Jenkins Release Notes

Changes since 2.580:

Bug:
Include Apache Commons Lang 2.6 for compatibility.

RFE:
Include Apache Ant 1.10.18 to silence software content analysis scanners.

RFE:
Update slf4j logging to v2.0.19 for Winstone and Stapler.

RFE:
Update Winstone to version 8.1050.x with Eclipse Jetty 12.1.13.

RFE:
Update Stapler to version 2119.x with Eclipse Jetty 12.1.13.

Notable changes since 2.568.3:

Major RFE:
Refresh the status icons to show the status of the current job, without including status of previous job.

RFE:
Stop bundling the bouncycastle API, Command Agent Launcher, Oracle Java SE Development Kit Installer, JAXB, Trilead API, SSH server, JavaBeans Activation Framework (JAF) API, JavaMail API, and Instance Identity plugins, reducing the size of jenkins.war by more than 20 MB.
Jenkins no longer installs these plugins automatically when upgrading from Jenkins 2.356 or earlier, or when a plugin built against such an old version is discovered.
If you are affected, install these plugins through the plugin manager.

RFE:
Stop bundling the JUnit, Mailer, Matrix Authorization Strategy, Matrix Project, and OWASP Markup Formatter plugins, reducing the size of jenkins.war by more than 20 MB.
Jenkins no longer installs these plugins automatically when upgrading from Jenkins 1.577 or earlier, or when a plugin built against such an old version is discovered.
If you are affected, install these plugins through the plugin manager.

RFE:
Reduce size of Jenkins war by removing unused CLI dependency.

RFE:
Reduce size of Jenkins war by removing comments from translation files.

RFE:
Standardise Jenkins branding during Sign in, Registration, and About Jenkins

RFE:
Refine Notifications component.

RFE:
Refine the 'System Log' Manage Jenkins page

RFE:
Standardise command palette, dialog, dropdown, and tooltip materials

RFE:
Accept ECDSA and Ed25519 private keys for access to the Jenkins command line interface.

RFE:
Add password complexity rules and extension point for configurable password validation.

RFE:
Allow administrators to configure the remember-me ("Keep me signed in") cookie validity with the hudson.security.TokenBasedRememberMeServices2.tokenValidity system property.
The validity period is limited to 1 year.

RFE:
Prohibit the deserialization of Object fields by default.

RFE:
Check that the deserialized elements in additional collections are of the expected type.

Bug:
Render Plugin Manager entries without wiki URLs as plain text (regression in 2.370).

Bug:
Fix tailing of logs when partial lines are emitted (regression in 2.534).

Bug:
Fix missing shadow and blur on the global search results dropdown.

Bug:
Fix breadcrumb overflow menu items not rendering.

Bug:
Restore the Cancel button on the Console Output page of running builds so users can abort a build without leaving the log view.

Bug:
Show only accessible links in sidepanel for new manage Jenkins UI.

Bug:
Fix the combobox suggestion list flashing and closing immediately when the field is clicked.

Bug:
Center the chevron in the list of builds on the Build History view.

Bug:
Do not show "Agent is connected" message when node is marked temporarily offline

Changes since 2.568

RFE:
Update Spring Security from 7.0.5 to 7.1.0.

RFE:
Update Spring Framework from 7.0.7 to 7.0.8.

Bug:
Re-enable the "Add" button immediately when an item is deleted from a full list (regression in 2.536).

Bug:
Fix blue tinted scrollbar.

Bug:
Fix the combobox suggestion list flashing and closing immediately when the field is clicked.

RFE:
Update bundled Script Security Plugin from 1402.v94c9ce464861 to 1402.1405.vc96e74964250.

RFE:
Disable sticky elements when the disableStickyPositioning HTTP cookie is enabled (used in acceptance tests).

Notable changes since 2.555.3

RFE:
Use a dialog to add and edit the description of jobs, builds, views, computers, and more.

RFE:
Refine appearance of dialogs.

RFE:
Refine the 'System' page of Manage Jenkins.

