Changelog Archive

What's new in 2.320 (2021-11-09)

• Upgrade the Guava library from 11.0.1 (released on January 9, 2012) to 31.0.1 (released on September 27, 2021). Plugins have already been prepared to support the new version of Guava; use the Plugin Manager to upgrade all plugins before and after upgrading Jenkins. (pull 5707, issue 36779, JEP-233, Guava web site, Guava 31.0.1 changelog)
• Modernise the 'New view' and 'New node' pages. (pull 5842)
• Improve artifact list readability in dark theme. (pull 5889)
• Use CSS animation for console progress. (pull 5871)
• Allow plugin upload by URL in addition to file name. (issue 4814)
• Update bundled version of Bouncy Castle API plugin from 2.20 to 2.25. (pull 5898, Bouncy Castle release notes)
• Prevent LinkageError during class loading (regression in 2.309). (issue 66993)
• Do not attempt to canonicalize tar entries when untaring, as the result may be unexpected for symlinks. (issue 67063)
• Fix form submission for file access rules of agent to controller security subsystem (regression in 2.111). (pull 5881, issue 67061, Upgrade guide - Agent to controller path filter security fixes)
• Avoid false positives in plugin search (installed tab). (pull 5870)
• Fix missing hyperlink in build history (regression in 2.314). (issue 67028)
• Add space between icon and project name (or build number) in all links to builds. (pull 5887)
• Add space between icon and project name in upstream & downstream section of project page. (issue 66749)
• Replace outdated URLs with working redirects. (issue 67032)
• An exception thrown by a RestartListener no longer leaves Jenkins in a zombie-like state. (issue 67002)
• Display the time zone of the user when an administrator updates a user account. (issue 66845)
• Developer: Provide a stable version of ObjectWebASM (currently 9.1) on the classpath. (pull 5524, ObjectWebASM web site)
• Developer: Use the upstream version of AntClassLoader without custom patches. (pull 5856)

What's new in 2.319 (2021-11-04)

• Important security fixes. (security advisory)
• Security hardening: Require role check for remoting callables. (LTS upgrade guide, developer documentation)
• Always allow configuring agent-to-controller security subsystem.

What's new in 2.318 (2021-10-26)

• Add XStream2 constructor matching super. (issue 66955)
• Remove deprecated, unsafe classes previously copied from Apache Ant. Docker Slaves plugin is incompatible with this change. (issue 66930)
• ExecutorListener may now be implemented as a static extension. (issue 66947)
• Update tooltips to be consistent across Jenkins. (pull 5763)

What's new in 2.317 (2021-10-19)

• Screen Resolution cookie now has the secure flag set when Jenkins is running on HTTPS. (issue 49675)
• Deprecate the -cp option in the remoting agent.jar command line. Upgrade from Remoting 4.10 to Remoting 4.11. (pull 5821, issue 64831, Remoting 4.11 changelog)
• Display ongoing build in build history (regression in 2.314). (issue 66753)
• Fix agent handshake when connecting over Websocket on Java 11. Upgrade from Remoting 4.10 to Remoting 4.11. (pull 5821, issue 61212, Remoting 4.11 changelog)
• Reduce the amount of disk writes to logs/tasks/*.log when nothing interesting is happening. (issue 66854)

What's new in 2.316 (2021-10-11)

• Update the French translation in the legend. (issue 66681)
• Display full plugin name and link when a plugin fails to load. (issue 66776)
• Improve error reporting for certain kinds of bugs in computer listeners. (pull 5755)
• Update bundled versions of Pipeline: API, Pipeline: Step API, SCM API, and Structs plugins. (pull 5773, Pipeline: API plugin, Pipeline: Step API plugin, SCM API plugin, Structs plugin)
• Developer: Fix XStream2 support of unmarshalling implicit collections. (pull 5757)

What's new in 2.315 (2021-10-06)

• Security fixes. (security advisory)
• Security hardening: The "short description" of build causes is now defined as plain text instead of HTML. (related LTS upgrade guide entry, related developer documentation)

What's new in 2.314 (2021-09-28)

• Modernise the "Build History" search bar (pull 5692)
• Show new status icons in build history (issue 66659)
• Modernise the "Manage Jenkins" screen (pull 5693)

