instruction: Explain Docker containerization in CI/CD pipelines
output: Archived LTS Changelog Back to Recent LTS Changelog 2.414.2 September 20, 2023 Security Important security fixes. security advisory Major enhancement Add allow-same-origin to the sandbox Content-Security-Policy directive of workspace and artifact browsers if the Resource Root URL feature is not used.
  Allow requests to resources like stylesheets and images, even if a reverse proxy prohibits cross-site requests. JENKINS-71366 Major bug fix The plain text console log will still be printed even if some console annotations are corrupt. JENKINS-61452 Bug fix New login page breaks login-theme-plugin (regression in 2.404). JENKINS-71238 Fix invalid CSS which caused some buttons to become invisible on hover (regression in 2.402). JENKINS-71238 2.414.1 August 23, 2023 Changes since 2.414 Security Important security fix. 2023-07-26 security advisory Major enhancement Update Debian images to version 12.0 (bookworm). Docker pull request 1687 Enhancement Add last build status to job page. pull 8129 Bug fix Remove rebuilder plugin from the setup wizard plugin selection. JENKINS-71630 Only disable the plugin manager "install" button if no plugins are selected (regression in 2.414). JENKINS-71698 Notable changes since 2.401.3 Major enhancement Update to various UI elements.
  Update appearance and framework for dropdown links.
  Modernize forms and pages. pull 8210 , pull 8179 , pull 8076 , pull 8025 , pull 7989 , pull 8015 , pull 7962 , pull 7716 , pull 7836 , JENKINS-70805 , pull 7891 , JENKINS-71160 , pull 7870 , JENKINS-71115 , pull 7887 , JENKINS-71152 , pull 7420 , JENKINS-70115 , pull 7922 , JENKINS-71177 , pull 7770 Update UI and function of Log Recorder.
  Display a notice when there are no logs available. pull 8186 , pull 8164 Allow cancelling the quiet down mode of a safe restart with an optional custom message for safe restarts (with new default message).
  Use a less dangerous color for the safeRestart banner.
  Allow setting the full prepareShutdown message instead of only the reason.
  Show a hint on the "Jenkins Unavailable" page about safe restarts. JENKINS-70059 Major bug fix Prefix the name of input elements of ListView to prevent form submission issues when an Item (job) is named elements . JENKINS-71200 Enhancement Use dialogs to delete computers, views, clouds, users and log recorders instead of dedicated pages. JENKINS-13545 Improve Content Security Policy compatibility. JENKINS-71034 , JENKINS-71035 , JENKINS-71036 , JENKINS-71037 , pull 8054 , JENKINS-71042 , JENKINS-71044 , JENKINS-71045 , pull 8039 , JENKINS-71040 , JENKINS-71041 Upgrade Winstone from 6.10 to 6.12.
  This includes the upgrade of Jetty from 10.0.13 to 10.0.15.
  Add or update MIME types for JavaScript files, JavaScript module files, AV1 Image File (AVIF) files, Web Open Font Format (WOFF) files, and WebAssembly files. Winstone 6.11 changelog , Winstone 6.12 changelog , Jetty 10.0.14 changelog , Jetty 10.0.15 changelog Update to sign-in page on desktop and mobile.
  Remove animations and modernize page. pull 7995 , JENKINS-71246 , pull 7872 Update to Builds widget UI. JENKINS-70220 , pull 7870 , JENKINS-71115 Rework clouds management into multiple pages to better scale to large numbers of clouds.
  Users of EC2 Plugin should update it to version 2.0.7 or newer for compatibility. JENKINS-70729 Add Japanese translation of Apply. pull 8140 Switch the double-launch checker to a regular administrative monitor. pull 8127 Add support for jakarta.inject annotations. pull 8065 Reduce the circumstances under which recent old builds will be loaded when starting new builds. pull 7998 Refinements to class loading behavior looking up special formatters for XML configuration files. pull 7976 Add a user experimental flag to run Jenkins without Prototype.js.
  Plugin authors should enable this flag and fix any issues that result from the removal of Prototype.js.
  In the future Prototype.js will be removed from Jenkins core. pull 7948 Make "Skip to content" link visible through keyboard navigation. pull 7956 Bug fix Fix update center proxy configuration hyperlink in error messages. JENKINS-71244 Fix support of clouds without a config.jelly file. pull 7972 2.401.3 July 26, 2023 Security Important security fix. security advisory Bug fix Remove incorrect text from JENKINS_HOME help. pull 8161 2.401.2 June 28, 2023 Major enhancement Warn administrators when their Linux operating system is approaching end of life. pull 7913 , pull 8082 , JENKINS-71428 , End of life operating systems Enhancement Upgrade from Guice 5 to 6. Guice 6.0.0 changelog , pull 8121 2.401.1 May 31, 2023 Changes since 2.401 Security Important security fix. 2023-06-14 security advisory Bug fix Fix the writing of emojis to XML (regression in 2.403). JENKINS-71182 Do not write NUL values to XML files.
  A technically illegal #x0 (NUL) could be written to Jenkins XML files but could no longer be read.
  Now the write will fail as well (regression in 2.398). JENKINS-71139 Remove "" trailing text from system dropdown menu. JENKINS-71345 Fix the warning icon in the workspaces temporary directory message. JENKINS-71160 Show full width filter field for builds on pages less than 970 pixels wide. JENKINS-71115 Notable changes since 2.387.3 Enhancement Simplify the names of the settings in Manage Jenkins. pull 7661 Use a card layout instead of a table for the dashboard on mobile. pull 7581 Refresh the Build with Parameters interface. pull 7748 Revamp icon legend as a modal. pull 7718 Refresh the design of the About Jenkins page. pull 7712 Running pipeline build logs can now be displayed across controller restarts without reloading in some environments. pull 7614 Introduce user experimental flags. JENKINS-69853 Add a copy button for the code snippets that start agents and for the Jenkins home directory.
  Warn user that copy button requires HTTPS. pull 7625 , pull 7678 , pull 7665 , JENKINS-21052 The default connection mode for the Java CLI client is now webSocket .
  You can specify http to continue to use the former default (for example because you are running Jenkins in a servlet container other than the recommended builtin Jetty, or because you are running an unusual reverse proxy which does not support WebSocket).
  You can also continue to specify ssh to use SSH transport (for example because you prefer to authenticate with a private key rather than an API token), or use a native SSH client. pull 7605 Simplify loading of JavaScript and CSS.
  Users of OWASP DependencyTrack must upgrade to 4.3.1 or later, and users of ServiceNow CI/CD must upgrade to 2.1 or later. pull 7827 Upgrade Spring Framework from 5.3.26 to 5.3.27. Spring Framework 5.3.27 release notes Upgrade bundled Winstone from 6.7 to 6.10.
  Add the excludeProtocols option.
  Improve logging during shutdown. pull 7632 , Winstone 6.10 changelog , Winstone 6.9 changelog , Winstone 6.8 changelog Bug fix Fix  pointer exception on the "Manage Jenkins" page when HTTP/2 is enabled. JENKINS-70630 Hide the Restart Jenkins checkbox in the update center if the controller doesn't support it. JENKINS-69489 Move set node temporarily offline/online buttons to appbar. JENKINS-70394 2.387.3 May 3, 2023 Bug fix Restore New Node button in computer overview for users with node creation permission. JENKINS-70820 Fix Delete Build button text overflow. JENKINS-70809 Hide Restart Jenkins checkbox in the update center if the controller doesn't support it. JENKINS-69489 Support emojis in Job DSL scripts. JENKINS-69129 2.387.2 April 5, 2023 A new GPG signing key is used for the Jenkins long term support package repositories. Follow the instructions in the upgrade guide to install the new public key on your computer. Major bug fix Adjust WebSocket idle timeout to 60 seconds by default, to avoid "WebSocketTimeoutException: Connection Idle Timeout" issues. JENKINS-69955 Bug fix Restore the redirect destination of the pluginManager/installNecessaryPlugins API endpoint. JENKINS-70599 Update bundled plugins to include fixes announced in 2023-01-24 and 2023-02-15 Jenkins security advisories. Jenkins Security Advisory 2023-01-24 , Jenkins Security Advisory 2023-02-15 Enhancement Sign WAR file and Windows installer with new code signing certificate. pull 358 2.387.1 March 8, 2023 Changes since 2.387 Security Important security fixes. security advisory Major bug fix Move 'set node temporarily offline/online' buttons to app-bar to make them clickable again (regression in 2.385). JENKINS-70394 Allow WebSocket agent connections to time out after 5m if a write never succeeds. JENKINS-70531 Fix the TcpSlaveAgentListenerRescheduler functionality.
  TcpSlaveAgentListener is automatically restarted on failure. JENKINS-70334 Bug fix Add script-security update to LTS baseline. JENKINS-70487 Do not submit empty telemetry data if an error occurred during data collection. JENKINS-70533 Update bundled Apache Mina SSHD API plugins from 2.9.1-44.v476733c11f82 to 2.9.2-50.va_0e1f42659a_a. CVE-2022-45047 Enhancement Limit the maximum number of search results. Notable changes since 2.375.3 Major enhancement Update to various UI elements.
  Modernize table display, page layout, and buttons. pull 6843 , pull 6995 , JENKINS-69339 , pull 7373 , pull 7452 , pull 7173 , JENKINS-70128 , pull 7556 , JENKINS-70112 , pull 7555 , pull 7475 , JENKINS-70209 , pull 7425 , JENKINS-70117 , pull 7597 , JENKINS-70240 , pull 7314 , pull 7203 , pull 7171 , pull 7364 , JENKINS-69517 , pull 7366 , pull 7364 , pull 7229 , JENKINS-69715 , pull 7352 , pull 7367 , pull 7368 , pull 7399 , JENKINS-70036 , pull 7427 , JENKINS-70121 , pull 6511 Add missing breadcrumb items in various locations. pull 6912 , pull 7487 , pull 7488 , pull 7489 , pull 7490 , pull 7491 , pull 7492 , pull 7493 , pull 7494 , pull 7495 , pull 7496 Update ANTLR2 grammars and code to ANTLR4. pull 7293 Update Spring Security from 5.7.4 to 5.8.0.
  This update includes several fixes and improvements. Spring Security 5.7.5 release notes , Spring Security 5.8.0 release notes , CVE-2022-31690 , CVE-2022-31692 Set default file size rotation of AsyncPeriodicWork / AsyncAperiodicWork task logs to 10MB. JENKINS-64151 Update appearance of tooltips and replace old library with Tippy.js. pull 6408 Major bug fix Several fixes and improvements for Websocket agents. JENKINS-70105 , pull 7309 Enhancement The minimum required Remoting version has been increased to 4.7 (released on February 16, 2021). pull 7340 Add telemetry related to distributed builds. JENKINS-70199 Add telemetry for activation of permissions that are not enabled by default. JENKINS-70044 Remove the notice in the plugin manager Updates tab about newer plugin versions not compatible with your current core version.
  Limit the display of updates to plugin versions actually being offered by the update center for your core version. JENKINS-62332 Show recommended actions, such as "update affected plugins", in security warnings popup. pull 7046 Jenkins no longer bundles a patched version of the deprecated Commons HttpClient 3.x library for use by plugins.
  Plugins should be migrated to the native Java 11 HTTP client or updated to depend on the legacy Commons HttpClient 3.x API plugin. Commons HTTP Client , Apache HTTP Client Remove the deprecated Multijob plugin from the setup wizard. pull 7413 Remove the deprecated WMI Windows Agents plugin from the setup wizard. pull 7414 Do not report implied dependencies for WMI Windows Agents plugin. JENKINS-70301 Avoid unnecessary configuration save when reloading configuration from disk. pull 7305 Robustness improvement regarding build number collisions. JENKINS-23152 Remove support for log rotation via SIGALRM .
  The command-line argument --daemon has been removed. pull 7256 Upgrade XStream from 1.4.19 to 1.4.20.
  This maintenance release addresses the security vulnerabilities CVE-2022-40151 and CVE-2022-41966, causing a Denial of Service by raising a stack overflow.
  It also provides new converters for Optional and Atomic types. XStream 1.4.20 release notes , CVE-2022-40151 , CVE-2022-41966 Upgrade Guice from 5.0.1 to 5.1.0.