RFE:
Refine the 'Users' page of Manage Jenkins.

RFE:
Refine how administrative monitors are displayed.

RFE:
Deduplicate build causes in queue tooltip and build overview.

RFE:
Reduce agent creation time during high usage.

RFE:
Improve queue maintenance performance for jobs with large build histories.

RFE:
Add Windows Server 2025 container image for the Jenkins controller.

Bug:
Ensure cancel button for queued jobs doesn't move when other badges are present.

Bug:
Remove lines from log recorder page.

Bug:
Wrap long, unbroken strings correctly within the maximum width of the dialog.

Bug:
Restore the job name in the page title on the build console and changes pages.

Bug:
Ensure urls in widgets loaded via ajax are correct.

Changes since 2.555:

RFE:

• Upgrade Spring Framework from 6.2.16 to 6.2.17.
• Upgrade Spring Security from 6.5.8 to 6.5.9.

Bug:

• Fix multibranch Pipeline scan from parent folder (regression in 2.547).

Notable changes since 2.541.3:

Major RFE:

• Require Java 21 or newer.

Major RFE:

• Remove Java 17 container images for the Jenkins controller.

RFE:

• Enables the Overall/Manage permission by default.
• This permission when granted to users allows them to configure certain parts of Jenkins' global configuration without the ability to execute arbitrary code.

RFE:

• API tokens with expiration date.

RFE:

• Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths.

RFE:

• No longer include the client IP address in CSRF protection token ("crumb") calculation. Effectively, the behavior is the same as if the (now removed) "Enable proxy compatibility" option were always checked.

RFE:

• Show a warning to administrators who set the hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID flag, informing them of the further reduced safety, and the option's planned future removal.

RFE:

• Bump the minimum supported remoting.jar version to 3176.v207ec082a_8c0.

RFE:

• Revamp Clouds page.

Bug:

• Fix sidebar navigation for non-ASCII localized section headers.
• Fix a 404 error when clicking plugin names on the “License and dependency information for plugins” page.
• Fix primary button text color in administrative monitors.
• Fix progressive rendering progress calculation.
• Redirect to the correct URL when creating log recorders with non-ASCII names.
• Do not fail builds when the tool installation directory is readonly.

Security

Important security fixes.

RFE

Clarify UI label when configuring Content Security Policy.

Bug

Do not compute the CSP header if it's completely disabled using the Java system property jenkins.security.csp.CspHeader.headerName in case computation takes too long.

Fix exception message being logged in rare cases on views with keyboard shortcut indicators.

Make redirects to documentation on www.jenkins.io work in the builtin administrative monitors when using Chrome and enforcing Content Security Policy.

Changes since 2.541

RFE

Add telemetry for Java properties.

Bug

Use rootURL in Cloud sidepanel so links in actions work properly.

Bug

Fix console log copy button for freestyle projects that have finished (regression in 2.493).

RFE

Update Winstone to version 8.1026.v31def012a_f48 to increase the default maximum HTTP response header size to 32KB to account for very complex Content Security Policy headers.

RFE

Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths.

Bug

Allow large forms to be submitted (regression in 2.531).

RFE

Add telemetry for Content Security Policy enforcement.

RFE

Add Windows Server 2022 for Windows controller and agent containers.

RFE

Add Java 25 container images for the Jenkins controller and agents.

Notable changes since 2.528.3

Major RFE

Support Java 25.

Major RFE

Allow configuring Content-Security-Policy protection for the Jenkins UI.

Introduce an API for plugins to relax (or further tighten) the rules around various resources.

If you have the Content Security Policy Plugin (csp) installed, update it to version 2.x.

Major RFE

Red Hat and openSUSE packages are unified into the same RPM packaging with a brand new URL: https://pkg.jenkins.io/rpm-stable/.

We kept the former LTS packages (versions 2.528.3 and below) in https://pkg.jenkins.io/redhat-stable-legacy/.