What's new in 2.313 (2021-09-21)

• Allow a plugin to dynamically insert a JAR file into its classpath. (issue 66563)
• Remove the --daemon argument from Jenkins command line arguments. Replace Akuma library from Jenkins core with simpler implementations using ProcessTree capabilities (pull 5561)
• Allow Jenkins to start when the JCasC configuration defines view-related permissions (regression in 2.302). (issue 66470)
• Correction of Label expression including a "implies" relationship without spaces around. (issue 66613)
• WebSocket connections now work when the Jenkins controller is running Java 11 and using self-terminated TLS. (issue 61212)

What's new in 2.312 (2021-09-14)

• Update executable war from 1.45 to 2.0 (pull 5706)
• Replace the old icons with the new SVG icons in the job trend page. (issue 65928)

What's new in 2.311 (2021-09-09)

• Fix wrong parameter type for Text Parameter when triggering a build via the buildWithParameters API call. (pull 5704)
• Graphs now scale correctly on high resolution screens. (pull 5697)
• The checkbox labeled "Enable Agent → Controller Access Control" in the form "Configure Global Security" would always start out as disabled. Submitting the form without checking it would then cause a configuration change (regression in 2.307). (pull 5694)
• Load classes from plugins in parallel for faster startup on multicore machines. (issue 23784)
• Internal: Experimental support for URLClassLoader can be enabled by setting hudson.ClassicPluginStrategy.useAntClassLoader=false. (pull 5698)

What's new in 2.310 (2021-09-07)

• Jenkins 2.310 was not placed in the artifact repository or on the download site.

What's new in 2.309 (2021-08-30)

• Fix missing settings/cog icon in Plugin Manager. Fix incorrect folder icon showing in projects (regression in 2.307). (pull 5690)
• Add ABORTED threshold to ReverseBuildTrigger. (pull 5542)
• Developer: Bump Java Native Access (jna) from 5.8.0 to 5.9.0. (pull 5682, JNA 5.9.0 changelog)
• Internal: AntClassLoader (and its subclass PluginFirstClassLoader) and MaskingClassLoader register themselves as parallel-capable. (pull 5687)
• Upgrade from xstream 1.4.17 to 1.4.18. (pull 5685, issue 66507, XStream 1.4.18)

What's new in 2.308 (2021-08-24)

• Use SVGs over PNGs for the sidebar when possible. Breadcrumb bar/logo/menu items are now correctly aligned on the left together. Move old war/images folder to webapp so they can be used in frontend - the SVGs are now in the webapp/images/svgs folder. (pull 5663)
• Update appearance for feed bar and description button to be modern and consistent. (pull 5664)
• When the buildWithParameter API is called, if the requests with the same parameters in the queue are merged, the http response code of the request uses a more appropriate 303(see other) instead of 201(created). (issue 66105)
• Warn about use of master in a label expression when that's no longer in use. (pull 5674)
• Use full URL character encoding for the generated inbound agent launch string. (pull 5636)
• Use the JVM's default keystore type for the Jenkins server when terminating TLS connections within Jenkins. Used if Jenkins is started with the --httpsPort argument. Winstone 5.21: Update Jetty from 9.4.42.v20210604 to Jetty 9.4.43.v20210629. (pull 5670, issue 66379, Winstone 5.20 changelog, Winstone 5.21 changelog, Jetty 9.4.43 changelog)
• Developer: Bump spring-security-bom from 5.5.1 to 5.5.2. (pull 5672, Spring project spring-security 5.5.2 release notes)

What's new in 2.307 (2021-08-17)

