Dave Ball I know this is marked as fixed, but I wanted to mention that this is sort of true. Tim Jacomb the current LTS image, as of today (sha256:ae4797bb5657c4e923b14928d7529cb4bbd05935b09f89eee7649a7d66a3d94d) has version 2.2.0 of the jenkins-plugin-cli (https://github.com/jenkinsci/plugin-installation-manager-tool) installed. This version seems to have a bug that allows it to select invalid versions of plugins that don't reflect the jenkins-version-specific update sites. It looks like if you replace the bundled jar file (in the LTS image @ /usr/lib/jenkins-plugin-manager.jar) with one that is current (2.5.0), then the plugins are versioned based on the current jenkins version correctly (and consequently doesn't pull v 2.23 of the workflow-basic-steps plugin).
I just stumbled through this myself (as we use the LTS docker image as an upstream). Hope this helps.
It also looks like the plugin bug itself is referenced in JENKINS-63941 (aside from the fact that it shouldn't appear in version specific update centers)
Edit: I lied, because the metadata even for version specific update centers isn't correct for v2.23 of this plugin, it's broken. This should probably be re-opened and tagged linked to JENKINS-63941