Red Hat and openSUSE users are redirected from older endpoints (/redhat-stable and /opensuse-stable) to "https://pkg.jenkins.io/rpm-stable/" but are strongly advised to update their "jenkins.repo" repository configurations.

System V initialization scripts are removed for openSUSE installations

RFE

Move the user time zone configuration to the user preferences page.

RFE

Remove duplicate built-in executor configuration from System configuration page.

It now configures it on the built-in executor under Nodes instead.

RFE

Add ability to set default value for experimental flags via system property.

Bug

Eliminate spurious CPU utilization in browser when idle.

Bug

Fix toggle collapse in Chrome to prevent 404 errors.

Bug

Fix MyViewsProperty condition.

RFE

Redesign the reorderable list component.

RFE

Log a thread dump when a /health check exceeds the 10 second default timeout to help diagnose stuck requests.

This timeout is configurable via the jenkins.health.HealthCheckAction.thresholdTimeout system property.

RFE

Use the same styling for title bar mouseover effect.

Bug

Set the default enter delay for tooltips to 250ms.

Bug

Restore file fingerprint and project relationship actions to views.

Bug

Fix API token rendering.

RFE

Add rest API to create an agent from XML.

RFE

Add experimental pages for Manage Jenkins, jobs, builds, dashboard, run details, and parameter details.

Changes since 2.528

• Bug:
  Remove Eclipse modifier class to ensure code compiles as expected.
• Bug:
  Fix All/None/Suggested buttons visibility in plugin setup wizard.
• Bug:
  Fix number comparison in min/max form validator.

Notable changes since 2.516.3

• Major RFE:
  Update Debian container images to Debian 13 (Trixie).
• Major RFE:
  Updates to various UI elements.
  Refine the header, app bar, and side panel.
  Refine colors, borders, and buttons.
  Use secondary text color for dropdowns.
• Major RFE:
  Breadcrumbs now have a visual indicator and are compatible with accessibility guidelines.
• RFE:
  Improve performance with additional caching of Java classes.
• RFE:
  Apply the current theme color palette to shutdown and safe-restart messages.
• RFE:
  Remove the /extensionList/ HTTP endpoint and related telemetry.
  Users of the Timestamper plugin should update to version 1.29 or newer.
• RFE:
  Use a new name format for subdirectories of $JENKINS_HOME/users/.
  Stop creating redundant $JENKINS_HOME/users/users.xml.
• RFE:
  Minor performance optimization for administrative monitors badge display.
• RFE:
  Refine User page UI.
• RFE:
  Refine the Console URL Provider UI.
• RFE:
  Show parameters of a run in read-only mode.
• RFE:
  Reduce agent launch log stack trace noise for ClosedChannelExceptions.
• RFE:
  SSH cli now uses EdDSA natively provided by Apache Mina via Bouncycastle.
• RFE:
  Add Polish localization.
  Adjust Bulgarian localization spacing.
  Add German localization for Global Build Discarder.
• Bug:
  Fix a race condition in WebSocket agent connection initialization.
• Bug:
  Create friendlier HTTP response for an attempt to buildWithParameters a disabled or nonparameterized job.
• Bug:
  Fix incorrect parameter name in quietDown API online help.
• Bug:
  Correct word-wrap and word-break CSS properties to use supported values.
• Bug:
  Stop printing an incorrect log message when retrieving agent labels.
• Bug:
  Enable the chevron button in job tables by removing pointerevents:none from its CSS styling.
• Bug:
  Avoid queue items being lost if the node disconnects at a bad time during allocation.

Security

Important security fixes.

Major Bug

Remove link styling in a menu when the corresponding menu is closed.

Major Bug

Fix a memory leak in Java class loading for the GStringTemplateEngine class.

RFE

Reduce plugin ClassLoader memory consumption.

RFE

Upgrade to Winstone 8.13 and Jetty 12.0.25.

Jetty upgrade includes multiple bug fixes and most recent release of Eclipse Jetty 12.

Bug

Position the Save and Apply buttons for views under the header instead of over it.