Currently if you want to exclude a jar from a plugins manifest you mark the dependency as <optional>true</optional> or <scope>provided</scope>

this works at the plugin level but it also means those libraries are not available on the compile ./ test classpath of plugins that depend on the library.

This sounds bizarre, but there are several reasons why we may want to do this.

1. many plugins are bundling findbugs / spotbugs and we may want to have a global exclusion on them

2. a plugin may require some code to compile that may not be needed when running in Jenkins under a certain configuration and so it may want to conditionally inject the libraries (e.g. bouncycastle libraries may be provided by the JVM if the JVM has been setup to be FIPS compliant and so the bouncycastle-api should not expose it's bouncycastle libraries as they collide), conversely by default it would like to have them available to dependant plugins as it is unlikely they would be building / testing on a bouncycastle FIPS enabled JVM.

3. this could reduce the hacks needed to add specific libraries to the plugin-pom at provided level that are used to add the servlet-api but prevent packaging of them