• Replace the term "master" with "controller" (for the main Jenkins application) or "built-in node" in user interface strings and documentation as appropriate. (pull 5425)
• Add migration code to change the node name (e.g. NODE_NAME environment variable) and label of the built-in node only after explicit migration by an administrator. New installations get the new node and label immediately. If a job definition, Pipeline definition, or tool installer reference must be tied to the built-in node, it should use the label "built-in". (Built-In Node Name and Label Migration)
• Add the system property jenkins.model.Jenkins.nodeNameAndSelfLabelOverride to specify a different node name and label for the built-in node (e.g. for Configuration as Code use cases) than the one otherwise determined. This will not affect other uses of the node name, such as the URL to the built-in node (now /computer/(built-in)/). (pull 5425)
• GDSL file in jenkins-core library no longer reports an IllegalStateException when used in IntelliJ IDEA. (pull 5662)
• Improve layout of console output header. (pull 5507)
• Use the SVG version of the Jenkins text logo instead of the PNG. (pull 5660)
• Developer: Jenkins now uses an updated version of the AntClassLoader class with fewer custom patches. (pull 5656)
• Removed: The Woodstox implementation of the StAX API has been removed from Jenkins core. Users of the Azure Artifact Manager, Azure Container Agents, Azure Storage, and Azure SDK API plugins must upgrade those plugins to the latest versions in lockstep with this core upgrade. Plugins that consume Woodstox should depend on it directly or via the Jackson 2 API plugin. (pull 5651, Woodstox implementation, StAX API, Azure Artifact Manager plugin, Azure Container Agents plugin, Azure Storage plugin, Azure SDK API plugin, Jackson 2 API plugin)

What's new in 2.306 (2021-08-10)

• Provide working "Help About" links for Jenkins CLI, Jenkins core, and Jenkins war. (issue 64666)
• Developer: AntClassloader will now ignore files that are part of the classpath but not zip files when scanning for resources. It used to throw an exception. (pull 5650)

What's new in 2.305 (2021-08-03)

• Show tooltips when users hover on the SVG icons. (issue 65923)
• Ability to disable Java 11 administrative monitor with a system property. (issue 66177)
• Developer: Make AntClassLoader multi-release JAR aware when it deals with java.util.jar.JarFile. (pull 5635)

What's new in 2.304 (2021-07-27)

• Fix an issue unzipping archives in a corner case when entries have the same path prefix as the target location. (issue 66094)
• Avoid polluting the log when usage statistics can not be sent. (issue 66139)
• Bump matrix-auth from 2.6.7 to 2.6.8. (pull 5630)
• Bump bundled Ant from 1.10.10 to 1.10.11. (pull 5620)
• Remove support for native JNR (Java Native Runtime) chmod(2) and stat(2) implementations as opposed to NIO (Java non-blocking I/O) via the hudson.Util.useNativeChmodAndMode system property. This system property no longer has any effect. (pull 5606)
• Developer: Allow consumers of XmlFile to disable fsync(2). (pull 5599)
• Internal: Terminology cleanup to fix build time trend's distributed builds. Only show the agent column when the controller has agents defined. (pull 5625)

What's new in 2.303 (2021-07-20)

• Bump commons-compress from 1.20 to 1.21. (pull 5624)
• Bump spring-security-bom from 5.5.0 to 5.5.1. (pull 5598, Spring project spring-security 5.5.1 release notes)

What's new in 2.302 (2021-07-13)

• Optimize access control checks affecting (at least) Pipeline node steps. (pull 5586)
• Developer: The hudson.util.SubClassGenerator and experimental hudson.model.TreeView class have been removed without replacement. (pull 5566, pull 5603)
• Internal: Upgrade from Remoting 4.9 to Remoting 4.10 with bugfixes and dependency updates. (pull 5607, Remoting 4.10 changelog)

What's new in 2.301 (2021-07-06)

• Fix a regression in 2.298 where some plugins (including Azure Storage) could not correctly parse streaming XML output. (pull 5604)
• The Jenkins process management functionality now supports FreeBSD. (pull 5563)
• Bump jenkins from 1.64 to 1.65. (pull 5594)
• Winstone 5.19: Update Jetty from 9.4.41.v20210516 to Jetty 9.4.42.v20210604. (pull 5589, Winstone 5.19 changelog, Jetty 9.4.42 changelog)

What's new in 2.300 (2021-06-30)

• Important security fixes. (security advisory)

What's new in 2.299 (2021-06-22)

