I realized that the compressed size of Bobby's source is actually about 7 kb and the rest are bundled JARs.

Could you explain the purpose of each one? Maybe it's possible to replace some of them with lighter alternatives.

The "fabric-" ones could be replaced with a dependency of Fabric API, for example.

fabric-command-api is used to register the /bobby upgrade command.
fabric-api-based is a dependency of fabric-command-api.
configurate-core is used to serialize/deserialize/live-reload bobby's configuration.
configurate-hocon makes available the HOCON format for aforementioned config.
config and geantyref are dependencies of configurate.

The "fabric-" ones could be replaced with a dependency of Fabric API, for example.

But that literally triples overall size and requires people to now install another mod 95% of which I don't need.
For configurate bobby used to depend on Confabricate but that got stuck in 1.16.

I realized that the compressed size of Bobby's source is actually about 7 kb and the rest are bundled JARs.

You can't compare source code size with the jar size. Java source code is generally smaller than the compiled binary. And text compression is generally ridiculously good as well. If you simply remove the bundled jars from the bobby jar, you're still left with 100kb.