  Guice 5.1.0 contains eight fixes and improvements. Guice 5.1.0 release notes Upgrade Spring Framework from 5.3.23 to 5.3.24. Spring Framework 5.3.24 release notes Bug fix Improve tooltip performance. JENKINS-70178 Fix the update of disabled plugins. JENKINS-69183 Close connection on the agent if the agent's liveness ping receives no response. JENKINS-70414 Delay initialization of cryptography needed for TCP inbound agents unless and until such an agent is connected. pull 7514 Delete .disabled files when uninstalling a plugin. JENKINS-68194 Fix a race condition affecting the launch of inbound agents. pull 7378 2.375.4 March 8, 2023 Security Important security fixes. security advisory Enhancement Limit the maximum number of search results. 2.375.3 February 8, 2023 Bug fix Resolve implied dependencies on WMI Windows Agent plugin. JENKINS-70301 Prevent Angry Jenkins when checking a non http(s) based update center URL. JENKINS-70240 Remove negative letter-spacing to improve legibility in some languages and fonts (regression in 2.340 + 2.350). JENKINS-70209 Restore link to last breadcrumb in Console view. JENKINS-70169 2.375.2 January 11, 2023 Enhancement Add telemetry related to distributed builds. JENKINS-70199 Major bug fix Wait for 10 seconds before attempting to reconnect a WebSocket agent, regardless of whether or not the controller is responding. Slow down websocket re-connect Memory leak when repeatedly connecting WebSocket agents. JENKINS-70103 Bug fix Updated bundled Script Security plugin from 1189.vb_a_b_7c8fd5fde to 1190.v65867a_a_47126.
  Updated JUnit plugin from 1156.vcf492e95a_a_b_0 to 1160.vf1f01a_a_ea_b_7f. Jenkins Security Advisory 2022-11-15 Fix console-view bouncing when new entries appear. JENKINS-69587 2.375.1 November 30, 2022 Changes since 2.375 Major bug fix Prevent potential deadlocks on websocket agents. JENKINS-69890 Fix Gravatar error on profile page (regression in 2.335). JENKINS-70023 Enhancement Add telemetry for activation of permissions that are not enabled by default. JENKINS-70044 Notable changes since 2.361.4 Major enhancement Update to various UI elements.
  Modernize icons, navigation, and buttons. JENKINS-65124 , pull 6728 , pull 6924 , pull 6956 , pull 6907 , pull 7052 , pull 7098 , pull 7074 , pull 7185 , pull 6886 , JENKINS-69032 , pull 7183 , pull 7182 , pull 7217 , pull 7216 , pull 7205 , JENKINS-69714 , pull 7197 Improve breadcrumb bar accessibility. pull 6912 Update the design of notifications. pull 7049 Update the weather and status icons. JENKINS-65124 Major bug fix Prevent a stack overflow when loading a queue (regression in 2.361). JENKINS-69850 Enhancement Winstone 6.6: Upgrade Jetty from 10.0.11 to 10.0.12.
  Remove support for OpenSSL-style PEM-encoded RSA private keys when running Jenkins with the embedded Jetty (Winstone) container and TLS.
  The flags --httpsPrivateKey and --httpsCertificate have been removed.
  The flags --ajp13Port and --ajp13ListenAddress have been removed.
  The flags --handlerCountMax and --handlerCountMaxIdle have been removed.
  The flags --toolsJar and --useJasper have been removed.
  Support HTTP/2 without the use of a custom --extraLibFolder option. pull 7117 , JENKINS-69624 , pull 7277 , JENKINS-69509 , Winstone 6.0 changelog , Winstone 6.1 changelog , Winstone 6.2 changelog , Winstone 6.3 changelog , Winstone 6.4 changelog , Winstone 6.5 changelog , Winstone 6.6 changelog , Jetty 10 and 11 blog post , Jetty 10.0.12 changelog , HTTPS with an existing certificate , Remove ability to load pem cert for winstone Add sidebar to plugin manager, increase search bar size. pull 6783 Add support for Apple's touch bar icons. pull 6768 Removed: The signed jenkins-parent-${JENKINS_VERSION}-src.zip source archives have been removed from Artifactory for future releases.
  Users who wish to download source archives for offline consumption are encouraged to do so via GitHub. pull 7061 , Artifactory , GitHub source code download Display email form validation errors near the data entry field in the setup form. JENKINS-68952 Show recommended actions (e.g., to update affected plugins) in security warnings popup. pull 7046 Clarify safe restart won't wait for Pipeline jobs. pull 7091 Allow form checker to check more than one thing at a time. pull 6951 Add documentation for the --paramsFromStdIn and --version command-line options. pull 7246 Bug fix Fix sorting of British currency in tables. pull 7250 Improve build progress animation when refreshing parts of the history/executors widget. JENKINS-68627 Fix the resize behavior of Execute Shell build steps. JENKINS-69320 Fix searchBar is  issue in setup wizard and when using custom Jenkins headers. JENKINS-69250 Ensure that temporary network partitions do not cancel the WebSocket ping thread (regression in 2.363). pull 7195 2.361.4 November 13, 2022 Major bug fix Prevent a stack overflow when loading a queue (regression in 2.361). JENKINS-69850 2.361.3 November 2, 2022 Major bug fix Fix a race condition that causes file descriptor leaks when cloud agents are created (regression in 2.294). JENKINS-69534 Bug fix Model link chevron is not in center in user build cause on console log. JENKINS-69257 Table columns get wider or smaller depending on the sort selection. JENKINS-67864 2.361.2 October 5, 2022 Major bug fix Fix thread safety in websockets handling. JENKINS-69543 Bug fix Fix the resize behavior of Execute Shell build steps (regression in 2.321 or 2.357). JENKINS-69320 Fix a potential FileAlreadyExistsException error on startup on systems with slow I/O. JENKINS-67624 Fix Plugin Manager selection buttons appearance. JENKINS-69467 Fix Java version check in /etc/init.d/jenkins . JENKINS-69570 Properly reset attributes of cached symbols. JENKINS-68805 2.361.1 September 7, 2022 Changes since 2.361 Security Important security fix. 2022-09-09 security advisory Major enhancement Winstone 6.1: Upgrade Jetty from 9.4.46.v20220331 to 10.0.11.
  Remove support for OpenSSL-style PEM-encoded RSA private keys when running Jenkins with the embedded Jetty container and TLS. Winstone 6.0 Changelog , Winstone 6.1 Changelog , Jetty blog , Remove ability to load pem cert for winstone Update to various UI elements.
  Modernize tables, forms, and progress bars. pull 6963 , JENKINS-69240 , pull 6961 , JENKINS-69230 , pull 6957 , JENKINS-69211 , pull 6930 , JENKINS-68957 , pull 6728 , JENKINS-68578 , pull 6922 , JENKINS-68851 Major bug fix Fix an error when rebuilding jobs triggered by polling (regression in 2.358). JENKINS-69210 Update Jenkins pom from 1.83 to 1.84.
  Ensure jar files and javadoc are up to date for 2.361.1. JENKINS-69198 Bug fix Upgrade Remoting from 3025.vf64a_a_3da_6b_55 to 3044.vb_940a_a_e4f72e to improve performance of previous fix for java.lang.OutOfMemoryError: unable to create new native thread on agents. pull 6936 , JENKINS-65873 , JENKINS-68954 , Remoting 3028.va_a_436db_35078 changelog , Remoting 3044.vb_940a_a_e4f72e changelog Use correct icon lookup, even when plugin ID includes multiple occurrences of "plugin". JENKINS-68801 Fix sorting list of installed plugins by timestamp in plugin manager (regression in 2.274). JENKINS-68750 Build number cut off on Safari (regression in 2.344). JENKINS-68390 Script console input box is not sizeable, yet the box looks like it is (regression in 2.321). JENKINS-68380 Developer: Temporarily restore compatibility with PowerMock-based tests (regression in 2.361.1 RC 1).
  PowerMock will be completely removed on or after June 1, 2023. JENKINS-69250 Notable changes since 2.346.3 Major enhancement Require Java 11 or newer. Blog post , JENKINS-68570 , JEP-236 , pull 6083 New design for project configuration page.
  Navigation links available on left side of screen. JENKINS-68282 Update to various UI elements.
  Modernize tables, forms, and progress bars. pull 6760 , JENKINS-68912 , pull 6698 , JENKINS-68934 , pull 6687 , JENKINS-68198 , pull 6651 , JENKINS-68672 Enhancement The instance-identity module has been converted to a detached plugin. JENKINS-55582 Update the minimum required Remoting version to 4.2.1. pull 6671 Keyboard shortcut added to focus global search bar (⌘ + K/CTRL + K). pull 6893 Blocked upstream projects in the queue block downstream projects when the option "Block build when upstream project is building" is enabled for the downstream project.
  Similarly, blocked downstream projects in the queue block upstream projects when the option "Block build when downstream project is building" is enabled for the upstream project. JENKINS-68780 Add breadcrumbs to "Manage Jenkins" and children of it.
  Developers should ensure they use relative links for navigating between pages if they are a child of "Manage Jenkins". pull 6126 Use native Java Platform functionality rather than Ant to load classes.
  The old behavior can be restored by setting -Dhudson.ClassicPluginStrategy.useAntClassLoader=true . pull 6571 Remove Java Web Start support for launching inbound agents, along with the GUI mode, the platform-specific agent installers, and the JAR signature. pull 6543 , Java Web Start Bug fix Connect breadcrumb context menus to items in subfolders. JENKINS-68906 Fix websocket reconnection in edge cases.
  Upgrade from Remoting 4.13 to 3044.vb_940a_a_e4f72e. pull 6576 , JENKINS-68542 , Remoting 3025.vf64a_a_3da_6b_55 changelog , Remoting 3028.va_a_436db_35078 changelog , Remoting 3044.vb_940a_a_e4f72e changelog Revert prior attempts to make log records collectible by limiting discarded messages. JENKINS-68417 2.346.3 August 10, 2022 Enhancement Upgrade Spring Framework from 5.3.19 to 5.3.20. pull 6565 , Spring Framework 5.3.20 changelog , CVE-2022-22970 , CVE-2022-22971 Bug fix Revert prior attempts to make log records collectible by limiting discarded messages. JENKINS-68417 Connect breadcrumb context menus to items in subfolders. JENKINS-68906 Improve progress bar visibility in shaded rows. JENKINS-68672 Update Remoting from 4.13.2 to 4.13.3 to improve performance of previous fix for java.lang.OutOfMemoryError: unable to create new native thread on agents. JENKINS-65873 2.346.2 July 13, 2022 Enhancement Remove deprecated Docker plugin installation script install-plugins.sh .
  Use plugin installation manager tool through the jenkins-plugin-cli script in the Docker image. Docker pull request 1408 , Plugin installation manager tool documentation Bug fix Ignore duplicate log recorders keyed by same name. JENKINS-68752 Display job icons correctly on the Jenkins dashboard, even when a non-empty context path alters the URL (regression in 2.346.1). JENKINS-68639 Show all log messages when an inbound agent fails to connect (regression in 2.310). JENKINS-68785 Plugins selected for update cannot be unselected once the update has started. JENKINS-68730 Fix offset of radio buttons when selected. JENKINS-68799 Make previous boot attempt timestamps available to boot-failure.groovy startup hooks (regression in 2.308). JENKINS-68848 2.346.1 June 22, 2022 Changes since 2.346 Security Important security fixes. security advisory Enhancement Remove SSH Plugin from setup wizard plugin selection. JENKINS-68556 Allow running on Java 17 without --enable-future-java . pull 6602 Show remote class loader statistics of agents with new table layout. JENKINS-68591 Update bundled Script Security Plugin from 1.75 to v35f6a_0b_8207e
  Update bundled WMI Windows Agents Plugin from 1.0 to 1.8.1 pull 6582 , 2022-05-17 security advisory Bug fix Fix indistinguishable build scheduling icon when the job is already in-queue (regression in 2.321). JENKINS-68303 Fix the position of the help button when it is not directly attached to an object (regression in 2.320). JENKINS-68042 Restore actions icon size lookup (regression in 2.341). JENKINS-68296 Fix a runtime error when viewing the build time trend on Java 17. JENKINS-68215 Provide supporting infrastructure to enable Pipeline: Groovy to work around a metaspace memory leak for users running Pipeline jobs on Java 11. pull 6597 , JENKINS-63766 , JDK-8231454 metaspace leak Restore the frame color of the build progress bar of the executor widget. pull 6607 Keep the Save and Apply buttons in front of menus (regression in 2.337). JENKINS-68640 Fix WebSocket reconnection in edge cases.