• Update stapler from 1539.v2f05ce93882d to 1563.v3da2d02f9572. (pull 5549, Stapler 1539.v2f05ce93882d changelog, Stapler 1563.v3da2d02f9572 changelog)
• Developer: InterceptingExecutorService and its subclasses no longer extend com.google.common.util.concurrent.ForwardingExecutorService or com.google.common.collect.ForwardingObject. (pull 5565)
• Remove jna-posix dependency from Jenkins core. Plugins that use jna-posix functionality must be migrated from jna-posix to jnr-posix. (pull 5560, Maven Repository Scheduled Cleanup plugin, SICCI for Xcode plugin, java.io.tmpdir cleaner plugin)

What's new in 2.298 (2021-06-15)

• Document REST methods to mark an (agent) node temporarily offline and related tasks. (pull 5556)
• Add X-Frame-Options header to AJAX responses. (pull 5555)

What's new in 2.297 (2021-06-08)

• Remove Apache Commons Digester library and related code from the Jenkins core. (pull 5320, issue 65161, announcement and upgrade guidelines)
• Fix incorrect process termination issues when running on macOS. (issue 65195)
• Add check to prevent out of bounds memory access error on macOS. (issue 64347)
• A race condition in class loading could result in a LinkageError. (issue 65766)
• Do not change fonts when artifacts are as shown as a tree. (issue 65751)
• Bump sshd-core from 2.5.1 to 2.7.0 in Jenkins CLI. (pull 5547)

What's new in 2.296 (2021-06-01)

• Fix regressions in forms submissions from unwanted form validation in any browser (regression in 2.289). (issue 65585)
• Recommend running on Java 11. (issue 65577)
• Change the word 'number' to 'integer' in the error message of the number field. (pull 5538)
• Show implied plugin dependencies or a count of dependencies for plugins split from core. (pull 5472)
• Bump spring-security-bom from 5.4.6 to 5.5.0. (pull 5505, Spring project spring-security 5.5.0 release notes)
• Winstone 5.18: Update Jetty from 9.4.40.v20210413 to 9.4.41.v20210516 for bug fixes and enhancements. (pull 5540, Winstone 5.18 changelog, Jetty 9.4.41 changelog)
• A specific and rarely encountered internal error now again correctly shows details about the cause (regression in 2.292). (pull 5537)
• Improve contrast for the checkbox in the login page. (pull 5536)
• Jenkins redirects users to the previous page after login even if they were able to view it while not logged in (regression in 2.266). (issue 64991)
• Developer: View is now a DescriptorByNameOwner allowing its use as AncestorInPath. (pull 5533)
• Remove the Bytecode Compatibility Transformer library and related code from Jenkins core. Developer: Plugins that rely on the hudson.model.Queue$Item#id or hudson.model.AbstractProject#triggers fields must be updated to call the corresponding getters. (pull 5526, Vertx plugin, Slave Prerequisites plugin)
• Developer: Remove JTidy dependency from Jenkins core. Plugins that use JTidy functionality must be updated to explicitly declare a dependency on JTidy rather than relying on Jenkins core to provide this library. (pull 5521, NIS notification lamp plugin)
• Internal: Remove partial (~6% complete) Arabic and Portuguese translations (pull 5518)
• Internal: Upgrade from Remoting 4.8 to Remoting 4.9 with bugfixes and dependency updates. (pull 5539, Remoting 4.9 changelog)

What's new in 2.295 (2021-05-25)

No notable changes in this release.

What's new in 2.294 (2021-05-25)

• Fix SSH command line interface (CLI) authentication (regression in 2.284). (issue 65273)
• Fix NoSuchMethodError when using plugins that rely on bridge methods for compatibility (regression in 2.278). (issue 65605)
• Remove the requirement for locking the queue when adding a new node. (pull 5450)
• Explain that some plugin updates can be unavailable even on the latest version of a given release line (i.e. LTS). (pull 5462)
• Update French terminology for controller. (issue 65398)
• Upgrade from xstream 1.4.16 to 1.4.17. (pull 5498, issue 65657, XStream 1.4.17)
• Internal: Upgrade from Remoting 4.7 to Remoting 4.8 with bugfixes and dependency updates. (pull 5478, issue 40700, Remoting 4.8 changelog)

What's new in 2.293 (2021-05-12)

