Jenkins Release Notes

Changes since 2.568

RFE:
Update Spring Security from 7.0.5 to 7.1.0.

RFE:
Update Spring Framework from 7.0.7 to 7.0.8.

Bug:
Re-enable the "Add" button immediately when an item is deleted from a full list (regression in 2.536).

Bug:
Fix blue tinted scrollbar.

Bug:
Fix the combobox suggestion list flashing and closing immediately when the field is clicked.

RFE:
Update bundled Script Security Plugin from 1402.v94c9ce464861 to 1402.1405.vc96e74964250.

RFE:
Disable sticky elements when the disableStickyPositioning HTTP cookie is enabled (used in acceptance tests).

Notable changes since 2.555.3

RFE:
Use a dialog to add and edit the description of jobs, builds, views, computers, and more.

RFE:
Refine appearance of dialogs.

RFE:
Refine the 'System' page of Manage Jenkins.

RFE:
Refine the 'Users' page of Manage Jenkins.

RFE:
Refine how administrative monitors are displayed.

RFE:
Deduplicate build causes in queue tooltip and build overview.

RFE:
Reduce agent creation time during high usage.

RFE:
Improve queue maintenance performance for jobs with large build histories.

RFE:
Add Windows Server 2025 container image for the Jenkins controller.

Bug:
Ensure cancel button for queued jobs doesn't move when other badges are present.

Bug:
Remove lines from log recorder page.

Bug:
Wrap long, unbroken strings correctly within the maximum width of the dialog.

Bug:
Restore the job name in the page title on the build console and changes pages.

Bug:
Ensure urls in widgets loaded via ajax are correct.

Changes since 2.555:

RFE:

• Upgrade Spring Framework from 6.2.16 to 6.2.17.
• Upgrade Spring Security from 6.5.8 to 6.5.9.

Bug:

• Fix multibranch Pipeline scan from parent folder (regression in 2.547).

Notable changes since 2.541.3:

Major RFE:

• Require Java 21 or newer.

Major RFE:

• Remove Java 17 container images for the Jenkins controller.

RFE:

• Enables the Overall/Manage permission by default.
• This permission when granted to users allows them to configure certain parts of Jenkins' global configuration without the ability to execute arbitrary code.

RFE:

• API tokens with expiration date.

RFE:

• Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths.

RFE:

• No longer include the client IP address in CSRF protection token ("crumb") calculation. Effectively, the behavior is the same as if the (now removed) "Enable proxy compatibility" option were always checked.

RFE:

• Show a warning to administrators who set the hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID flag, informing them of the further reduced safety, and the option's planned future removal.

RFE:

• Bump the minimum supported remoting.jar version to 3176.v207ec082a_8c0.

RFE:

• Revamp Clouds page.

Bug:

• Fix sidebar navigation for non-ASCII localized section headers.
• Fix a 404 error when clicking plugin names on the “License and dependency information for plugins” page.
• Fix primary button text color in administrative monitors.
• Fix progressive rendering progress calculation.
• Redirect to the correct URL when creating log recorders with non-ASCII names.
• Do not fail builds when the tool installation directory is readonly.

Security

Important security fixes.

RFE

Clarify UI label when configuring Content Security Policy.

Bug

Do not compute the CSP header if it's completely disabled using the Java system property jenkins.security.csp.CspHeader.headerName in case computation takes too long.

Fix exception message being logged in rare cases on views with keyboard shortcut indicators.

Make redirects to documentation on www.jenkins.io work in the builtin administrative monitors when using Chrome and enforcing Content Security Policy.

Changes since 2.541

RFE

Add telemetry for Java properties.

Bug

Use rootURL in Cloud sidepanel so links in actions work properly.

Bug

Fix console log copy button for freestyle projects that have finished (regression in 2.493).

RFE

Update Winstone to version 8.1026.v31def012a_f48 to increase the default maximum HTTP response header size to 32KB to account for very complex Content Security Policy headers.

RFE

Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths.

Bug

Allow large forms to be submitted (regression in 2.531).

RFE

Add telemetry for Content Security Policy enforcement.

RFE

Add Windows Server 2022 for Windows controller and agent containers.

RFE

Add Java 25 container images for the Jenkins controller and agents.

Notable changes since 2.528.3

Major RFE

Support Java 25.

Major RFE

Allow configuring Content-Security-Policy protection for the Jenkins UI.

Introduce an API for plugins to relax (or further tighten) the rules around various resources.

If you have the Content Security Policy Plugin (csp) installed, update it to version 2.x.

