Add a new Jenkins project root certificate as a trust anchor for update sites (20262036) in preparation for the current one's expiration in 2028. pull 27282 Fix loss of trailing partial lines when tailing plain text console logs. pull 27233 Allow Jenkins to be added to Firefox using OpenSearch. pull 27364 Restore iconOnly summary link behavior for hyperlinks on the icon (regression in 2.340). pull 27353 Use matching in build history search that is independent of locale. pull 27350 Do not clip the experimental flags value column on narrow screens. JENKINS-71211 Important security fixes. security advisory The Apache Commons Lang 2.6 library has been removed from Jenkins core. The Apache project last released Commons Lang 2.6 on January 16, 2011. The 2.x line is no longer maintained and includes known vulnerabilities that trigger software content analysis security scanners. Many Jenkins plugins previously relied on Jenkins core to provide this library rather than declaring it as their own dependency. New releases have been published for most affected plugins that now provide their own dependency or otherwise no longer require Apache Commons Lang 2. Pull requests have been submitted for other plugins so that they no longer require Apache Commons Lang 2. Plugin that used Apache Commons Lang 2 are listed in the tracking spreadsheet . Before upgrading Jenkins, upgrade your installed plugins to their most recent releases. In particular, make sure that plugins that previously depended on Commons Lang 2 have been updated. An outdated plugin may fail to load or may not function correctly after upgrading Jenkins because the Apache Commons Lang 2 classes are no longer provided by Jenkins core. Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2. Windows Server 2019 agent container images dropped Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Many Jenkins plugins previously relied on Jenkins core to provide this library rather than declaring it as their own dependency. New releases have been published for most affected plugins that now provide their own dependency or otherwise no longer require Apache Commons Lang 2. Pull requests have been submitted for other plugins so that they no longer require Apache Commons Lang 2. Plugin that used Apache Commons Lang 2 are listed in the tracking spreadsheet . Before upgrading Jenkins, upgrade your installed plugins to their most recent releases. In particular, make sure that plugins that previously depended on Commons Lang 2 have been updated. An outdated plugin may fail to load or may not function correctly after upgrading Jenkins because the Apache Commons Lang 2 classes are no longer provided by Jenkins core. Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2. Windows Server 2019 agent container images dropped Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Before upgrading Jenkins, upgrade your installed plugins to their most recent releases. In particular, make sure that plugins that previously depended on Commons Lang 2 have been updated. An outdated plugin may fail to load or may not function correctly after upgrading Jenkins because the Apache Commons Lang 2 classes are no longer provided by Jenkins core. Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2. Windows Server 2019 agent container images dropped Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2. Windows Server 2019 agent container images dropped Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Windows Server 2019 agent container images dropped Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Container images ( jenkins/inbound-agent and jenkins/ssh-agent ) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either: Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Upgrade to Windows Server 2022 Upgrade to Windows Server 2025 Build their own agent container image for Windows Server 2019 Revert "Standardise experimental Jenkins pages, make the side panel independently scrollable + make the build bar sticky". pull 27265 Remove Apache Commons Lang 2 library. pull 26105 Allow cancelling outdated form validation checks and continue processing remaining checks safely. pull 26595 Make tool installations more tolerant of slow file systems. pull 11216 Fix decoding of quoted Unicode escape sequences in label parsing. pull 26467 Show only accessible links in sidepanel for new manage Jenkins UI. pull 27228 Improve artifact archiving diagnostics when file access is denied. pull 27201 Fix autocomplete and combobox suggestions requiring a double tap to select on touch devices. pull 26923 Fix the combobox suggestion list flashing and closing immediately when the field is clicked. pull 26922 The bouncycastle API , Command Agent Launcher , Oracle Java SE Development Kit Installer , JAXB , Trilead API , SSH server , JavaBeans Activation Framework (JAF) API , JavaMail API , and Instance Identity plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins between 2016 and 2022 (Jenkins 2.16 through 2.356). Copies were bundled in the war since then so that instances upgrading from such old versions, or plugins built against them, would keep working. Most