a name -&gt; version mapping.
          */
         @Exported
         public final Map<String,String> dependencies = new HashMap<String,String>();