Major RFE

Red Hat and openSUSE packages are unified into the same RPM packaging with a brand new URL: https://pkg.jenkins.io/rpm-stable/.

We kept the former LTS packages (versions 2.528.3 and below) in https://pkg.jenkins.io/redhat-stable-legacy/.

Red Hat and openSUSE users are redirected from older endpoints (/redhat-stable and /opensuse-stable) to "https://pkg.jenkins.io/rpm-stable/" but are strongly advised to update their "jenkins.repo" repository configurations.

System V initialization scripts are removed for openSUSE installations

RFE

Move the user time zone configuration to the user preferences page.

RFE

Remove duplicate built-in executor configuration from System configuration page.

It now configures it on the built-in executor under Nodes instead.

RFE

Add ability to set default value for experimental flags via system property.

Bug

Eliminate spurious CPU utilization in browser when idle.

Bug

Fix toggle collapse in Chrome to prevent 404 errors.

Bug

Fix MyViewsProperty condition.

RFE

Redesign the reorderable list component.

RFE

Log a thread dump when a /health check exceeds the 10 second default timeout to help diagnose stuck requests.

This timeout is configurable via the jenkins.health.HealthCheckAction.thresholdTimeout system property.

RFE

Use the same styling for title bar mouseover effect.

Bug

Set the default enter delay for tooltips to 250ms.

Bug

Restore file fingerprint and project relationship actions to views.

Bug

Fix API token rendering.

RFE

Add rest API to create an agent from XML.

RFE

Add experimental pages for Manage Jenkins, jobs, builds, dashboard, run details, and parameter details.

Changes since 2.528

• Bug:
  Remove Eclipse modifier class to ensure code compiles as expected.
• Bug:
  Fix All/None/Suggested buttons visibility in plugin setup wizard.
• Bug:
  Fix number comparison in min/max form validator.

Notable changes since 2.516.3

• Major RFE:
  Update Debian container images to Debian 13 (Trixie).
• Major RFE:
  Updates to various UI elements.
  Refine the header, app bar, and side panel.
  Refine colors, borders, and buttons.
  Use secondary text color for dropdowns.
• Major RFE:
  Breadcrumbs now have a visual indicator and are compatible with accessibility guidelines.
• RFE:
  Improve performance with additional caching of Java classes.
• RFE:
  Apply the current theme color palette to shutdown and safe-restart messages.
• RFE:
  Remove the /extensionList/ HTTP endpoint and related telemetry.
  Users of the Timestamper plugin should update to version 1.29 or newer.
• RFE:
  Use a new name format for subdirectories of $JENKINS_HOME/users/.
  Stop creating redundant $JENKINS_HOME/users/users.xml.
• RFE:
  Minor performance optimization for administrative monitors badge display.
• RFE:
  Refine User page UI.
• RFE:
  Refine the Console URL Provider UI.
• RFE:
  Show parameters of a run in read-only mode.
• RFE:
  Reduce agent launch log stack trace noise for ClosedChannelExceptions.
• RFE:
  SSH cli now uses EdDSA natively provided by Apache Mina via Bouncycastle.
• RFE:
  Add Polish localization.
  Adjust Bulgarian localization spacing.
  Add German localization for Global Build Discarder.
• Bug:
  Fix a race condition in WebSocket agent connection initialization.
• Bug:
  Create friendlier HTTP response for an attempt to buildWithParameters a disabled or nonparameterized job.
• Bug:
  Fix incorrect parameter name in quietDown API online help.
• Bug:
  Correct word-wrap and word-break CSS properties to use supported values.
• Bug:
  Stop printing an incorrect log message when retrieving agent labels.
• Bug:
  Enable the chevron button in job tables by removing pointerevents:none from its CSS styling.
• Bug:
  Avoid queue items being lost if the node disconnects at a bad time during allocation.

Security

Important security fixes.

Major Bug

Remove link styling in a menu when the corresponding menu is closed.

Major Bug

Fix a memory leak in Java class loading for the GStringTemplateEngine class.

RFE

Reduce plugin ClassLoader memory consumption.

RFE

Upgrade to Winstone 8.13 and Jetty 12.0.25.

Jetty upgrade includes multiple bug fixes and most recent release of Eclipse Jetty 12.

Bug

Position the Save and Apply buttons for views under the header instead of over it.

Changes since 2.516

• Bug:
  Improve UI of secondary actions in the header.

• Bug:
  Add window listener computeOverflow to trigger a new compute of the breadcrumbs.

• Bug:
  Prevent multiple dropdowns appearing in breadcrumbs.

• Bug:
  Display a badge in the hamburger for Actions with active alerts.

• Bug:
  Make script console layout configurable.