instances are not affected. If the update center is reachable, Jenkins resolves and installs these plugins automatically over the network whenever something needs them, the same way it would for any other missing dependency, regardless of which Jenkins version you're running. You are only affected if your instance has no access to the update center. In that case, upgrading core past one of the versions above, or installing a plugin built against an old baseline, can no longer pull these plugins in automatically. Download the plugin files from the update center and place them in the plugins directory of the Jenkins home directory before starting the new version, or before installing the plugin that needs them. Most instances are not affected. If the update center is reachable, Jenkins resolves and installs these plugins automatically over the network whenever something needs them, the same way it would for any other missing dependency, regardless of which Jenkins version you're running. You are only affected if your instance has no access to the update center. In that case, upgrading core past one of the versions above, or installing a plugin built against an old baseline, can no longer pull these plugins in automatically. Download the plugin files from the update center and place them in the plugins directory of the Jenkins home directory before starting the new version, or before installing the plugin that needs them. You are only affected if your instance has no access to the update center. In that case, upgrading core past one of the versions above, or installing a plugin built against an old baseline, can no longer pull these plugins in automatically. Download the plugin files from the update center and place them in the plugins directory of the Jenkins home directory before starting the new version, or before installing the plugin that needs them. Standardise experimental Jenkins pages, make the side panel independently scrollable + make the build bar sticky pull 26863 Stop bundling the bouncycastle API, Command Agent Launcher, Oracle Java SE Development Kit Installer, JAXB, Trilead API, SSH server, JavaBeans Activation Framework (JAF) API, JavaMail API, and Instance Identity plugins, reducing the size of jenkins.war by more than 20 MB. Jenkins no longer installs these plugins automatically when upgrading from Jenkins 2.356 or earlier, or when a plugin built against such an old version is discovered. If you are affected, install these plugins through the plugin manager. pull 27129 Important security fixes. security advisory The JUnit , Mailer , Matrix Authorization Strategy , Matrix Project , and OWASP Markup Formatter plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins in 2014 (Jenkins 1.577) or earlier. Copies were bundled in the war since then so that instances upgrading from such old versions would keep working. Most instances are not affected. If these plugins are already installed (they are among the plugins suggested by the setup wizard), or your instance was installed or last upgraded at any point in the last decade, nothing changes. You are only affected if you upgrade an instance directly from Jenkins 1.577 or earlier, or if you install plugins built against Jenkins (then Hudson) 1.577 or earlier without using the Jenkins plugin manager. In those cases Jenkins can no longer install these plugins automatically from the war. If the update center is reachable, install the plugins through the plugin manager as usual. On instances without access to the update center, download the plugin files and place them in the plugins directory of the Jenkins home directory before starting the new version. When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version. Most instances are not affected. If these plugins are already installed (they are among the plugins suggested by the setup wizard), or your instance was installed or last upgraded at any point in the last decade, nothing changes. You are only affected if you upgrade an instance directly from Jenkins 1.577 or earlier, or if you install plugins built against Jenkins (then Hudson) 1.577 or earlier without using the Jenkins plugin manager. In those cases Jenkins can no longer install these plugins automatically from the war. If the update center is reachable, install the plugins through the plugin manager as usual. On instances without access to the update center, download the plugin files and place them in the plugins directory of the Jenkins home directory before starting the new version. When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version. You are only affected if you upgrade an instance directly from Jenkins 1.577 or earlier, or if you install plugins built against Jenkins (then Hudson) 1.577 or earlier without using the Jenkins plugin manager. In those cases Jenkins can no longer install these plugins automatically from the war. If the update center is reachable, install the plugins through the plugin manager as usual. On instances without access to the update center, download the plugin files and place them in the plugins directory of the Jenkins home directory before