  Upgrade from Remoting 4.13 to 4.13.2. pull 6576 , JENKINS-68542 , Remoting 4.13.2 changelog Fix class attribute for Jenkins Symbols using <l:icon … /> . JENKINS-68630 Notable changes since 2.332.4 Major enhancement Modernise form components and Jenkins UI. JENKINS-67396 , pull 6084 , pull 6442 , JENKINS-68293 , pull 5743 , JENKINS-68284 , pull 6473 , pull 6295 , pull 6273 , pull 6229 , pull 6307 , pull 5778 , pull 6248 , pull 5417 , pull 6186 Major bug fix Update Remoting from 4.11.2 to 4.13 to allow Java Web Start agents to connect (regression in 2.318).
  Allow agent reconnects on Java 11 and WebSocket.
  Prevent infinite loop in case of a closed SSL connection. pull 5983 , pull 6329 , JENKINS-67000 , JENKINS-66446 , JENKINS-67928 , Remoting 4.12 changelog , Remoting 4.13 changelog Enhancement Reject connections from agents with unsupported Remoting versions. JENKINS-50211 Update site warnings can now be configured with Configuration as Code.
  Allow setting a user's primary view via Configuration as Code. pull 6202 , JENKINS-56057 , pull 6203 , JENKINS-61985 Remove support for RoleChecker#check(RoleSensitive) calls which were added again in Jenkins 2.319.
  All remoting Callable implementations need to perform an actual role check as documented. pull 5901 , Remoting callables documentation Remove the Java Native Runtime (JNR) library from Jenkins core. pull 6323 , Java Native Runtime project Remove unused glibc package from Alpine-based Docker images. Docker pull request 1361 Remove unnecessary packages from Debian-based Docker images. Docker pull request 1375 Winstone 5.24 - Add an option to write the listening port to a file.
  Remove automatic self-signed certificate if TLS is specified but no keystore pull 5928 , JENKINS-66379 , Winstone 5.23 changelog , Winstone 5.24 changelog Add slim Debian-based JDK 17 Docker image. Docker pull request 1360 Add Alpine-based JDK 17 Docker image. Docker pull request 1362 Bug fix Render the question mark on the new help button only once so that it is not shown twice, even while using different themes. pull 6233 Wait for the computation to finish when triggering a new build while the build graph is being recomputed.
  This guarantees that recently updated build triggers are executed. JENKINS-67237 2.332.4 June 22, 2022 Security Important security fixes. security advisory Enhancement Remove SSH Plugin from setup wizard plugin selection. JENKINS-68556 2.332.3 May 4, 2022 Major bug fix Avoid a deadlock between agent class loading and logging. JENKINS-68122 Enhancement Replace the computer-flash GIF icon with the hourglass icon. JENKINS-67742 Make "View build information" pages readonly for users who don't have permission. JENKINS-67967 Upgrade bundled Jackson 2 API plugin from 2.12.0 to 2.13.2.20220328-273.v11d70a_b_a_1a_52. JENKINS-68276 , pull 6480 , Jackson 2 API plugin changelogs Bug fix Allow filtering updates in plugin manager by plugin ID (regression in 2.320). JENKINS-68260 Display log entries with missing logger names in the log viewer. pull 6310 Preserve load statistics data for label expressions. JENKINS-68055 Fix bad encoding of security warnings in French showing special characters. pull 6382 2.332.2 April 6, 2022 Enhancement Show warning dialog if Java 8 is selected in Windows installer. JENKINS-68170 , pull 306 (packaging) Bug fix Prefer --httpPort from JENKINS_ARGS over HTTP_PORT when the two differ. JENKINS-68007 , pull 296 (packaging) Remove unnecessary log spam when starting Jenkins under systemd on Debian 11 (regression in 2.333 and 2.332.1). JENKINS-67995 Don't show build status on jobs that are not yet built (regression in 2.321). JENKINS-67797 Ensure inbound agent restart logic is applied. JENKINS-66446 Recover gracefully after incorrect merge of /etc/sysconfig/jenkins on Red Hat-based systems. JENKINS-68149 , pull 301 (packaging) 2.332.1 March 9, 2022 Changes since 2.332 Enhancement Switch Linux installers from System V init to systemd. JENKINS-41218 Update the bundled Matrix Project plugin from 1.18 to 1.20. pull 6180 , JENKINS-67674 , 2022-01-12 security advisory Update bundled Display URL API plugin to prevent issues starting the mailer plugin for offline installations. JENKINS-67885 Bug fix Keep the same height when dragging and dropping a component (regression in 2.277). JENKINS-67496 Correctly render expandable text boxes into multiple lines (regression in 2.197 and 2.176.4). JENKINS-67627 Show correct feature name in tooltips of help links (regression in 2.179). JENKINS-67662 Launch only one agent to satisfy cloud agent requests that use label expressions. JENKINS-67635 Truncate long build names again (regression in 2.332). JENKINS-67689 Overwrite grey balls icon with the modern "not built" status. JENKINS-67753 Render the question mark on the new help button only once so that it is not shown twice, even while using different themes. pull 6233 Update remoting from 4.11 to 4.12 to allow Java web start agents to connect (regression in 2.318). pull 5983 , JENKINS-67000 , Remoting 4.11.2 changelog , Remoting 4.12 changelog Restart systemd service when the controller exits unexpectedly. JENKINS-56219 Restart the Jenkins service after plugin updates on Debian 11 (bullseye). JENKINS-65809 Notable changes since 2.319.3 Major enhancement Always enable the agent-to-controller security subsystem.
  Remove the admin-customizable allowlists for callables and file paths.
  Remove the ability to access some files on the controller from agents.
  Use the Plugin Manager to upgrade incompatible plugins. pull 5885 , JENKINS-67173 , the issue tracker Upgrade the Guava library from 11.0.1 (released on January 9, 2012) to 31.0.1 (released on September 27, 2021).
  Plugins have already been prepared to support the new version of Guava.
  Use the Plugin Manager to upgrade all plugins before and after upgrading Jenkins. pull 5707 , JENKINS-36779 , JEP-233 , Guava web site , Guava 31.0.1 changelog Enhancement Modernise the table design.
  Add support for Ionicons.
  Improve the usability and layout of the 'Plugin Manager' page with better controls and a 'Report an issue' link for each plugin.
  Update the 'New view', 'New node', 'About', 'System Info', and 'Log Recorder' pages. pull 5851 , pull 5925 , pull 5842 , pull 6055 , pull 5916 , pull 5358 , JENKINS-65113 Allow the plugin manager to upload by URL in addition to upload by file name. JENKINS-4814 Improve visualization of the 'Environment Variables' page. pull 6096 Improve artifact list readability in dark theme. pull 5889 Use CSS animation for console progress. pull 5871 Remove support for plugins written in JRuby or Jython.
  JRuby support has been removed from the Stapler web framework used in Jenkins core.
  Plugins written in JRuby and Jython have not been distributed by update center since January 22, 2022. pull 6103 , JEP-7: Deprecation of Ruby and Python plugin runtimes , Deprecating non-Java plugins (blog post) , Stapler repository , JRuby project Remove support for setting the Jenkins home directory via Java Naming and Directory Interface (JNDI). pull 6111 Developer: Provide a stable version of ObjectWebASM (currently 9.1) on the classpath. pull 5524 , ObjectWebASM web site Developer: Use the upstream version of AntClassLoader without custom patches. pull 5856 2.319.3 February 9, 2022 Security Security fix. security advisory Bug fix Fix ClassNotFoundException: io.jenkins.cli.shaded.org.w3c.dom.Node when using JAXB. JENKINS-67470 Launch only one agent to satisfy cloud agent requests that use label expressions. JENKINS-67635 Enhancement Upgrade the XStream library from 1.4.18 to 1.4.19.
  Addresses the CVE-2021-43859 security vulnerability when unmarshalling highly recursive collections or maps causing a Denial of Service. pull 6231 , XStream 1.4.19 changelog , XStream CVE-2021-43859 2.319.2 January 12, 2022 Security Security fix. security advisory Enhancement Only apply trimLabels operation to affected nodes when adding or removing them. JENKINS-67099 Improve FilePath telemetry collection and its description. JENKINS-67332 , JENKINS-67226 , pull 5957 , pull 6031 , pull 6061 2.319.1 December 1, 2021 Changes since 2.319 Bug fix Do not attempt to canonicalize tar entries when untaring, as the result may be unexpected for symlinks. JENKINS-67063 Fix form submission for file access rules of agent to controller security subsystem (regression in 2.111). pull 5881 , JENKINS-67061 , Upgrade guide - Agent to controller path filter security fixes Fix missing hyperlink in build history (regression in 2.314). JENKINS-67028 An exception thrown by a RestartListener no longer leaves Jenkins in a zombie-like state. JENKINS-67002 Prevent LinkageError during class loading (regression in 2.309). JENKINS-66993 Show ongoing first build in build history (regression in 2.314). JENKINS-66969 Jenkins startup could hang due to a deadlock in class loading. JENKINS-67188 Display the "Configure System" icon in the drop down menu. JENKINS-67033 Notable changes since 2.303.3 Major enhancement Replace the term "master" for the main Jenkins application with "controller" or "built-in node" in user interface strings and documentation.
  New installations get the new node and label immediately.
  Existing installations do not change the node name (e.g. NODE_NAME environment variable) or label of the built-in node until an administrator explicitly performs the migration.
  If a job definition, Pipeline definition, or tool installer reference must be tied to the built-in node, it should use the label " built-in ". Upgrade guide - Built-In Node Name and Label Migration Enhancement Modernise the "Manage Jenkins" screen. pull 5693 Modernise the "Build History" search bar. pull 5692 Update appearance for feed bar and description button to be modern and consistent. pull 5664 Improve layout of console output header. pull 5507 Show new status icons in build history. JENKINS-66659 Update tooltips to be consistent across Jenkins. pull 5763 Use SVGs over PNGs for the sidebar when possible.
  Breadcrumb bar/logo/menu items are now correctly aligned on the left together.
  Move old war/images folder to webapp so they can be used in frontend - the SVGs are now in the webapp/images/svgs folder. pull 5663 Replace the old icons with the new SVG icons in the job trend page. JENKINS-65928 Graphs now scale correctly on high resolution screens. pull 5697 Screen resolution cookie now has the secure flag set when Jenkins is running on HTTPS. JENKINS-49675 Deprecate the -cp option in the remoting agent.jar command line.
  Upgrade from Remoting 4.10 to Remoting 4.11. pull 5821 , JENKINS-64831 , Remoting 4.11 changelog When the buildWithParameter API is called, if the requests with the same parameters in the queue are merged, the http response code of the request uses a more appropriate 303(see other) instead of 201(created). JENKINS-66105 Remove deprecated, unsafe classes previously copied from Apache Ant. Docker Slaves plugin is incompatible with this change. JENKINS-66930 Load classes from plugins in parallel for faster startup on multicore machines. JENKINS-23784 Remove the Woodstox implementation of the StAX API from Jenkins core.
  Users of the Azure Artifact Manager, Azure Container Agents, Azure Storage, and Azure SDK API plugins must upgrade those plugins to the latest versions in lockstep with this core upgrade.
  Plugins that consume Woodstox should depend on it directly or via the Jackson 2 API plugin. pull 5651 , Woodstox implementation , StAX API , Azure Artifact Manager plugin , Azure Container Agents plugin , Azure Storage plugin , Azure SDK API plugin , Jackson 2 API plugin Internal: Experimental support for URLClassLoader can be enabled by setting hudson.ClassicPluginStrategy.useAntClassLoader=false . pull 5698 Bug fix Fix wrong parameter type for Text Parameter when triggering a build via the buildWithParameters API call. pull 5704 Use the JVM's default keystore type for the Jenkins server when terminating TLS connections within Jenkins.
  Used if Jenkins is started with the --httpsPort argument.
  Winstone 5.21: Update Jetty from 9.4.42.v20210604 to Jetty 9.4.43.v20210629. pull 5670 , JENKINS-66379 , Winstone 5.20 changelog , Winstone 5.21 changelog , Jetty 9.4.43 changelog Correction of label expression including a "implies" relationship without spaces around. JENKINS-66613 Fix agent handshake when connecting over Websocket on Java 11.