Notable changes since 2.504.3

• Major RFE:
  Redesign the header and navigation.

• Major RFE:
  Display plugin health score in the Plugin Manager.

• RFE:
  Updates to various UI elements.
  Refine the appearance of dialogs and Command Palette.
  Standardize Manage Jenkins page size.
  Use Jenkins color palette for test results and CodeMirror.

• RFE:
  Refresh user API Token UI.

• RFE:
  Remove support for loading user data from releases older than Jenkins 1.283.

• RFE:
  Remove support for loading proxy configuration from releases older than Jenkins 1.415.

• RFE:
  Add "No plugins" notice to Appearance configuration page.

• RFE:
  Update to a dropdown menu display for the user Default View.

• RFE:
  Improve UI of Secret and Password entry.

• RFE:
  A new /health endpoint is available to determine whether Jenkins is healthy.

• RFE:
  New jobs no longer create an empty legacyIds marker file in the builds directory.
  Existing legacyIds files are deleted upon upgrade to reduce inode usage.

• RFE:
  Jenkins' own user database no longer accepts new passwords longer than supported by bcrypt (72 bytes).
  Users with longer passwords are advised to change their password.

• RFE:
  Remove jbcrypt library.
  If you use the Active Directory plugin, you must update it to version 2.40 at the same time Jenkins is updated to 2.516.1.

• RFE:
  Remove deprecated hudson.util.IOException2.

• RFE:
  Remove support for ?path and ?pattern query parameters for directory listings of user content, such as workspaces and archived artifacts.
  The filter text box now uses JavaScript instead of a form submission to navigate to the expected URL.
  Programmatic users are advised to replace ?path or ?pattern in their requests with the resulting redirect URL, whose behavior did not change from before.

• RFE:
  Remove PAM Authentication plugin from suggested plugins.

• RFE:
  Add Powershell script to Windows installer to update registry information after WAR update.

• RFE:
  Add a "copy to clipboard" button to the Jenkins error page.

• RFE:
  Complete the Japanese translation for the keepDependencies help file.

• RFE:
  When running in Jetty (when using the default java -jar jenkins.war), set the SameSite attribute for cookies to provide additional protection from some CSRF vulnerabilities.
  By default this sets the attribute to Lax.
  This can be changed by setting the Java system property jenkins.security.JettySameSiteCookieSetup.sameSiteDefault.
  Users of Microsoft Entra ID (previously Azure AD) Plugin are advised to update the plugin to version 580.v2f665882b_a_71 or newer at the same time.

• RFE:
  Allow the Views tab bar to be configured per user.

• Bug:
  Only update affected computers when adding/updating/removing nodes instead of reviewing every computer and checking their retention strategy, which can cause performance issues at scale.

• Bug:
  Fix limitation of Summary widget on the build page.

• Bug:
  Fix search result URLs when using the old search implementation.

• Bug:
  Add value attribute to button element in submit.jelly.

• Bug:
  Ensure computer configuration is updated correctly after updating a node.

• Bug:
  Ensure number of executors of the built-in node is synced with the number of executors defined in Jenkins after a configuration reload.

• Bug:
  Allow icons in tables to be updated even when there is more than one table displayed on the page.

• Bug:
  Fix "No builds" state remaining in Build History widget after first build.

• Bug:
  Fix state of labels removed from nodes.

• Bug:
  When completing a build, look for older builds to rotate asynchronously, in case this process is expensive.

• Bug:
  Fix the display of icons in the header by only applying the jenkinsavatar class to user icons, not the other header icons.

• Bug:
  Reduce heap usage of various HTTP endpoints serving large build logs.

• Bug:
  Restore the children context menu for breadcrumbs.

• Bug:
  Remove overlapping text from the Thread Dump page.

• Bug:
  Defer rendering a build's artifact list to a background request to avoid expensive computations.

• Bug:
  Catch ConnectionRefusalException when thrown by a websocket agent connection attempt.

• Bug:
  Do not close the dropdown menu when hovering over the submenu of the dropdown menu.

• Bug:
  Fix URLs in search result list when running at root context.

• Bug:
  Restore side panel actions for views.

• Bug:
  Replace Loading overlay with skeleton outline on Manage Jenkins pages.

• Bug:
  Place secondary actions in the collapsing menu instead of displaying them based on screen width.

• Bug:
  Any RootAction that used custom rendering (action.jelly) is once again visible in the header and behaves appropriately.
  Any RootAction that uses jelly to show/hide is correctly hidden in the header.
  Any RootAction with sub tasks now shows the subtasks as a dropdown when in the correct context.