• Allow builds to complete when using fingerprints to track items associated with the build. Fix a regression where fingerprint facets were not removable (regression in 2.292). (issue 65611)

What's new in 2.292 (2021-05-11)

• Update Stapler from 1.263 to 1532.vfcf95addcb5f to improve performance when encoding unicode characters in JSON API. (pull 5422, Stapler 1527.ve41b3ce15c05 changelog, Stapler 1532.vfcf95addcb5f changelog)
• Display Pipeline builds among user build history and remove incorrect warning about view build history. (issue 59412)
• Stop bundling the External Monitor Job Type, LDAP, and PAM Authentication plugins. Jenkins will no longer automatically install the External Monitor Job Type, LDAP, or PAM Authentication plugins on startup if a plugin depending on Jenkins 1.467 or earlier is discovered. If you use such a plugin that also relies on the functionality provided by the External Monitor Job Type, LDAP, or PAM Authentication plugin and manage plugins outside Jenkins' plugin manager, you will now need to ensure that a recent release of the External Monitor Job Type, LDAP, or PAM Authentication plugin is installed. Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. (pull 5445, External Monitor Job Type plugin, LDAP plugin, PAM Authentication plugin)
• Improve build status progress animation. (issue 65574)
• Internal: Update Stapler from 1.263 to 1532.vfcf95addcb5f to remove Guava dependency. (pull 5422, Stapler 1527.ve41b3ce15c05 changelog, Stapler 1532.vfcf95addcb5f changelog)

What's new in 2.291 (2021-05-04)

• Remove JEP-200 compatibility workarounds for releases published before February 2018 of the following plugins: Maven Integration, Job DSL, Monitoring, Git Client, Pipeline: Supporting APIs, OWASP Dependency-Check. (pull 5454, Plugin versions with a fix, JEP-200)
• Improve performance for standard input of the Jenkins CLI, for example with the install-plugin command. (issue 64294)
• Wrap the build name in the build results list if it is too long. (issue 65190)
• Stop sending HTTP response headers related to the remoting-based CLI (removed in 2.165). (pull 5452)

What's new in 2.290 (2021-04-28)

• Winstone 5.17: Update Jetty from 9.4.39.v20210325 to 9.4.40.v20210413 for bug fixes and enhancements. (pull 5437, Winstone 5.17 changelog, Jetty 9.4.40 changelog)
• Fix an issue archiving files greater than 4 GiB in size when creating ZIP64 archives. (issue 52356)

What's new in 2.289 (2021-04-20)

• Ensure that file parameters correctly overwrite previous files (regression in 2.278). (issue 65327)
• Stop using deprecated untrusted submit events on modern browsers for compatibility with future Firefox releases. (issue 53462)
• Improve UI of slow trigger administrative monitor. (pull 5424)
• Improve performance when creating or deleting nodes by reducing queue-lock contention. (issue 65308)
• Bump spring-security-bom from 5.4.5 to 5.4.6. (pull 5413, Spring project spring-security 5.4.6 release notes)
• Update Japanese translations for login screen. (pull 5410)

What's new in 2.288 (2021-04-11)

• Reduce task queue lock contention when creating or deleting nodes. (issue 65308)
• Simplify icon for unstable builds (use an exclamation mark). (pull 5392)
• Fix load statistics graph links to include correct graph duration (regression in 2.264). (issue 65336)
• Honor the current folder when creating new views with the "New View" link. (issue 56934)
• Add Turkish translations for new login form. (pull 5387)
• Developer: Remove unnecessary bundled handlebars asset. There is no expected impact on plugins depending on handlebars. (pull 5385)
• Developer: Restore support for Jelly debugging with stapler.jelly.trace. (issue 65288)
• Internal: Update Stapler from 1.262.1 to 1.263 to use latest Apache commons-beanutils. Update Apache commons-beanutils from 1.9.3 to 1.9.4. (pull 5324, Stapler 1.263 release notes, Apache commons beanutils 1.9.4 release notes)

What's new in 2.287 (2021-04-07)

• Security fixes. (security advisory)
• Security hardening against some CSRF attacks. (related LTS upgrade guide entry)

What's new in 2.286 (2021-03-30)

