The hpi of the plugin is 10.2 MiB
It packs:

• okhttp (that implies kotlin) -> use okhttp api plugin instead
• jackson -> use jackson api plugin
• jsoup -> use jsoup api plugin
• hamcrest (that is only needed for tests)
• commons-lang in version 2.6 which contains a security vulnerability and is EOL -> use the commons-lang3 api plugin
• Many annotation jars which are probably compile time only or anyway provided by parent pom (spotbugs)
• other apache commons packages that are partly provided by core and should not be repacked (e.g. commons-beanutils, commons-codec) or are available as api plugins (commons-math). Others seem unused (might be only there to make the enforcer happy)

Check if dependencies are really needed (e.g. velocity seems unused)