starting the new version. When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version. When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version. Stop bundling the JUnit, Mailer, Matrix Authorization Strategy, Matrix Project, and OWASP Markup Formatter plugins, reducing the size of jenkins.war by more than 20 MB. Jenkins no longer installs these plugins automatically when upgrading from Jenkins 1.577 or earlier, or when a plugin built against such an old version is discovered. If you are affected, install these plugins through the plugin manager. JUnit Plugin , Mailer Plugin , Matrix Authorization Strategy Plugin , Matrix Project Plugin , OWASP Markup Formatter Plugin , JUnit Plugin , issue 26914 , pull 27098 Reduce size of Jenkins war by removing comments from translation files. pull 27100 Reduce size of Jenkins war by removing unused CLI dependency. pull 27099 Standardise Jenkins branding during Sign in, Registration, and About Jenkins pull 27046 Move password complexity rule classes from hudson.security to jenkins.security package JENKINS-69789 Clarify "Restrict where builds can run" help with an || example and explicit note that wildcards/regex are unsupported JENKINS-28380 Add Japanese translations for user configuration screen pull 4904 Allow administrators to configure the remember-me ("Keep me signed in") cookie validity with the hudson.security.TokenBasedRememberMeServices2.tokenValidity system property. The validity period is limited to 1 year. pull 26833 Clarify unclear Spanish translation for 'Unprotected URLs'. JENKINS-75134 Avoid null pointer exception showing the upstream cause of a job that was triggered by the build step in a pipeline prior to a Jenkins restart (regression in 2.558). pull 27094 Fix missing shadow and blur on the global search results dropdown. pull 27113 Fix PackedMap.values() returning keys instead of values. pull 27110 Fix HttpSessionListener so overrides of the deprecated sessionDestroyed method are invoked on session destruction. pull 27090 Move password complexity rule classes from hudson.security to jenkins.security package. JENKINS-69789 Clarify unclear Spanish translation for 'Unprotected URLs'. JENKINS-75134 Refresh the status icons to show the status of the current job, without including status of previous job. pull 23904 Fix HttpSessionListener so overrides of the deprecated sessionDestroyed method are invoked on session destruction. pull 27090 Fix the confirmation text in the experimental Manage Jenkins UI. pull 27055 Add online help to clarify the timezone used for SCM polling. JENKINS-1963 Add password complexity rule extension point for configurable password validation JENKINS-69789 Refine borders across Jenkins UI. pull 26974 Check that the deserialized elements in additional collections are of the expected type. pull 26918 Prohibit the deserialization of Object fields by default. Learn more , issue 26914 , pull 26915 Make Nodes page wide in experimental "Manage Jenkins" UI. pull 26997 Refine Notifications component. pull 27005 Keep job configuration pages at their current scroll position when opening modal dialogs (regression in 2.569). pull 27028 Render Plugin Manager entries without wiki URLs as plain text (regression in 2.370). pull 26976 Display operating system end of life messages when we are within 6 months of the end of life for Alpine Linux 3.21 - 3.24, CentOS Stream 9 - 10, Debian 13, Fedora 42 - 44, Red Hat Enterprise Linux 10, Rocky Linux 10, and Ubuntu 26.04. Correct the end of life date for Fedora 41. pull 26991 Refine the 'System Log' Manage Jenkins page pull 26614 Update bundled Script Security Plugin from 1402.v94c9ce464861 to 1402.1405.vc96e74964250. pull 26989 Fix breadcrumb overflow menu items not rendering pull 26978 Fix weird animation artifact when clicking "Apply". JENKINS-73906 Fix incorrect pluralization in the file deletion retry failure message. pull 26981 Move log.markAsComplete() into finally block in TaskThread.run() to prevent permanently stuck task UI when perform() throws an Error . pull 26967 Accept ECDSA and Ed25519 private keys for access to the Jenkins command line interface. pull 26954 Decrease padding for experimental UI details bar pull 26972 Complete the Korean translation of the Manage Jenkins screens. pull 26955 Add a Korean (ko) translation for the security configuration screens. pull 26960 Reenable the "Add" button immediately when an item is deleted from a full list like the postbuild actions of a Freestyle job (regression in 2.536). pull 26937

