The issue has been introduced in https://github.com/jenkinsci/jenkins/commit/036a8e94ed37cf851f0cafb9cb12c21e3496ed7c
PluginManager::addDependencies() is supposed to recursively check the plugin dependency tree and to construct a list. But calls in if (dependencyURL != null) are misordered
If pluginA depends on pluginB, which depends on pluginC...
1) We invoke addDependencies() for pluginB if pluginA is being loaded
2) We pass through the first iteration of the method and get into if (dependencyURL != null)
3) We add pluginB to the list and invoke addDependencies for children ([pluginC])
4) We enter second addDependencies() and exit on the first condition, because dependencySet already contains pluginB => we exit without adding pluginC to the dependency list