  Upgrade from Remoting 4.10 to Remoting 4.11. pull 5821 , JENKINS-61212 , Remoting 4.11 changelog 2.303.3 November 4, 2021 Security Important security fixes. security advisory Major enhancement Security hardening: Require role check for remoting callables. LTS upgrade guide , developer documentation Enhancement Always allow configuring agent-to-controller security subsystem. Bug fix Correction of Label expression including a "implies" relationship without spaces around. JENKINS-66613 2.303.2 October 6, 2021 Security Security fixes. security advisory Enhancement Security hardening: The "short description" of build causes is now defined as plain text instead of HTML. related LTS upgrade guide entry , related developer documentation Bump bundled Ant from 1.10.10 to 1.10.11. pull 5620 Upgrade from xstream 1.4.17 to 1.4.18. pull 5685 , JENKINS-66507 , XStream 1.4.18 Bug fix Allow Jenkins to start when the JCasC configuration defines view-related permissions (regression in 2.302). JENKINS-66470 Use the JVM's default keystore type for the Jenkins server when terminating TLS connections within Jenkins.
  Used if Jenkins is started with the --httpsPort argument.
  Winstone 5.21: Update Jetty from 9.4.42.v20210604 to Jetty 9.4.43.v20210629. pull 5670 , JENKINS-66379 , Winstone 5.20 changelog , Winstone 5.21 changelog , Jetty 9.4.43 changelog Fix wrong parameter type for Text Parameter when triggering a build via the buildWithParameters API call. pull 5704 2.303.1 August 25, 2021 Changes since 2.303 Bug fix Fix an issue unzipping archives in a corner case when entries have the same path prefix as the target location. JENKINS-66094 Detect files in a symlink that points to a directory (regression in 2.301).
  Bump Commons IO to 2.11.0. pull 5675 , JENKINS-66413 , Apache Commons-IO issue 741 Show tooltips when users hover on the SVG icons. JENKINS-65923 Enhancement Use Java 11 in Docker images instead of Java 8. Blog post Allow Java 11 administrative monitor to be disabled with a system property. JENKINS-66177 Notable changes since 2.289.3 Major bug fix Fix SSH command line interface (CLI) authentication (regression in 2.284). JENKINS-65273 Fix NoSuchMethodError when using plugins that rely on bridge methods for compatibility (regression in 2.278). JENKINS-65605 Major enhancement Remove Apache Commons Digester library and related code from the Jenkins core. pull 5320 , JENKINS-65161 , Announcement and upgrade guidelines Bug fix Jenkins redirects users to the previous page after login even if they were able to view it while not logged in (regression in 2.266). JENKINS-64991 Improve contrast for the checkbox in the login page. pull 5536 Enhancement Recommend running on Java 11. JENKINS-65577 Display Pipeline builds among user build history and remove incorrect warning about view build history. JENKINS-59412 Show implied plugin dependencies or a count of dependencies for plugins split from core. pull 5472 Explain that some plugin updates can be unavailable even on the latest version of a given release line (i.e. LTS). pull 5462 Update French terminology for controller. JENKINS-65398 Change the word 'number' to 'integer' in the error message of the number field. pull 5538 The Jenkins process management functionality now supports FreeBSD. pull 5563 Optimize access control checks affecting (at least) Pipeline node steps. pull 5586 Remove JEP-200 compatibility workarounds for releases published before February 2018 of the following plugins: Maven Integration, Job DSL, Monitoring, Git Client, Pipeline: Supporting APIs, OWASP Dependency-Check. pull 5454 , Plugin versions with a fix , JEP-200 Update Stapler from 1.263 to 1563.v3da2d02f9572 to improve performance when encoding unicode characters in JSON API. pull 5422 , Stapler 1527.ve41b3ce15c05 changelog , Stapler 1532.vfcf95addcb5f changelog , pull 5549 , Stapler 1539.v2f05ce93882d changelog , Stapler 1563.v3da2d02f9572 changelog Stop bundling the External Monitor Job Type, LDAP, and PAM Authentication plugins.
  Jenkins will no longer automatically install the External Monitor Job Type, LDAP, or PAM Authentication plugins on startup if a plugin depending on Jenkins 1.467 or earlier is discovered.
  If you use such a plugin that also relies on the functionality provided by the External Monitor Job Type, LDAP, or PAM Authentication plugin and manage plugins outside Jenkins' plugin manager, you will now need to ensure that a recent release of the External Monitor Job Type, LDAP, or PAM Authentication plugin is installed.
  Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. pull 5445 , External Monitor Job Type plugin , LDAP plugin , PAM Authentication plugin Winstone 5.19: Update Jetty from 9.4.41.v20210516 to Jetty 9.4.42.v20210604. pull 5589 , Winstone 5.19 changelog , Jetty 9.4.42 changelog Bump spring-security-bom from 5.4.6 to 5.5.1. pull 5505 , Spring project spring-security 5.5.0 release notes , pull 5598 , Spring project spring-security 5.5.1 release notes Bump sshd-core from 2.5.1 to 2.7.0 in Jenkins CLI. pull 5547 Add X-Frame-Options header to AJAX responses. pull 5555 Remove the Bytecode Compatibility Transformer library and related code from Jenkins core.
  Developer: Plugins that rely on the hudson.model.Queue$Item#id or hudson.model.AbstractProject#triggers fields must be updated to call the corresponding getters. pull 5526 , Vertx plugin , Slave Prerequisites plugin Stop sending HTTP response headers related to the remoting-based CLI (removed in 2.165). pull 5452 Internal: Upgrade from Remoting 4.7 to Remoting 4.10 with bugfixes and dependency updates. pull 5478 , JENKINS-40700 , Remoting 4.8 changelog , pull 5539 , Remoting 4.9 changelog , pull 5607 , Remoting 4.10 changelog Developer: Remove JTidy dependency from Jenkins core.
  Plugins that use JTidy functionality must be updated to explicitly declare a dependency on JTidy rather than relying on Jenkins core to provide this library. pull 5521 , NIS notification lamp plugin Developer: InterceptingExecutorService and its subclasses no longer extend com.google.common.util.concurrent.ForwardingExecutorService or com.google.common.collect.ForwardingObject . pull 5565 Developer: Remove jna-posix dependency from Jenkins core.
  Plugins that use jna-posix functionality must be migrated from jna-posix to jnr-posix . pull 5560 , Maven Repository Scheduled Cleanup plugin , SICCI for Xcode plugin , java.io.tmpdir cleaner plugin Developer: The hudson.util.SubClassGenerator and experimental hudson.model.TreeView class have been removed without replacement. pull 5566 , pull 5603 2.289.3 July 28, 2021 Bug fix Improve build status progress animation. JENKINS-65574 2.289.2 June 30, 2021 Security Important security fixes. security advisory Enhancement Winstone 5.18: Update Jetty from 9.4.39.v20210325 to 9.4.41.v20210516 for bug fixes and enhancements. JENKINS-65624 , pull 5437 , pull 5540 , Winstone 5.17 changelog , Winstone 5.18 changelog , Jetty 9.4.40 changelog , Jetty 9.4.41 changelog Update from xstream 1.4.16 to 1.4.17. pull 5498 , JENKINS-65657 , XStream 1.4.17 Bug fix Prepare for form submission changes in future Firefox releases.
  Adapt form validation for all web browsers and form validation test automation for HtmlUnit based tests. JENKINS-65585 , pull 5479 , pull 5405 A race condition in class loading could result in a LinkageError . JENKINS-65766 Do not change fonts when build artifacts are as shown as a tree. JENKINS-65751 Jenkins redirects users to the previous page after login even if they were able to view it while not logged in (regression in 2.266). JENKINS-64991 Fix incorrect process termination issues when running on macOS. JENKINS-65195 Add check to prevent out of bounds memory access error on macOS. JENKINS-64347 2.289.1 June 2, 2021 Changes since 2.289 Major bug fix Fix NoSuchMethodError when using plugins that rely on bridge methods for compatibility (regression in 2.278). JENKINS-65605 Bug fix Fix form submission for some specific form validation cases (regression in 2.289). JENKINS-65585 Wrap the build name in the build results list if it is too long. JENKINS-65190 Improve performance for standard input of the Jenkins CLI, for example with the `install-plugin` command. JENKINS-64294 Fix an issue archiving files greater than 4 GiB in size when creating ZIP64 archives. JENKINS-52356 Notable changes since 2.277.4 Major enhancement SSHD module is no longer bundled in Jenkins core.
  Provide SSHD as a plugin. JENKINS-55582 , JENKINS-64107 , pull 5049 , pull 5206 , SSHD module repository Add modern icons: build status and weather. pull 5065 , pull 5392 Developer: Add support for plugins to use external SVG sprites in their icons. pull 5065 , Example external SVG sprite implementation in GitHub Branch Source plugin Enhancement Add administrative monitors recommending no executors are configured on the controller. pull 5337 Add indicator for security-related entries in the global administrative monitors configuration. pull 5078 Improve UI of slow trigger administrative monitor. pull 5424 Support 'min' and 'max' values in field definitions of forms. JENKINS-63855 Improve button focus states. pull 5291 Do not force plugin upgrades of recently detached plugins. pull 5311 Stop bundling the Ant and Javadoc plugins.
  Jenkins will no longer automatically install the Ant and Javadoc plugins on startup if a plugin depending on Jenkins 1.430 or earlier is discovered.
  If you use such a plugin that also relies on the functionality provided by the Ant or Javadoc plugin (e.g., the RAD Builder and manage plugins outside the Jenkins plugin manager, you will now need to ensure that a recent release of the Ant or Javadoc plugin is installed.
  Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. pull 5338 , Ant plugin , Javadoc plugin , RAD Builder plugin Improve performance when creating or deleting nodes by reducing queue-lock contention. pull 5402 , pull 5412 , JENKINS-65308 Improve support for update site-defined setup wizard suggestions. JENKINS-65172 Switch to sending POST requests by default for form validation URLs. pull 4623 Add a Jenkins User-Agent header to outgoing HTTP requests by default.
  Use jenkins.UserAgentURLConnectionDecorator.disabled to disable it if needed. pull 5368 Remove the hardcoded JKS key store so that other key stores can be used, like BCFKS from the FIPS version of Bouncy Castle. pull 5266 Upgrade from Remoting 4.6 to Remoting 4.7 with bugfixes and dependency updates. pull 5292 , Remoting 4.7 changelog Upgrade bouncycastle-api plugin from 2.16.0 to 2.20.
  Upgrade Bouncy Castle library to 1.64. pull 5347 , bouncycastle-api 2.20 changelog , bouncycastle-api 2.18 changelog , bouncycastle-api 2.17 changelog , bouncycastle-api 2.16.3 changelog , bouncycastle-api 2.16.2 changelog , bouncycastle-api 2.16.1 changelog , Bouncy Castle library 1.64 release notes Bump spring-security-bom from 5.4.5 to 5.4.6. pull 5413 , Spring project spring-security 5.4.6 release notes Internal: Update Stapler from 1.262.1 to 1.263 to use latest Apache commons-beanutils.
