Michael Neale Ivan Meredith, Spent some time on this. Looks like Jenkins 2.46.3 loads plugins differently than 2.7.3. Here is whats going on:

blueocean-pipeline-api-impl fails to load because plugins get loaded in this sequence:

1. github-branch-source:jar:2.0.5
   1. plain-credentials:jar:1.1 
2. pipeline-model-definition:1.14
   1. credentials-binding:1.11
      1. plain-credentials:jar:1.3 : This FAILS 

If you look up at blueocean-pipeline-api-impl pom file, github-branch-source is before pipeline-model-definition and it gets resolved in that order, at least in 2.46.3. This results in jenkins loading github-branch-source first (which installed plain-credentials:1.1. and then it tries to install pipeline-model-definition and it fails because there is older version of plain-credentials(1.1) installed. See log: https://gist.github.com/vivek/54489c23c3cebe0eb7aa88aca1b4f920.

<dependency>
    <groupId>org.jenkins-ci.plugins</groupId>
    <artifactId>github-branch-source</artifactId>
</dependency>
<dependency>
    <groupId>org.jenkinsci.plugins</groupId>
    <artifactId>pipeline-model-definition</artifactId>
</dependency>

It might not just be issue of ATH, there are other use cases, like running aggregator inside another plugin. So, there are multiple-ways to fix it, 

1. Change order of how github-branch-source and pipeline-model-definition appear in blueocean-pipeline-api-impl. That is pipeline-model-definition appears first and then github-branch-source. We are adding both these plugins for better out of the box experience. Good opportunity to move them to aggregator? Anyways, I tested this and it works well.
2. Add plain-credentials:jar:1.3  dependency in runtime-deps/pom.xml

We should go for option 1 only if it breaks running aggregator as dependency in another plugin via mvn hpi:run. I will test it shortly. I would also like to test beta-5 (once we release it, shortly) on 2.46.3 to ensure all is well.

This issues is specific to ATH. I tested creating new plugin that depends on aggregator and it works just fine. We should add dependency of plain-credentials:1.3 in runtime-deps/pom.xml.

Vivek I tried adding it to the ATH but it still failed, so perhaps we should re open this as an ATH ticket? There doesn't seem to be an easy solution.

@Vivek should we adjust the order of dependencies?

It may be preferable than adding another specific version somewhere.

Michael Neale ah, looks like it didn't work for you because of a bug in maven.sh. I mentioned proper fix in https://issues.jenkins-ci.org/browse/JENKINS-39630. I will submit a PR.

We can do reordering fix but that would be a hack as we do not know how later versions of jenkins might pick order. Besides we do not want to put a fix in blueocean as it doesn't break it's use case of running directly thru aggregator.

Michael Neale Right, it doesn't work. It was false positive that made me think it worked. Given nature of how 'hpi:assemble-dependencies' works, it's fair to go with re-ordering of dependencies as I mentioned in this ticket. 

Or maybe assemble ath dependencies in separate output directory using `hpi:assemble-dependencies DoutputDirectory=target/ath-plugins` and then later copy them over to 'target/plugins' after copying bluocean plugins from `$AGGREGATOR_DIR/target/plugins/*.hpi`. 

Having explored these options I think re-rdering is the only thing I see going to work. I will leave it up to Ivan Meredith to do further exploration.