Risks assessment:
There is an uncaught NPE in PluginWrapper#getDeprecations. It's triggered whenever the UpdateSite latest data information is null. Initially I thought it's only possible in Test environment, but maybe it's possible to be null on production as well; for example, after a call to UpdateSite#doInvalidateData or if the updates/xxx.json file is not found.
When is this called? It's called on every page load because an AdministrativeMonitor calls this method. So the logs will fill up with
2020-08-31 14:20:16.841+0000 [id=89] WARNING jenkins.model.Jenkins#lambda$getActiveAdministrativeMonitors$1
java.lang.NullPointerException
at hudson.PluginWrapper.getDeprecations(PluginWrapper.java:1310)
at hudson.PluginWrapper.isDeprecated(PluginWrapper.java:379)
at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:174)
at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:948)
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:482)
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:472)
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708)
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:566)
at hudson.PluginManager$PluginDeprecationMonitor.getDeprecatedPlugins(PluginManager.java:2264)
at hudson.PluginManager$PluginDeprecationMonitor.isActivated(PluginManager.java:2258)
...
...
Although Jenkins will remain responsive. (edited)
Besides the monitor, any other code calling PluginWrapper#isDeprecated may trigger the same exception.
Fixed on https://github.com/jenkinsci/jenkins/commit/3ea9dc6b3ad4e158b19060f7f0f969577b5a22cf