  Update Apache commons-beanutils from 1.9.3 to 1.9.4. pull 5324 , Stapler 1.263 release notes , Apache commons beanutils 1.9.4 release notes Bug fix Sort available plugins by name when popularity is equal. pull 5359 Honor the current folder when creating new views with the "New View" link. JENKINS-56934 Do not render full error responses in case of internal errors when validating fields in configuration forms. JENKINS-65017 Accept negative numbers in number input controls (regression in 2.274). pull 5341 Improve reconnection behavior for inbound TCP agents. JENKINS-64510 2.277.4 May 5, 2021 Bug fix Fix disabled dropdown items to appear disabled (regression in 2.277.1). JENKINS-65021 Fix load statistics graph links to include correct graph duration (regression in 2.277.1). JENKINS-65336 Honor the current folder when creating new views with the "New View" link. JENKINS-56934 Enhancement Upgrade from xstream 1.4.15 to 1.4.16. pull 5360 , JENKINS-65281 , XStream 1.4.16 2.277.3 April 20, 2021 Security Important security fix. security advisory Enhancement Winstone 5.16: Update Jetty from 9.4.38.v20210224 to 9.4.39.v20210325 for bug fixes and enhancements. pull 5380 , Winstone 5.16 changelog , Jetty 9.4.39.v20210325 changelog 2.277.2 April 7, 2021 Security Security fixes. security advisory Major bug fix Fix help buttons in the draggable section (regression in 2.277.1). JENKINS-64972 Enhancement Security hardening against some CSRF attacks. related upgrade guide entry Bug fix Fix NoClassDefFoundError exception while executing ProcessTree.get() . JENKINS-62006 Prevent Jenkins queue deadlock when cancelling tasks under certain conditions. JENKINS-64931 Reduce logging of renamed API endpoint. JENKINS-65186 2.277.1 March 10, 2021 As described in the Major changes in the weekly release line blog post, this release improves key user interface components. Configuration user interfaces now use html div markup to present a better layout than the previous html table layout. Configuration pages are now easier to read, easier to understand, and work better on a wide range of screens. See the Jenkins issue tracker for a list of plugins known to have issues with the change. As described in the Spring and XStream updates (breaking changes!) blog post, this release updates and replaces outdated internal components. The Acegi security library used for authentication has been replaced by Spring Security ( JEP-227 ). See the Spring Security compatibility table for the latest plugin compatibility status. A fork of the XStream library used to read and write XML files has been replaced by the upstream version of XStream ( JEP-228 ). See the XStream compatibility table for the latest plugin compatibility status. Known Issues If your Jenkins instance was created before Jenkins 2.4 or 2.7.1 LTS, a Setup Wizard may appear on the startup after the upgrade. In such a case, a Jenkins admin may need to skip the plugin installation. See the upgrade guide for the detailed guidelines. Changes since 2.277 Security Important security fix.
  This vulnerability does not exist in any Jenkins LTS release.
  It was discovered in a weekly release and fixed in a weekly release without being part of an LTS release. security advisory , Spring Security 5.4.4 release notes , Spring Security 5.4.3 release notes Major bug fix Show available plugin updates by reloading update center data on upgrade/downgrade. JENKINS-41727 Fix Internet Explorer 11 rendering of the Available plugins tab (regression in 2.270). JENKINS-64805 Include 'plugin-id' and 'plugin-version' data attributes in the Available plugins tab (regression in 2.270). JENKINS-64775 Fix plugin search over multiple update sites (regression in 2.270). JENKINS-64840 Bug fix Restore, as deprecated, the old constructor based on acegisecurity Authentication parameter in order to keep backward compatibility. JENKINS-64746 , pull 5216 , Spring Security 5.4.2 release notes Notable changes since 2.263.4 Major enhancement Change Jenkins configuration UI from tables to divs for layout in forms. JENKINS-56109 , pull 3895 , Table to div layout migration guide Massive performance enhancement to available plugins page of Plugin Manager.
  Exact matches of plugin name are moved to the top. JENKINS-64196 Developer: Use an updated version of the XStream serialization library without custom patches. pull 4944 , pull 5115 , JEP-227 , Spring and XStream updates (breaking changes!) blog post , XStream 1.4.14 changelog , XStream 1.4.15 changelog Developer: Use Spring Security rather than its predecessor, Acegi Security.
  Other bundled Spring libraries are also updated. pull 4948 , pull 5166 , JEP-228 , Spring and XStream updates (breaking changes!) blog post , Spring Security 5.4.2 release notes Developer: Upgrade jQuery from 2.1.4 to 3.5.1. pull 4929 , jQuery older release notes (3.1.1, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1) , jQuery 3.5.0 release notes , jQuery 3.5.1 release notes Bug fix Fix incorrect striping of rows on available page of Plugin Manager. JENKINS-63684 Prevent user input of 'e' or 'E' as 'positive-number', 'non-negative-number', or 'number'. JENKINS-64439 Change the standard URL for obtaining the inbound agent configuration file from ${agent_url}/slave-agent.jnlp to ${agent_url}/jenkins-agent.jnlp .
  The old name is obsolete and will be removed at a future time. JENKINS-35452 Enhancement Improve performance of authorisation strategies when the authentication realm is case insensitive. JENKINS-64039 Add the ability to specify a reason for quieting down Jenkins ("Prepare for shutdown"). JENKINS-1877 Dropped support for deprecated system properties: hudson.model.Hudson.logStartupPerformance , hudson.model.Hudson.initLogLevel , hudson.model.Hudson.parallelLoad , hudson.model.Hudson.killAfterLoad and hudson.model.Hudson.workspaceDirName .
  Please use jenkins.model.Jenkins. -prefixed SystemProperties. pull 4962 Remove administrative monitor offering to migrate $JENKINS_HOME on a ZFS filesystem. pull 5047 Show security and non-security notifications in separate categories with their associated icons. JENKINS-63977 Reduce page load time by loading the administrative monitors popup on demand.
  Allow keyboard navigation even when there are active administrative monitors. pull 5063 Use a more accessible color palette in configuration form tabs. pull 5176 Improve fingerprint save performance. pull 5190 , pull 5198 , JENKINS-64670 Add a system property jenkins.agent.inboundUrl to provide an alternate URL for inbound TCP agents. JENKINS-63222 Drop support for deprecated system properties: hudson.model.Hudson.logStartupPerformance , hudson.model.Hudson.initLogLevel , hudson.model.Hudson.parallelLoad , hudson.model.Hudson.killAfterLoad and hudson.model.Hudson.workspaceDirName .
  Please use jenkins.model.Jenkins. -prefixed SystemProperties. pull 4962 Reduce lock contention around Jenkins queue. JENKINS-58101 Stop bundling CVS plugin.
  Jenkins will no longer automatically install CVS plugin on startup if a plugin depending on Jenkins (then Hudson) 1.340 or earlier is discovered.
  If you use a plugin that relies on the functionality provided by CVS plugin and manage plugins outside the Jenkins plugin manager, you will now need to ensure yourself that a recent release of CVS plugin is installed.
  Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. pull 5102 Winstone 5.15: Update Jetty from 9.4.30.v20200611 to 9.4.38.v20210224 for bug fixes and enhancements. JENKINS-64035 , pull 5034 , pull 5122 , pull 5332 , Winstone 5.12 changelog , Winstone 5.13 changelog , Winstone 5.14 changelog , Winstone 5.15 changelog , Jetty 9.4.31.v20200723 changelog , Jetty 9.4.32.v20200930 changelog , Jetty 9.4.33.v20201020 changelog , Jetty 9.4.34 changelog , Jetty 9.4.35 changelog , Jetty 9.4.36 changelog , Jetty 9.4.37 changelog , Jetty 9.4.38 changelog Upgrade from Remoting 4.5 to Remoting 4.6 with bugfixes and dependency updates. pull 5043 , Remoting 4.6 changelog Update stapler to 1.262 to fix a number of IllegalReflectiveAccessWarnings when running on Java 11. pull 5111 , Stapler 1.262 changelog Update jnr-posix library from 3.0.45 to 3.1.4. pull 5129 , Commits from jnr-posix 3.0.45 to 3.1.4 Update Java native access (jna) library from 5.3.1 to 5.6.0 for more recent platform library fixes and enhancements. pull 5125 , JNA 5.6.0 changelog , JNA 5.5.0 changelog , JNA 5.4.0 changelog 2.263.4 February 10, 2021 Enhancement Improve performance in fingerprint file creation. JENKINS-64670 Bug fix Use the correct freestyle font-size for descriptions. JENKINS-64332 Don't tell user's to signup when signup is not available. JENKINS-64426 2.263.3 January 25, 2021 Security Security fix. 2021-01-26 security advisory Major bug fix Provide a default implementation of the "all files in zip" download link.
  This is especially important for external storage plugin (regression in 2.263.2). JENKINS-64655 Fix the file handle leak inside DirectoryBrowserSupport (regression in 2.263.2). pull 5188 , JENKINS-64632 , SECURITY-1452 Include root folder in downloaded zip files (regression in 2.263.2).
  Resolve an additional related zip archive root folder issue. pull 5187 , JENKINS-64621 , JENKINS-61473 , SECURITY-1452 2.263.2 January 13, 2021 Security Important security fixes. security advisory Major bug fix Help text now expands in behaviours for GitHub organization folders (regression in 2.244). JENKINS-64373 Enhancement Security hardening related to XML processing using Digester2 . related upgrade guide entry Security hardening related to form validation responses. related upgrade guide entry Security hardening restricting label names. related upgrade guide entry Internal: Updated Node version to latest LTS (14.15.1). pull 5087 Bug fix Populate select fields with default values (regression in 2.244). JENKINS-64071 , JENKINS-64125 , pull 5081 Wrong unicode codes in Spanish translation and small improvements. JENKINS-64330 2.263.1 December 3, 2020 Changes since 2.263 Major bug fix Fix hidden page elements from radio blocks showing up when they should not. pull 5046 , JENKINS-64040 , JENKINS-64136 Bug fix Fix file handle leak when viewing corrupted build logs.
  Upgrade Stapler from 1.260 to 1.261. pull 5038 , Stapler 1.261 changelog Prevent the Build History Widget from crashing when users have Discover permissions without Read for folders. JENKINS-63868 Enhancement Winstone 5.12: Update Jetty from 9.4.30.v20200611 to 9.4.33.v20201020.
  Introduce LowResourceMonitor from Jetty by upgrading to Winstone 5.12. JENKINS-64035 , pull 5034 , pull 4975 , Winstone 5.12 changelog , Jetty 9.4.31.v20200723 changelog , Jetty 9.4.32.v20200930 changelog , Jetty 9.4.33.v20201020 changelog Improve performance of authorisation strategies when the authentication realm is case insensitive. JENKINS-64039 Notable changes since 2.249.3 Major bug fix Fix Debian / Ubuntu Java version check for Java 11.0.9.1. JENKINS-64212 , pull 198 (packaging) Major enhancement Graduate Overall/SystemRead permission to general availability (GA) status. pull 4909 , JEP-224 SSHD module 2.7: Remove deprecated key exchange and MAC algorithms. pull 4951 , SSHD module 2.7 changelog Enhancement SSHD module 2.7: Allow configuring disabled key exchange and MAC algorithms through system properties. pull 4951 , SSHD module 2.7 changelog Improve the layout and clarity of the page displayed when jobs are not yet created. JENKINS-63592 Allow users with the Jenkins/MANAGE permission to restart and safe restart Jenkins. JENKINS-63795 Set Cross-Origin-Opener-Policy to same-origin . pull 4910 , Cross-Origin-Opener-Policy at developer.mozilla.org Improve the scripting capacity related to the API Token system.
  Provide a way to configure a fixed/default API Token for admin during installation phase. JENKINS-57484 Developer: Improve the combobox component to support default value and readonly mode. pull 4939 Developer: Allow migration of fingerprints from local storage to external storage. JENKINS-62757 Developer: Expose fingerprint range set serialization methods for plugins. pull 4888 Developer: Pluggable Artifact Storage: Make the VirtualFile API generally available to plugin developers. pull 4974 , JEP-202 Developer: A SimpleBuildStep or SimpleBuildWrapper can now choose not to require a workspace context (working directory and launcher). JENKINS-46175 Developer: Cloud implementations are given more context about ongoing planned nodes.
  Add CloudState to be passed to Cloud#provision and Cloud#canProvision methods. pull 4922 Bug fix Hide description panel in sidebar if historyWidget.descriptionLimit is 0. pull 4978 , Features controlled with System Properties Prevent JavaScript error when registering validators in some cases. JENKINS-42228 Prevent resource leak in the File Fingerprint Storage implementation. pull 4992 2.249.3 November 4, 2020 Major bug fix Fix extensions footer location (regression in 2.235.1). pull 4949 , pull 5001 , JENKINS-63798 Show display names in change list again (regression in 2.249.1). JENKINS-63712 Bug fix Prevent radio buttons from moving when they are clicked. JENKINS-63332 2.249.2 October 7, 2020 Major bug fix Fix migration of status filter when coming from an older version of Jenkins (regression in 2.249.1). JENKINS-62661 Bug fix Make alert colors consistent with 'Manage Jenkins' alert colors. JENKINS-63330 Avoid warning on logs about Anonymous Class in hudson.FilePath . JENKINS-63563 Fix PointerException pollution on logs if PluginDeprecationMonitor is enabled and some conditions are met. JENKINS-63562 Developer: Make unavailable plugin background themeable. JENKINS-63331 2.249.1 September 9, 2020 Changes since 2.249 Security Important security fixes from Jenkins 2.252 and 2.235.4. security advisory Major bug fix Stop pre-formatting agent logs to prevent deadlocks (regression in 2.231). JENKINS-63458 Fix button that copies API token to clipboard (regression in 2.238). JENKINS-63274 Restore wrapping tabs into multiple lines instead of overflowing (regression in 2.248). JENKINS-63180 Bug fix Normalize widget colors to be consistent with the new color palette. Fixes bread crumbs flash in Dark Theme Empty installed plugins table text is readable again (regression in 2.249). JENKINS-63276 Show build time data in the Build Time Trend Page (regression in 2.245). JENKINS-63232 Replace text references to slave with agent in Japanese documentation and messages. JENKINS-63166 Fix backspace key sometimes did not delete text from the Script Console on a Mac (regression in 2.248). JENKINS-63342 Fix regular expression validator UI location (regression in 2.244). JENKINS-63308 Enhancement Prevent concurrent build deletion. JENKINS-61687 Notable changes since 2.235.5 Major enhancement Release 'alpha' dark theme. JENKINS-60924 , pull 4752 , JENKINS-62515 , pull 4763 , pull 4772 , pull 4814 , pull 4842 , pull 4843 , Dark Theme repository , Introducing the Jenkins Dark Theme Stop supporting .NET Framework 2.0 for launching Jenkins server and agents as a Windows service.