Restore the Cancel button on the Console Output page of running builds so users can abort a build without leaving the log view. pull 26637 Fix build history tooltip being clipped by overflow hidden pull 26554 Fix some rare Firefox scenarios where keydown is not handled correctly. pull 26966 Center the chevron in the list of builds on the Build History view. pull 26522 Include charset=UTF8 in ContentType when serving text/* files through the workspace and artifact browser. pull 26912 Install Jenkins controller via the MSI available via the "Windows" links on https://www.jenkins.io/download/ Build their own image Standardise command palette, dialog, dropdown, and tooltip materials pull 26900 Hide CSRF configuration section when only the default crumb issuer is available pull 26057 Allow to disable build history widget auto refresh in development mode pull 26558 Fix the combobox suggestion list flashing and closing immediately when the field is clicked. pull 26884 Do not show "Agent is connected" message when node is marked temporarily offline pull 26675 Fix tailing of logs when partial lines are emitted (regression in 2.534). pull 26871 Fix experimental job app bar status icon pull 26892 Fix unexpected bluish scrollbar pull 26893 Important security fixes. security advisory Ensure urls in widgets loaded via ajax are correct pull 26721 Reduce agent creation time during high usage by caching calls to Util.isOverridden . issue 26796 , pull 26797 Extend telemetry collection for Content Security Policy until December. pull 26807 Fix description editor rendering empty when reopened inside a modal dialog. pull 26795 Limit the SECURITY-3657 security fix by default to the controller JVM due to reported problems extracting some stashes involving symbolic links on agents. pull 26709 Prevent active builds from being lost when a job is reloaded (regression in 2.523). pull 26700 Add permalinks to experimental job UI menu pull 26699 Make scrollbar color derive from secondary text color pull 26735 Restore the job name in the page title on the build console and changes pages. pull 26727 Ensure applying configuration as code retains the offline cause of agent (regression in 2.482). pull 26749 Use variable for jenkins-not-applicable class. pull 26728 Refine the System page in Manage Jenkins. pull 26679 Update bundled Script Security Plugin from 1399.ve6a_66547f6e1 to 1402.v94c9ce464861, Matrix Authorization Strategy Plugin from 3.2.9 to 3.2.10. pull 26719 Wrap long, unbroken strings correctly within the maximum width of the dialog. pull 26574 Stop retaining build references in the old data monitor. pull 26711 Stop signing the war file with jarsigner. Rely on the GPG signature to verify publisher identity. pull 26708 Fix parameterised pipeline build triggering. pull 26685 Adopt experimental App Bar API for jobs pull 26510 Avoid unnecessary copy of all loaded builds in AbstractLazyLoadRunMap.getLoadedBuilds() . pull 26636 Refine the 'Users' Manage Jenkins page pull 26475 Deprecate CheckMethod#toCheckUrl method, which generates a JS expression, and does not work with CSP enabled. pull 26638 Prevent selecting an autocomplete suggestion submitting the configuration form (regression in 2.556). pull 26646 Restore warnings in the update site warnings monitor (regression in 2.558). pull 26644 Fix console card breaking layout in experimental build view pull 26663 Use correct views tab bar in new dashboard page respecting user preferences pull 26640 Keep the Duplicate Jenkins checker enabled when saving the global configuration (regression in 2.549). pull 26631 Refine appearance of dialogs pull 26514 Update dependency org.apache.ant:ant to v1.10.17 to resolve regression issue due to v1.10.16 pull 26611 Improve queue maintenance performance for jobs with large build histories pull 26597 Fix Windows null pointer exception due to Apache Ant 1.10.16 (regression in 2.558). pull 26606 Remove lines from log recorder page. pull 26598 Render links to nodes and clouds correctly in the context menu (regression). pull 26583 Use the correct URL in delete dialogs invoked from the cloud context menu (regression in 2.556). pull 26593 Refine how administrative monitors are displayed pull 26417 Deduplicate build causes in queue tooltip and build overview. pull 26392 Use a dialog to add/edit the description of jobs, builds, views, computers, ... pull 26535 Ensure cancel button for queued jobs doesn't move when other badges are present. pull 26564 Refine experimental Run overflow menu. pull 26524 Fix wrong permission for description button in new build page. pull 26548 Fix multibranch Pipeline scan from parent folder (regression). pull 26517 Fix legacy context menu items not working. pull 26525 Fix delete button being missing and actions showing when they shouldn't be (regression in 2.556). pull 26526 Fix breadcrumb heading label. pull 26523 Upgrade to Spring Security 7. pull 11304 Upgrade to Spring Framework 7. pull 11292 Refine Third Party Licences page. pull 26476 Remove maximum width of sections. pull 26435 Introduce experimental API for adding actions to experimental Run UI. pull 11204 Added Turkish translations to setup wizard. pull 26426 Explain prepending additional values to environment variables with BASE+EXTRA in the online help for nodes. JENKINS-41492 Use standard size node icon even with long node names. pull 26486 Important security fixes. security advisory Adapt Script Console for experimental Manage Jenkins UI pull 11333 Refine legacy Add button for repeatable lists pull 26352 Fix keyboard navigation scrolling in dropdowns pull 26358 Partially revert optimisation in RunMap that causes issues when reloading pull 26399 Restore unsaved changes warning in the new Manage Jenkins UI. pull 26314