• Important security fix. (2021-04-20 security advisory)
• Fix disabled dropdown items to appear disabled (regression in 2.264). (issue 65021)
• Improve support for update site-defined setup wizard suggestions. (issue 65172)
• Add a "CI" environment variable, always set to "true" as in most other CI solutions. Note that the presence of this variable may change behavior of some of the tools used in your pipelines. (issue 36707)
• Support 'min' and 'max' values in field definitions of forms. (issue 63855)
• Add administrative monitors recommending no executors are configured on the controller. (pull 5337)
• Add a Jenkins User-Agent header to outgoing HTTP requests by default. Use jenkins.UserAgentURLConnectionDecorator.disabled to disable it if needed. (pull 5368)
• Winstone 5.16: Update Jetty from 9.4.38.v20210224 to 9.4.39.v20210325 for bug fixes and enhancements. (2021-04-20 security advisory, pull 5380, Winstone 5.16 changelog, Jetty 9.4.39.v20210325 changelog)
• Bump jna from 5.7.0 to 5.8.0. (pull 5381, JNA 5.8.0 changelog)

What's new in 2.285 (2021-03-23)

• Switch to sending POST requests by default for form validation URLs. (pull 4623)
• Bump matrix-auth from 2.6.5 to 2.6.6. (pull 5366, Security Advisory 2021-03-18)
• Upgrade from xstream 1.4.15 to 1.4.16. (pull 5360, XStream 1.4.16)
• Upgrade bouncycastle-api plugin from 2.16.0 to 2.20. Upgrade Bouncy Castle library to 1.64. (pull 5347, bouncycastle-api 2.20 changelog, bouncycastle-api 2.18 changelog, bouncycastle-api 2.17 changelog, bouncycastle-api 2.16.3 changelog, bouncycastle-api 2.16.2 changelog, bouncycastle-api 2.16.1 changelog, Bouncy Castle library 1.64 release notes)
• Fix NoClassDefFoundError exception while executing ProcessTree.get(). (issue 62006)
• Sort available plugins by name when popularity is equal. (pull 5359)

What's new in 2.284 (2021-03-16)

• Gear, clipboard, and user icons are transparent again (regression in 2.283). (pull 5354)
• Stop bundling the Ant and Javadoc plugins. Jenkins will no longer automatically install the Ant and Javadoc plugins on startup if a plugin depending on Jenkins 1.430 or earlier is discovered. If you use such a plugin that also relies on the functionality provided by the Ant or Javadoc plugin (e.g., the RAD Builder and manage plugins outside the Jenkins plugin manager, you will now need to ensure that a recent release of the Ant or Javadoc plugin is installed. Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. (pull 5338, Ant plugin, Javadoc plugin, RAD Builder plugin)
• Update Jenkins CLI to SSHD Core from 1.7.0 to 2.6.0. (pull 5206)
• Add Japanese translations for Dashboard, Views, Rename. (pull 5350)

What's new in 2.283 (2021-03-09)

• Fix help buttons in the draggable section (regression in 2.264). (issue 64972)
• Add modern icons: build status and weather. (pull 5065)
• Accept negative numbers in number input controls (regression in 2.274). (pull 5341)
• Prevent Jenkins queue deadlock when cancelling tasks under certain conditions. (issue 64931)
• Do not render full error responses in case of internal errors when validating fields in configuration forms. (issue 65017)
• Lower verbosity of a Queue.save() error message. (pull 5326)
• Add indicator for security-related entries in the global administrative monitors configuration. (pull 5078)
• Add Japanese translations for New Job screen. (pull 5334)
• Developer: Add support for plugins to use external SVG sprites in their icons. (pull 5065, Example external SVG sprite implementation in GitHub Branch Source plugin)

What's new in 2.282 (2021-03-02)