  .NET Framework 4.0 or above is now required. announcement , upgrade guidelines , JENKINS-60005 , JENKINS-61862 , Windows support policy Update Windows Service Wrapper (WinSW) from 2.3.0 executable for .NET Framework 2.0 to 2.9.0 for .NET Framework 4.0.
  Includes numerous improvements and bugfixes.
  Most notably, the service installer will now ask for permission elevation if the required. changes summary , full WinSW changelog , Windows Agent Installer 2.0 changelog Enhancement Show in plugin manager when newer releases of plugins exist but aren't being offered due to unsatisfied requirements.
  Show warnings for deprecated plugins in the update manager and administrative monitors. pull 4073 , JENKINS-59136 , pull 4742 , JENKINS-62332 Provide a more modern look and feel for the Jenkins UI. JENKINS-62698 , pull 4808 , JENKINS-61973 , pull 4700 , JENKINS-62750 , pull 4816 , JENKINS-56109 , pull 4820 , JENKINS-63002 , pull 4835 , Configuration UI Accessibility: Tables to Divs migration , pull 4782 , JENKINS-4767 , JENKINS-62175 Remove page generation timestamp from the footer. JENKINS-61806 Allow users with Overall/Manage permission to configure Node Monitoring and to reload configuration from disk. JENKINS-62264 , pull 4724 , JENKINS-61458 , pull 4728 Add system read support for 'Node Monitoring Configuration', configuring clouds, viewing agent configuration, system information, and logs. JENKINS-61206 Support Bearer tokens in Jenkins-CLI -auth parameter. pull 4673 Security hardening: Always round-trip password form control values in an encrypted form, even if not backed by an encrypted Secret field.
  In case of problems, this can be disabled by setting the system property hudson.util.Secret.AUTO_ENCRYPT_PASSWORD_CONTROL to false on startup. JENKINS-61808 Security hardening: Always use a placeholder value for password form control values in item related configuration forms when the user is missing Item/Configure permission, even if not backed by an encrypted Secret field.
  In case of problems, this can be disabled by setting the system property hudson.util.Secret.BLANK_NONSECRET_PASSWORD_FIELDS_WITHOUT_ITEM_CONFIGURE to false . JENKINS-61808 Update Winstone from 5.9 to 5.10.
  Update Jetty from 9.4.27.v20200227 to 9.4.30.v20200611.
  Add --httpsRedirectHttp option that activates automatic HTTP request redirects to HTTPs. pull 4811 , 9.4.28.v20200408 changelog , 9.4.29.v20200521 changelog , 9.4.30.v20200611 changelog Add the ability to filter out environment variables for Shell and Windows batch build steps. JENKINS-62014 Allow fingerprint storage engine to be selected from the configuration page.
  Add new external fingerprint storage API methods. pull 4834 , JENKINS-62345 , pull 4731 , JEP-226 , Fingerprint API Javadoc , Redis reference implementation Developer: Add alert-success banner. JENKINS-62747 Developer: Add new extension points to define build step environment filters (currently in beta). JENKINS-62014 Internal: Upgrade to Remoting 4.5.
  This switches agent.jar and remoting.jar to a code-signing certificate owned by the CDF. pull 4832 , Remoting 4.4 changelog , Remoting 4.5 changelog Bug fix Fix the default domain name in Windows service serviceaccount configurations. JENKINS-12660 , Windows Service Wrapper 2.7.0 changelog Fix --httpKeepAliveTimeout option which had no effect (regression in 2.224). JENKINS-61823 Update Stapler from 1.259 to 1.260. JENKINS-61438 , pull 4813 , Stapler 1.260 changelog Fix IllegalArgumentException: Method not found error caused by misbehaviour in Util.isOverridden() (regression in 2.241). JENKINS-62723 Remove the fallback Jenkins URL from the JNLP launch file so that WebSocket agents can be connected over Java Web Start. JENKINS-63014 2.235.5 August 17, 2020 Security Important security fixes. security advisory Major enhancement Major update of the Alpine-based Jenkins Docker image.
  Jenkins Docker image for Alpine now uses Alpine 3.12 and AdoptOpenJDK 8u262. upgrade guide 2.235.4 August 12, 2020 A new GPG signing key is used for the Jenkins long term support package repositories. Follow the instructions in the Linux repository signing blog post to install the new public key on your computer. Security Important security fixes. security advisory Major enhancement Use new 64 bit Windows installer with service account checks and port validation.
  Supports 64 bit Java 8 and 64 bit Java 11. Announcement , Upgrade guide Bug fix Allow graceful shutdown when SCM triggers are configured. JENKINS-62695 Fix IllegalArgumentException: Method not found error caused by misbehaviour in Util.isOverridden() (regression in 2.241). JENKINS-62723 2.235.3 July 27, 2020 Major enhancement Update Debian and Red Hat repository signing keys for the Jenkins long term support repositories. announcement and upgrade guidelines 2.235.2 July 15, 2020 Security Important security fixes. security advisory Bug fix Fix --httpKeepAliveTimeout option which had no effect (regression in 2.235.1). JENKINS-61823 , pull 4812 , Winstone 5.9.1 changelog Fix buttons that linger too long after closing modal (regression in 2.233 and 2.235.1). JENKINS-62560 2.235.1 June 17, 2020 Changes since 2.235 Major bug fix Make plugin manager work on Internet Explorer 11 again (regression in 2.231). JENKINS-62163 Prevent telemetry warnings about missing javax.annotation classes when running with Java 11 (regression in 2.231). JENKINS-61920 Fix a deadlock involving custom loggers during agent startup (regression in 2.231). JENKINS-62181 Bug fix Prevent Old Data Monitor from failing plugin loading in the case of class field unmarshalling issues. JENKINS-62231 Notable changes since 2.222.4 Major enhancement Various improvements to the plugin manager, including:
  It no longer shows all available plugins by default; use search field to find plugins.
  They are now sorted by popularity by default.
  Additionally, categories are no longer used to group plugins, instead they're shown as labels. JENKINS-61166 , pull 4580 , pull 4513 , pull 4588 , pull 4534 , pull 4591 , pull 4535 , pull 4589 , pull 4584 Organize entries on the Manage Jenkins page into categories and show them in a grid. pull 4546 Remove 'auto refresh' feature, including now obsolete auto refresh telemetry capability. pull 4503 Users with extended read permission now get a more read-only looking UI. JENKINS-61202 , pull 4479 , Read-only Jenkins Configuration blog post Allow users with Overall/SystemRead permission to view About Jenkins , Manage Plugins , Global Security Configuration , and System Log . JENKINS-61205 , JENKINS-61201 , JENKINS-61203 , JENKINS-61207 , JENKINS-61455 , JENKINS-61208 , JENKINS-61208 Allow users with Overall/Manage permission to access the System Information , Prepare for Shutdown , and About Jenkins management links. Usage Statistics in Global Configuration is now also configurable by users with that permission. JENKINS-61456 , JENKINS-61453 , JENKINS-61457 , JENKINS-61455 Bug fix Distinguish between defined ( ***** ) and  ( N/A ) password on read-only configuration forms for users with Overall/SystemRead or Item/ExtendedRead permissions. JENKINS-61812 Enhancement Use modern system fonts provided by the browser when possible.
  Changes font size for body copy and headings to improve consistency and legibility. JENKINS-60921 Restyle buttons.
  Add support for large buttons, hyperlinks styled as buttons and icon-only buttons. JENKINS-61840 Restyle the help icon. pull 4663 Improve styling of alert banners to be more visually appealing and to better match existing user interface components.
  Alerts now fully cover the navigation bar while they are displayed instead of covering only a portion of the navigation bar. JENKINS-61478 Suppress error stack traces for non-administrator users as core capability. JENKINS-60410 2.222.4 May 24, 2020 Major bug fix Prevent a form validation "404 Not Found" error when the resource root URL configuration points at a previously configured resource root URL (regression in 2.222.1). JENKINS-62133 Bug fix Upgrade to Remoting 4.2.1 to fix an issue with large payloads over WebSockets.
  Requires a matching agent.jar with remoting 4.2.1 or later. JENKINS-61409 , pull 4601 , pull 4596 , Remoting 4.2.1 changelog , WebSockets blog post , JEP-222 Update Groovy Init hooks to run after all job configurations are adapted. JENKINS-61694 Fix spacing between error messages in Setup Wizard (regression in 2.222.1). JENKINS-61660 Fix input field hints for tools like the git plugin that search the PATH for their executable (regression in 2.222.1). JENKINS-61711 Remove grey bar below the textarea form elements for read only users. JENKINS-61284 Distinguish between defined ( ***** ) and  ( N/A ) password on read-only configuration forms for users with Overall/SystemRead or Item/ExtendedRead permissions. JENKINS-61812 Enhancement Users with extended read permission now get a more read-only looking UI. JENKINS-61202 , pull 4479 , JENKINS-61321 , pull 4541 2.222.3 April 24, 2020 Major bug fix Use the saved global build discarder configuration on restart. JENKINS-61688 Fix proxy form validation when a password is set (regression in 2.222.1). JENKINS-61692 Bug fix Prevent PointerException when hitting Check Now against a custom update center without tool installer metadata. JENKINS-60788 Prevent one occurrence of "Jenkins.instance is missing" during Jenkins restart. pull 4525 , JENKINS-60454 , JENKINS-55070 , JENKINS-59992 , JENKINS-61192 Enhancement Developer: Make h.checkAnyPermission and <l:layout permissions="..."> work on objects that aren't AccessControlled . JENKINS-61465 Developer: Prevent spurious deprecation messages by removing the deprecated findbugs-annotation. JENKINS-61279 2.222.2 April 22, 2020 Jenkins 2.222.2 was not packaged or delivered. All changes planned for 2.222.2 are included in 2.222.3. Bug fix Jenkins 2.222.2 was not placed in the artifact repository or on the download site. 2.222.1 March 25, 2020 Global build discarder configuration is not loaded from disk when Jenkins starts ( JENKINS-61688 ). Configuration is saved but not loaded on restart. Jenkins 2.222.1 will always start with the default configuration of the Job Build Discarder. Custom global build discarder configuration is ignored on restart. The default global build discarder is configured each time that Jenkins restarts. Changes since 2.222 Security Important security fixes. security advisory Major bug fix Fix drag & drop for previously saved steps in the job configuration form (regression in 2.217). JENKINS-61429 Winstone 5.9: Fix propagation of the maximum form content size and form content keys number (regression in Jetty 9.4.20 and Jenkins 2.205). pull 4542 , JENKINS-60409 , Winstone 5.9 changelog , Jetty 9.4.27 changelog Winstone 5.9: Fix improper reverse proxy redirects to host due to X-Forwarded-Host and X-Forwarded-Port ordering issue (regression in Jetty 9.4.20 and Jenkins 2.205). pull 4542 , JENKINS-60199 , Winstone 5.9 changelog , Jetty 9.4.27 changelog Enhancement Security hardening related to request routing and CSRF protection. related upgrade guide Developer: Listen on loopback interface by default in debug mode. pull 4515 Notable changes since 2.204.6 Major enhancement Revamp the layout and icons of the header bar and breadcrumbs.
