Overall/Manage permission by default.
This permission when granted to users allows them to configure certain parts of Jenkins' global configuration without the ability to execute arbitrary code.
pull 23873
hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID flag, informing them of the further reduced safety, and the option's planned future removal.
pull 25918
remoting.jar version to 3176.v207ec082a_8c0.
pull 26034
jenkins.security.csp.CspHeader.headerName in case computation takes too long.
issue 26254
Got type array but no lister class found for type...)
JENKINS-76249
5E386EADB55F01504CAE8BCF7198F4B714ABFC68) is used for the Jenkins long term support RPM and DEB package repositories. Administrators need to install and accept the new signing key when upgrading. The new Linux repository signing keys blog post has more details.
Content-Security-Policy protection for the Jenkins UI.
Introduce an API for plugins to relax (or further tighten) the rules around various resources.
If you have the Content Security Policy Plugin (csp) installed, update it to version 2.x.
admin documentation, plugin compatibility, developer documentation, JENKINS-76263
/health check exceeds the 10 second default timeout to help diagnose stuck requests.
This timeout is configurable via the jenkins.health.HealthCheckAction.thresholdTimeout system property.
pull 11266
MyViewsProperty condition.
pull 11252
versionLT and Compare-VersionLessThan to account for Jenkins versioning formatting in `jenkins-support` scripts.
pull 2099 (Docker)
21.0.8+9 to 21.0.9+10.
pull 2019 (Docker), Temurin JDK21 release notes
17.0.16+8 to 17.0.17+10.
pull 2110 (Docker), Temurin JDK17 release notes
20251020 to 20251103.
pull 2188 (Docker)
/extensionList/ HTTP endpoint and related telemetry.
Users of the Timestamper plugin should update to version 1.29 or newer.
pull 10752
$JENKINS_HOME/users/.
Stop creating redundant $JENKINS_HOME/users/users.xml.
pull 10926
ClosedChannelExceptions.
pull 10927
buildWithParameters a disabled or nonparameterized job.
pull 10954
quietDown API online help.
JENKINS-75991
word-wrap and word-break CSS properties to use supported values.
pull 10881
pointerevents:none from its CSS styling.
JENKINS-75252
GStringTemplateEngine class.
JENKINS-75879
ClassLoader memory consumption.
JENKINS-75675
computeOverflow to trigger a new compute of the breadcrumbs.
JENKINS-75818
/health endpoint is available to determine whether Jenkins is healthy.
JENKINS-75530
legacyIds marker file in the builds directory.
Existing legacyIds files are deleted upon upgrade to reduce inode usage.
JENKINS-75465
hudson.util.IOException2.
pull 10628
?path and ?pattern query parameters for directory listings of user content, such as workspaces and archived artifacts.
The filter text box now uses JavaScript instead of a form submission to navigate to the expected URL.
Programmatic users are advised to replace ?path or ?pattern in their requests with the resulting redirect URL, whose behavior did not change from before.
JENKINS-75388
keepDependencies help file.
pull 10366
java -jar jenkins.war), set the SameSite attribute for cookies to provide additional protection from some CSRF vulnerabilities.
By default this sets the attribute to Lax.
This can be changed by setting the Java system property jenkins.security.JettySameSiteCookieSetup.sameSiteDefault.
Users of Microsoft Entra ID (previously Azure AD) Plugin are advised to update the plugin to version 580.v2f665882b_a_71 or newer at the same time.
pull 10630, Jenkins features controlled by system properties
submit.jelly.
JENKINS-75441
jenkinsavatar class to user icons, not the other header icons.
JENKINS-75615
ConnectionRefusalException when thrown by a websocket agent connection attempt.
pull 10655
Loading overlay with skeleton outline on Manage Jenkins pages.
JENKINS-68934
RootAction that used custom rendering (action.jelly) is once again visible in the header and behaves appropriately.
Any RootAction that uses jelly to show/hide is correctly hidden in the header.
Any RootAction with sub tasks now shows the subtasks as a dropdown when in the correct context.
JENKINS-75683
/extensionList/) is in use by plugins or can safely be removed in future releases of Jenkins.
pull 10423, pull 10505
Details widget for builds.
pull 10147
OKLCH.
pull 10078
enableTopButton to insert entry at the top in an f:repeatable.
JENKINS-75464
\ in their username.
pull 10344, JENKINS-75278, Jetty 12.0.15 changelog, Jetty 12.0.16 changelog, Jetty 12.0.17 changelog
JnlpSlaveRestarterInstallerTest on ci.jenkins Windows agents.
pull 10196
ComboBox component.
pull 9462
webSocket mode when a 403 error results from a reverse proxy misconfiguration.
pull 9930
List subclasses from Java 11 over remoting.
pull 10026
AtomicFileWriter are now derived from the target file name.
pull 10058
FileBoolean(Class, String).
pull 10022
.tgz files so they are no longer mismatched.
JENKINS-73942
hudson.model.UpdateSite$Warning on Manage Jenkins that may be shown when plugins with known security issues are installed.
JENKINS-73487
Jenkins#doSafeRestart(StaplerRequest, String).
JENKINS-73838
doSafeRestart.
pull 9882
.tar.gz artifacts in Firefox.
JENKINS-73381
rowSelectionController.
JENKINS-73669
-webSocket mode.
pull 9591
RekeySecretAdminMonitor.
JENKINS-73597
makeButton to create a jenkins-button on the fly instead of using YUI.
JENKINS-73563
ExitLifecycle, exit the process immediately upon a boot failure.
Also allow custom lifecycles to exit immediately.
pull 9483
Overall/MANAGE permission.
pull 9437
--compression can be used to disable compression if desired.
pull 9379, Stapler 1881.vd39f3ee5c629 release notes, Winstone-Jetty 6.20 release notes
Map fields in XML files more robust.
JENKINS-73687
IndexOutOfBoundsException in cloud management pages when the controller has no executors.
pull 9519, JENKINS-73554
hudson.slaves.SlaveComputer.allowUnsupportedRemotingVersions escape hatch, which was previously not working with inbound agents.
JENKINS-73467
$JENKINS_HOME/logs/tasks/Periodic background build discarder.log.
JENKINS-73692
ExtendedReadRedaction extension point to allow plugins to redact content from config.xml files served via API or CLI to users with Extended Read permission.
SECURITY-3373
SecretTextArea fields.
JENKINS-73404
miniorange-saml-sp) plugin should upgrade to a compatible version in lockstep with upgrading Jenkins core.
Users of the OpenText Application Automation Tools (hp-application-automation-tools-plugin) plugin should wait for a compatible version before upgrading Jenkins core.
Apache Commons 2.0.0-M2 release notes
webappsDir argument to run Winstone with a directory full of WAR files has been removed without replacement.
Winstone 6.19 changelog
tunnel (with no argument) even if that field had been left blank.
JENKINS-73011
WorkspaceCleanupThread to consider workspaces with suffixes even if the original is nonexistent.
Reduce the number of remoting calls made by WorkspaceCleanupThread.
JENKINS-65829