To the best of my knowledge, we currently do not have a good solution to add features to core that would be implemented with the help of existing libraries without exposing those libraries to plugins.

1. Doing it in a plugin doesn't necessarily work without needlessly adding an extension point, thinking about competing implementations, plus what if it's supposed to be non-optional/internal behavior that admins should not need to think about every time they open the plugin manager?
2. Jenkins modules are basically dead since JEP-230
3. There's no generic jenkins-core-impl module that would be able fill holes prepared in jenkins-core.
4. Vendoring libraries (copying stuff into the Jenkins source tree, like https://github.com/jenkinsci/jenkins/tree/master/core/src/main/java/jenkins/org/apache/commons/validator/routines ) is too much effort to maintain (AFAICT Dependabot wouldn't know about them).
5. Shading libraries? Still exposes them to plugins, and IIRC, this requires a full module for every library, otherwise shading doesn't work.
6. For completeness, just adding the dependency makes it available to use in plugins, from where it may be used, causing problems when it comes to updating the dependency incompatibly, or replacing it with something else because it was never intended for use in plugins in the first place.

As a core contributor wanting to add a dependency without exposing it to plugins, what am I supposed to do?