  Instances with plugins that depend on details of the Jenkins layout (e.g. Simple Theme Plugin) may experience UI/layout problems.
  A new experimental header color scheme can be enabled by setting the jenkins.ui.refresh system property to true . JENKINS-60920 Add globally configured build discarders that delete old builds not marked as "keep forever" even if there is no, or a less aggressive, per-project build discarder configured, executed periodically and after a build finishes. pull 4368 Move cloud configuration from Configure System into its own configuration form on the Manage Nodes page. pull 4339 Remove Enable Security checkbox in the Global Security configuration. JENKINS-40228 Remove the ability to disable CSRF protection .
  Instances upgrading from older versions of Jenkins will have CSRF protection enabled and the default issuer set if they currently have it disabled. pull 4509 Redesign password fields to prevent password auto-fill except for the login form.
  Reduce browsers offering to update stored passwords.
  Revert by setting the system property hudson.Functions.hidingPasswordFields to false . pull 3991 Deprecate the macOS native installer packaging. Jenkins macOS native installer deprecation Remove old, deprecated, unsupported agent protocols Inbound TCP Agent Protocol/1 , Inbound TCP Agent Protocol/2 , and Inbound TCP Agent Protocol/3 .
  Update Remoting from 3.36 to 4.2 to remove unsupported protocols and add WebSocket support. JENKINS-60381 , Remoting 3.40 release notes , Remoting 4.0 release notes , Remoting 4.0.1 release notes , Remoting 4.2 release notes Add experimental WebSocket support. JEP-222 , blog post Extends the current milestones so plugins can update jobs and configuration during Jenkins initialization.
  Adds initialization milestones: SYSTEM_CONFIG_LOADED , SYSTEM_CONFIG_ADAPTED , JOB_CONFIG_ADAPTED . JENKINS-51856 Introduce a new experimental UI that can be enabled by setting the jenkins.ui.refresh system property to true .
  Currently it includes a new header color scheme, more changes to be added as a part of the UI/UX revamp. pull 4463 , JENKINS-60920 , JEP-223 , Jenkins UX SIG Add a new experimental Overall/Manage permission which allows a user to configure parts of the global Jenkins configuration without having the Overall/Administer permission.
  This is an experimental feature, disabled by default, that can be enabled by setting the jenkins.security.ManagePermission system property to true . pull 4501 , JENKINS-60266 , JEP-223 Add a new experimental Overall/SystemRead permission, which gives (almost) full read access to the Jenkins instance.
  The permission is disabled by default, install the Extended Read Permission plugin to activate it. pull 4506 , JENKINS-12548 , JEP-224 , Extended Read Permission plugin Enhancement The environment variable WORKSPACE_TMP may now be used from (non-Pipeline) builds to access a temporary directory associated with the build workspace. JENKINS-60634 Deprecate the Overall/RunScripts , Overall/UploadPlugins , and Overall/ConfigureUpdateCenter permissions.
  Permissions were announced as dangerous and disabled by default in major authorization plugins in 2017.
  Custom authorization strategy implementations that grant Overall/Administer without implying one or more of these three permissions will no longer work as expected.
  Configurations that grant any of these permissions to users without Overall/Administer will no longer work as expected. pull 4365 , JENKINS-60266 , JEP-223 , 2017-04-10 security advisory for Matrix Authorization plugin , 2017-04-10 security advisory for Role-Based Authorization plugin Major bug fix Fix PointerException when getting a list of runs with a status threshold (regression in 2.202). JENKINS-60884 User is no longer logged out when authenticating another user. JENKINS-59107 Bug fix Winstone 5.9: Fix support of system logging customization (regression in 2.204.5) pull 4452 , JENKINS-57888 , Winstone 5.9 changelog , Jetty 9.4.27 changelog 2.204.6 March 25, 2020 Security Important security fixes. security advisory Enhancement Security hardening related to request routing and CSRF protection. related upgrade guide 2.204.5 March 7, 2020 System logging customization defect ( JENKINS-57888 - system logging customization ) from Jenkins 2.177...2.203.3 is reintroduced in this version as it is considered as less serious than the fixed regressions. There is a plan to fix it again in 2.222.1. Major bug fix Fix propagation of the maximum form content size and form content keys number (regression in Jetty 9.4.20 and Jenkins 2.204.3). JENKINS-60409 Fix improper reverse proxy redirects to 127.0.0.1 due to X-Forwarded-Host and X-Forwarded-Port ordering issue (regression in Jetty 9.4.20 and Jenkins 2.204.3). JENKINS-60199 Bug fix Revert Winstone from 5.8 to 5.3 to resolve embedded Jetty web container regressions in later Winstone versions.
  High default maximum form size limit and reverse proxy redirection are restored (regressions in 2.204.3). JENKINS-60409 , JENKINS-60199 , Winstone changelog 2.204.4 March 3, 2020 Major bug fix Fix a KeyStores with multiple certificates are not supported error from Jetty when passing certain kinds of certificates, such as domain wildcards (regression in 2.204.3). pull 4539 , JENKINS-60857 , Winstone 5.8 release notes 2.204.3 February 28, 2020 Enhancement Internal: Winstone 5.7: Change the Jetty thread pool name to "Jetty (winstone)" pull 4452 , JENKINS-60821 , Winstone 5.7 release notes Bug fix If the Jenkins root URL has been configured by scripts prior to running the setup wizard, skip the location configuration panel even if selecting the option to skip creation of an admin user. JENKINS-60750 Prevent inaccurate warnings about missing classes on Java 11 triggered by JavaMelody when Monitoring Plugin is installed. JENKINS-60725 Include details in the system log when a build rotation fails. JENKINS-60716 Fix java version check for AdoptOpenJDK 11. JENKINS-60678 Prevent Jenkins page rendering from being blocked when the update center data parsing is in progress. JENKINS-60625 Winstone 5.7: Fix support of system logging customization (regression in 2.177). pull 4452 , JENKINS-57888 , Winstone 5.7 release notes Fix  pointer exception in Agent API when the agent is offline (e.g. retrieving agent version or OS description). JENKINS-42658 2.204.2 January 29, 2020 Security Important security fixes. security advisory Major bug fix User is no longer logged out when authenticating another user. JENKINS-59107 Enhancement Security hardening related to Stapler routing. Security hardening: Set X-Content-Type-Options to nosniff in REST API responses. Bug fix Disable multiple deletion attempts if hudson.Util.maxFileDeletionRetries is zero. JENKINS-60351 Prevent 'zombie' executors on built-in node by removing one-off executors in Computer.removeExecutor. JENKINS-57304 Fix AtomicFileWriter performance issue on CephFS when creating an empty file. JENKINS-60167 Developer: ViewGroupMixIn#getPrimaryView() may return  , and needs to be checked by plugins depending on this version of weekly and beyond.
  It is an intermediate state until a default view is implemented. JENKINS-60092 2.204.1 December 18, 2019 Configuration as code plugin users upgrading to Jenkins 2.204.1 should review the LTS upgrade guide global configuration save topic and the LTS upgrade guide download settings topic Changes since 2.204 Enhancement Show a tooltip with the full link name when hovering over sidebar links. JENKINS-59508 Bug fix Prevent faulty subtask contributors from leaving builds running forever. JENKINS-59793 Fix Uninstall column sorting in the Plugin Manager Install pane. JENKINS-59665 Notable changes since 2.190.3 Major enhancement Prevent calls to Jenkins#save persisting data before we have finished loading the in-memory model.
  This prevents possible corruption of the main Jenkins configuration. JENKINS-58993 Remove the ability to download update center metadata using the user's browser (deprecated since 2015).
  Jenkins will no longer inform about available updates without a connection to update sites.
  We recommend the use of a local mirror of our update sites, or a self-hosted update center like Juseppe in these situations. pull 3970 Allow time zone to be set on a per-user basis. JENKINS-19887 Add an option for a Resource Root URL through which Jenkins will serve user-generated static resources like workspace files or archived artifacts without the need for Content-Security-Policy headers. JENKINS-41891 Enhancement Stop bundling Maven Plugin, Subversion Plugin, and several other plugins inside the Jenkins war file.
  In very rare cases, this could result in problems when attempting to install plugins compatible with Jenkins before 1.310.
  The Jenkins project is currently not publishing any such plugins. pull 4040 Deprecate the macOS native installer in favor of Homebrew. macOS Native Installer Deprecation blog post Remove 100 character length limitation of build description in build history widget. JENKINS-19760 , JENKINS-31209 Update Remoting from 3.33 to 3.36.
  Adds a new connection mode for inbound TCP agents.
  Update minimum required remoting version to 3.14.
  Adds command line options "-help" and "-version". Remoting 3.36 release notes , pull 4193 , Remoting 3.35 release notes , pull 4208 , pull 4186 , JENKINS-53461 , pull 4165 , Remoting 3.34 release notes , Remoting connection steps reduced Bug fix Revert changes in forms submission in Jenkins classic UI with Firefox have caused a regression on forms with "file" inputs.
  These were made to anticipate a bugfix in Firefox which has been backed out since.
  (regression in 2.173) JENKINS-58296 , JENKINS-53462 , Firefox issue 1370630 2.190.3 November 20, 2019 Bug fix Robustness: Do not allow users to resubmit requests using POST on URLs requiring a form submission, as that will fail anyway. JENKINS-59514 The lastCompletedBuild permalink was not being cached in the …/builds/permalinks file. JENKINS-56809 Fix labels to Atom feed links. JENKINS-48375 Revert changes in forms submission in Jenkins classic UI with Firefox.
  Changes caused a regression on forms with "file" inputs.
  These were made to anticipate a bugfix in Firefox which has been backed out since.
  (regression in 2.164.3) JENKINS-58296 , JENKINS-53462 , Firefox issue 1370630 2.190.2 October 28, 2019 Bug fix URLs of some projects with emojis in their name were inaccessible. JENKINS-59406 Increase client-side keep-alive ping frequency on the HTTP-based CLI to prevent timeouts. JENKINS-59267 Internal: hudson.util.ProcessTree.OSProcess#getEnvironmentVariables returned  when an error occurred even though it shouldn't. JENKINS-59580 2.190.1 September 25, 2019 Changes since 2.190 Security Important security fixes. 2019-09-25 security advisory , 2019-08-28 security advisory Bug fix Fix missing absolute URL in the RSS / Atom feeds. (regression in 2.190) JENKINS-59167 Major bug fix Jenkins UI broke when a slow trigger administrative warning would be shown. (regression in 2.189) JENKINS-58938 Notable changes since 2.176.4 Major enhancement Jenkins no longer creates symbolic links inside project or build directories.
  The Build Symlink plugin may be installed to restore this functionality if desired.
  URLs such as /job/…/lastStableBuild/ are not affected, only tools which directly access the $JENKINS_HOME filesystem. JENKINS-37862 Remove Trilead SSH library from Jenkins core and make it available in a new detached plugin . JENKINS-43610 Bug fix Add support of emojis and other non-UTF-8 characters in job names. 🎉 JENKINS-23349 Enhancement Update Windows Agent Installer from 1.10.0 to 1.11, enabling TLS 1.2 on agent downloads when running with .NET 4.6 or newer. JENKINS-51577 , full changelog Update Winstone-Jetty from 5.2 to 5.3 to update Jetty to 9.4.18. pull 4016 , full changelog , Jetty 9.4.18 changelog , Jetty 9.4.17 changelog , Jetty 9.4.16 changelog Update JNA from 4.5.2 to 5.3.1 to fix issue with shared library loading on AIX when using OpenJDK. JENKINS-57515 Update Remoting to 3.33. JENKINS-57959 , JENKINS-50095 , JENKINS-57713 , full changelog Support setting excludes and case sensitivity in the fingerprint() build step in Pipeline and other job types. documentation , pull 3915 Improve Configuration-as-Code compatibility of ListView . JENKINS-57121 Stop using the name argument in the install-plugin CLI command. pull 4123 Remove obsolete session cookies when logging out, preventing errors related to headers being too large. JENKINS-25046 Add support for IPv6 addresses in the Jenkins URL configuration. JENKINS-58041 Allow distinguishing between new projects, disabled projects, and those with aborted builds through differently shaded build balls. pull 3997 Add a warning when cron trigger spends a long time in its execution. JENKINS-54854 Batch up plugin installations in setup wizard to improve performance. pull 4124 The default interval for node monitors (e.g. free disk space) can now be changed by setting the system property hudson.node_monitors.AbstractNodeMonitorDescriptor.periodMinutes . pull 4105 , Jenkins features controlled by system properties 2.176.4 September 25, 2019 2.176.4 and 2.190.1 contain the same security fixes. We're providing an additional release of the 2.176.x LTS line to allow administrators to apply security updates without having to perform a major upgrade. Security Security fixes. security advisory 2.176.3 August 28, 2019 Security Important security fixes. security advisory Bug fix The plugin manager UI no longer prevents disabling a plugin when other plugins only have optional dependencies to it. JENKINS-33843 Fix performance issue when using "Remember me". (regression in 2.160) JENKINS-56243 Do not throw exception when testing proxy configuration. (regression in 2.168) JENKINS-57383 Prevent occasional IllegalStateException on Jenkins restart and invalidate the user session. JENKINS-55945 2.176.2 July 17, 2019 Security Important security fixes. security advisory Bug fix A thread pool used to wait for external processes to complete could leak class loaders. JENKINS-57725 Make sure detached plugins (plugins whose functionality used to be part of Jenkins itself) are installed upon Jenkins startup when needed as implied dependencies of other plugins which were already present.