• Update Eclipse Jetty from 9.4.35.v20201120 to 9.4.38.v20210224 for bug fixes and enhancements. (pull 5317, Jetty 9.4.38 changelog, Jetty 9.4.37 changelog, Jetty 9.4.36 changelog)
• SSHD module is no longer bundled in Jenkins core. Provide SSHD as a plugin. (issue 55582, issue 64107, pull 5049, SSHD module repository)
• Do not force plugin upgrades of recently detached plugins. (pull 5311)
• Upgrade from Remoting 4.6 to Remoting 4.7 with bugfixes and dependency updates. (pull 5292, Remoting 4.7 changelog)
• Remove the hardcoded JKS key store so that other key stores can be used, like BCFKS from the FIPS version of Bouncy Castle. (pull 5266)
• Improve reconnection behavior for inbound TCP agents. (issue 64510)
• Internal: Ensure that Jenkins#setViews() updates the configuration only when all views are successfully set. (pull 5301)

What's new in 2.281 (2021-02-23)

• Improve button focus states. (pull 5291)
• Remove some workarounds for IE < 11. (pull 5280)
• Developer: Revert symbol-annotation bump (regression in 2.280). (pull 5293)
• Developer: Relax ParameterDefinition and subclass constructor signatures to allow optional attributes like description to be defined in setters. (pull 5275)

What's new in 2.280 (2021-02-16)

• Important security fix. (security advisory)
• Fix plugin search over multiple update sites (regression in 2.270). (issue 64840)
• Show available plugin updates by reloading update center data on upgrade/downgrade. (issue 41727)
• Update JNA from 5.6.0 to 5.7.0. (pull 5273, JNA 5.7.0 changelog)
• Provide new translations for Polish language. (pull 5271)

What's new in 2.279 (2021-02-09)

• Fix Internet Explorer 11 rendering of the Available plugins tab (regression in 2.270). (issue 64805)
• Include 'plugin-id' and 'plugin-version' data attributes in the Available plugins tab (regression in 2.270). (issue 64775)
• Upgrade LDAP plugin from 1.26 minimum to 2.3. (pull 5244, LDAP 2.3 changelog, LDAP 2.2 changelog, LDAP 2.1 changelog, LDAP 2.0 changelog)

What's new in 2.278 (2021-02-02)

• Use an updated version of the Commons FileUpload library 1.4 without custom patches. (pull 5174, issue 64650, Apache Commons FileUpload project)
• Library dependency updates: reflections, javassist, annotation-indexer, commons-compress, bridge-method-annotation, bridge-method-injector, access-modifier-annotation, jaxen. (pull 5197, pull 5204, pull 5208, pull 5209, pull 5210, pull 5228, pull 5231, pull 5232)
• Restore, as deprecated, the old constructor based on acegisecurity Authentication parameter in order to keep backward compatibility. (issue 64746)

What's new in 2.277 (2021-01-26)

• Use a more accessible color palette in configuration form tabs. (pull 5176)
• Improve fingerprint save performance. (pull 5190, pull 5198, issue 64670)
• Fix drag & drop for form changes (regression in 2.264). (issue 64291)
• Fix server-side form validation that broke client-side form validation (regression in 2.270). (issue 64429)

What's new in 2.276 (2021-01-19)

• Security fix. (2021-01-26 security advisory)
• Provide a default implementation of the "all files in zip" download link. This is especially important for external storage plugin (regression in 2.275). (issue 64655)
• Fix the file handle leak inside DirectoryBrowserSupport (regression in 2.275). (pull 5188, issue 64632, SECURITY-1452)
• Include root folder in downloaded zip files (regression in 2.275). Resolve an additional related zip archive root folder issue. (pull 5187, issue 64621, issue 61473, SECURITY-1452)
• Allow job descriptions to be copied without zero-width spaces. (issue 28022)
• Update spring-security from 5.4.1 to 5.4.2. (pull 5166, Spring project spring-security 5.4.2 release notes)
• Update commons-codec from 1.14 to 1.15. (pull 5165, Apache commons-codec 1.15 release notes)
• Add a system property jenkins.agent.inboundUrl to provide an alternate URL for inbound TCP agents. (issue 63222)
• Restricted methods FilePath#zip(OutputStream, DirScanner, String, boolean) and VirtualFile#zip(OutputStream, String, String, boolean, boolean) have a new parameter String prefix. (pull 5187, issue 64621, issue 61473)

What's new in 2.275 (2021-01-13)