  This simplifies compatibility for specialized installation scenarios not using the update center, such as when Jenkins is run from a Docker image prepackaged with some plugins. JENKINS-57528 Update WinP from 1.27 to 1.28 to fix problems with a missing DLL and flickering console window in the Windows graceful process shutdown logic. JENKINS-57477 , full changelog Enhancement Replace some exception stack traces related to agent channels with simpler messages. JENKINS-57993 2.176.1 June 10, 2019 Changes since 2.176 Bug fix Restore Chinese localized resources used by the setup wizard. JENKINS-57412 Robustness: Do not put agent offline for runtime exceptions in ComputerListener#onOnline() . JENKINS-57111 Notable changes since 2.164.3 Major enhancement Support for the Remoting mode of the CLI ( -remoting option) has been removed. pull 3838 , announcement blog post Remove misleading nonStoredPasswordParam symbol for password parameter definitions, since it's actually stored encrypted. JENKINS-56776 Remove built-in support for CCtray (cc.xml) files.
  To restore this feature, install the CCtray XML Plugin . JENKINS-40750 Enhancement Add stop-job CLI command which allows aborting builds. JENKINS-11888 Add support for turning off a log recorder in the logger configuration. JENKINS-56200 Add the run parameter filter value to REST API responses. JENKINS-56554 Update status icon of a build when the build is finished. JENKINS-16750 Remove misleading references to Java Web Start and JNLP from GUI surrounding inbound Jenkins agents. pull 3998 Inform administrators about potentially unsafe permissions setup involving builds running as the virtual SYSTEM user. JENKINS-24513 Add a log message to build logs when builds run with the virtual SYSTEM authentication. pull 3908 Migrate all Chinese localization resources into Localization: Chinese (Simplified) plugin . pull 4008 Adjust stream flushing behavior for code running remotely on agents for better performance.
  This may lead to loss of messages for plugins which print to a build log from the agent machine but do not flush their output.
  Use -Dhudson.util.StreamTaskListener.AUTO_FLUSH=true to restore the previous behavior for freestyle builds.
  Note that Pipeline builds always expect remote flush. pull 3961 Update Winstone from 5.1 to 5.2 to make HTTPS cipher exclusions configurable. JENKINS-56659 , JENKINS-56591 , full changelog Developer: Update Stapler from 1.256 to 1.257 to add support for loading localized webapp resources from any plugin.
  Add jenkins.PluginLocaleDrivenResourceProvider interface for plugins to participate in localized resource lookup. JEP-216 , full changelog Developer: Update Localizer library from 1.24 to 1.26 allowing plugins to override the lookup for localized resource files. pull 3896 , JEP-216 , full changelog Developer: Add Jelly UI component f:secretTextarea for multi-line secrets analogous to f:password for single-line. pull 3967 , Storing Secrets in Jenkins Developer: SystemProperties may now be used from agent-side code.
  See SystemProperties#allowOnAgent . pull 3961 Bug fix Remove Mailer related localized strings from core. Make sure you use Mailer Plugin 1.23. JENKINS-55292 Do not offer a workspace lease to a new build if it is already in use by a (Pipeline) build running across an agent reconnection. JENKINS-50504 2.164.3 May 9, 2019 Bug fix Corrupted console notes could cause an uninformative NegativeArraySizeException to be thrown from ConsoleNote#readFrom and build log display to be broken. JENKINS-45661 The setup wizard did not properly escape passwords, resulting in errors with certain special characters. JENKINS-56856 Make form submit buttons on the Jenkins classic UI compatible with potentially upcoming Firefox bug fix. JENKINS-53462 , Firefox bug 1370630 Properly flush output from the Maven console annotator. JENKINS-56995 Make Debian/Ubuntu launcher script work with Java 11. JENKINS-57096 Enhancement Re-enable Stapler request dispatching telemetry. JENKINS-57167 2.164.2 April 10, 2019 Security Security fixes. security advisory Bug fix Workspace and artifacts browsing did not work on Windows Server 2016 with Microsoft Docker. (regression in 2.150.2) JENKINS-56114 Prevent PointerException when discarding unreadable fingerprint data. JENKINS-43218 2.164.1 March 13, 2019 Changes since 2.164 No notable changes in this release. Notable changes since 2.150.3 Major enhancement Java 11 is now fully supported. Multiple improvements for running Jenkins on Java 11 since 2.150.x, including support for plugins declaring a minimum Java version in their metadata and refusing to load incompatible plugins, and installation of a new JAXB plugin when running on Java 11 to allow use of JAXB APIs from plugins. announcement blog post , running on Java 11 , upgrading to Java 11 , JENKINS-52012 , JENKINS-52282 , JENKINS-55076 , JENKINS-55048 , JENKINS-55980 , JENKINS-55681 , JENKINS-52285 Enhancement The list-jobs no longer lists items recursively when listing a specific folder. JENKINS-48220 Add a new CLI command disable-plugin to disable one ore more installed plugins and optionally restart Jenkins. JENKINS-27177 Update Trilead SSH library to add support for OpenSSH keys with AES256-CTR encryption. JENKINS-47603 , JENKINS-47458 , JENKINS-55133 , JENKINS-53653 Add support for the ed25519 key algorithm in Jenkins CLI. JENKINS-45318 Reduce the performance impact of the SECURITY-904 fix when downloading artifacts or workspaces as ZIP file. JENKINS-55050 Add new category Languages to the plugin wizard, which automatically installs available localization plugins based on browser language. pull 3626 Update Windows Service Wrapper from 2.1.2 to 2.2.0 and Windows Agent Installer from 1.9.3 to 1.10.0 to support disabling, renaming and archiving service logs. pull 3854 , Windows Service Wrapper changelog , Windows Agent Installer Module changelog Developer: Login and signup pages redesigned in 2.129 now can receive style contributions ( footer view for SimplePageDecorator ) from multiple plugins. JENKINS-54325 Bug fix Update SSHD Module from 2.5 to 2.6 to apply a proper Apache Mina idle timeout value when a custom value was set using the org.jenkinsci.main.modules.sshd.SSHD.idle-timeout system property . JENKINS-55978 , full changelog 2.150.3 February 13, 2019 Bug fix Improve robustness of console annotators such as the Timestamper plugin in conjunction with certain Pipeline steps such as git on an agent with an old agent.jar . JENKINS-55257 User account creation by administrators did not show error messages when it failed. (regression in 2.129 and 2.138.1) JENKINS-52869 2.150.2 January 16, 2019 Security Important security fixes. security advisory Enhancement Invalidate sessions and CLI authentication caches when changing the user password in the Jenkins user database. Add support for killing child processes on AIX. JENKINS-16867 2.150.1 December 5, 2018 Changes since 2.150 Security Important security fixes. security advisory Bug fix Revert compatibility fix for future releases of Firefox due to regressions it caused since 2.148. JENKINS-54261 , JENKINS-54333 , JENKINS-54570 Prevent Stream is closed error in case a CLI command finishes before the input is entirely read. JENKINS-54310 Avoid Premature EOF error when using the shutdown CLI command. JENKINS-49196 Do not cache CSS/JS resource files for console annotations like Timestamper Plugin across Jenkins restarts. JENKINS-38719 Notable changes since 2.138.4 Major enhancement Numerous fixes and improvements to better support running Jenkins on Java 11. JENKINS-46523 , JENKINS-46725 , JENKINS-51805 , JENKINS-52019 , JENKINS-52024 , JENKINS-53693 , JENKINS-53710 , JENKINS-53929 , Parent POM 1.49 changelog , Winstone-Jetty 5.1 changelog , Groovy 2.4.12 changelog , Jetty 9.4.12 changelog Migrate most Simplified Chinese translations into Localization: Chinese (Simplified) Plugin. pull 3667 Enhancement Allow use of the console command with Job/Read permission. JENKINS-52181 Wait up to two minutes for process termination before killing it (typically when aborting a build). JENKINS-17116 Reduce logging level of restart and shutdown related notifications from SEVERE to INFO. JENKINS-53282 New JENKINS_USER_ID and JENKINS_API_TOKEN environment variables can be used to configure the CLI authentication. JENKINS-53792 Do not submit telemetry if there's no relevant data. JENKINS-54137 Use per-trial correlation IDs for telemetry submissions. JENKINS-54136 Developer: Add support for the @PostConstruct lifecycle method annotation. JENKINS-52818 Developer: Add interface PersistentDescriptor that allows implementing Descriptor s to skip explicit calls to load() . JENKINS-52818 Developer: Introduce getPlatform() and setPlatform() methods in hudson.EnvVars . JENKINS-53721 Developer: Introduce new hudson.Util#fix(value, defaultValue) method. pull 3656 Developer: Add overridable Queue.Task#getAffinityKey() to allow consistent hashing for Pipeline builds in the future. JENKINS-36547 Bug fix Update Remoting from 3.26 to 3.27 to eliminate a potential deadlock. full changelog , JENKINS-53569 Developer: ConsoleAnnotatorFactory mishandled its type parameter, effectively forcing all implementations to use Object or raw types. pull 3662 2.138.4 December 5, 2018 Security Important security fixes. security advisory 2.138.3 November 8, 2018 Bug fix The initial visibility of nested groups of radio buttons did not accurately reflect the current values. JENKINS-48516 Improve robustness when search items don't specify a display name. JENKINS-50795 Enhancement Update Stapler from 1.254.2 to 1.255 to integrate a fix related to StaplerProxy#getTarget() return value handling. pull 3690 , stapler/stapler#149 Add telemetry trial related to Stapler request dispatching. JENKINS-54029 2.138.2 October 10, 2018 Security Important security fixes. security advisory Major enhancement Security hardening: Escape variables in Jelly views by default. announcement blog post , LTS upgrade guide , list of affected plugins Major bug fix Update Winstone-Jetty from 4.4 to 5.0 to fix HTTP/2 support and threading problems on hosts with 30+ cores. JENKINS-53239 , JENKINS-52804 , JENKINS-51136 , JENKINS-52358 Enhancement Security hardening related to Stapler routing. SECURITY-595 in the 2018-12-05 security advisory Security hardening related to HTTP verb restrictions for web methods. Extend anonymous usage statistics with information about applied security fix escape hatches. JEP-214 Bug fix Fix a thread safety issue when creating multiple nodes in parallel. JENKINS-53401 Nested f:repeatable / f:repeatableProperty form elements inherited minimum when they shouldn't. JENKINS-37599 2.138.1 September 12, 2018 Changes since 2.138 Bug fix A configured quiet period was interpreted as milliseconds, instead of seconds. (regression in 2.82) JENKINS-48770 Notable changes since 2.121.3 Major enhancement Redesigned login, signup, and Jenkins is (re)starting pages. Existing page decorators like Simple Theme Plugin will no longer work with these redesigned pages. JENKINS-50447 , announcement blog post Replace single per-user API token with new system of multiple, revocable, unrecoverable API tokens with usage tracking. JENKINS-32442 , JENKINS-32776 , blog post The deprecated Jenkins CLI Protocol versions 1 and 2, and Java Web Start Agent Protocol versions 1, 2, and 3 have been