• Important security fixes. (security advisory)
• Security hardening related to XML processing using Digester2. (related LTS upgrade guide entry)
• Security hardening related to form validation responses. (related LTS upgrade guide entry)
• Security hardening restricting label names. (related LTS upgrade guide entry)

What's new in 2.274 (2021-01-05)

• Reduce lock contention around jenkins queue. (issue 58101)
• Prevent user input of 'e' or 'E' as 'positive-number', 'non-negative-number', or 'number'. (issue 64439)
• Update jnr-posix library from 3.0.45 to 3.1.4. (pull 5129, Commits from jnr-posix 3.0.45 to 3.1.4)
• Update Java native access (jna) library from 5.3.1 to 5.6.0 for most recent platform library fixes and enhancements. (pull 5125, JNA 5.6.0 changelog, JNA 5.5.0 changelog, JNA 5.4.0 changelog)

What's new in 2.273 (2020-12-29)

• Fix plugin manager buttons to correctly reposition themselves instead of being stuck under certain conditions (regression in 2.270). (issue 64504)
• Make the root source paths of GroovyHookScript customizable with jenkins.util.groovy.GroovyHookScript.ROOT_PATH. (issue 63833)
• Hide collapse icon in sidepanel widgets if they cannot be collapsed. (issue 64483)
• Update stapler to 1.262 to fix a number of IllegalReflectiveAccessWarnings when running on Java 11. (pull 5111, Stapler 1.262 changelog)

What's new in 2.272 (2020-12-22)

• Prevent NullPointerException in Plugin Manager when using an update center without support for plugin categories (regression in 2.270). (issue 64445)
• Fix race condition on authentication filters registration. (issue 64465)
• Dropped support for deprecated system properties: hudson.model.Hudson.logStartupPerformance, hudson.model.Hudson.initLogLevel, hudson.model.Hudson.parallelLoad, hudson.model.Hudson.killAfterLoad and hudson.model.Hudson.workspaceDirName. Please use jenkins.model.Jenkins.-prefixed SystemProperties. (pull 4962)
• Remove support for queue.txt format (replaced by XML in 2009). (pull 5123)
• Update Eclipse Jetty from 9.4.33.v20201020 to 9.4.35.v20201120 for bug fixes and enhancements. (pull 5122, Winstone 5.13 changelog, Jetty 9.4.34 changelog, Jetty 9.4.35 changelog)
• Remove administrative monitor offering to migrate $JENKINS_HOME on a ZFS filesystem. (pull 5047)
• Update the bundled XStream library from 1.4.14 to 1.4.15. (pull 5115, XStream 1.4.15 changelog)

What's new in 2.271 (2020-12-15)

• Stop bundling CVS plugin. Jenkins will no longer automatically install CVS plugin on startup if a plugin depending on Jenkins (then Hudson) 1.340 or earlier is discovered. If you use a plugin that relies on the functionality provided by CVS plugin and manage plugins outside the Jenkins plugin manager, you will now need to ensure yourself that a recent release of CVS plugin is installed. Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. (pull 5102)
• Don't tell users to signup if they can't. (issue 64426)
• Correct Freestyle font-size for descriptions. (issue 64332)
• FieldUtils now silently fails to set public final fields again. (issue 64390)
• The page variable divBasedFormLayout is globally available, not only within . (issue 64403)
• Remove unused jquery dependencies. (pull 5107)

What's new in 2.270 (2020-12-08)

• Massive performance enhancement to available plugins page of Plugin Manager. Exact matches of plugin name are moved to the top. (issue 64196)
• Fix incorrect striping of rows on available page of Plugin Manager. (issue 63684)
• Ensure that help text expands correctly for GitHub organization folders (regression in 2.264). (issue 64373)
• Replace slave with agent in Brazilian and Turkish localization of Agent to Controller security. (issue 62347)
• Add Traditional Chinese translation for description of built-in environment variables that are available to shell scripts. (issue 64329)
• Use correct unicode in Spanish translation and other fixes. (issue 64330)
• Developer: Update localizer plugin to allow threaded builds and localization from XML as well as properties. (issue 41729)

What's new in 2.269 (2020-12-01)

• Populate select fields with default values even when pre-populated select tags are used (regression in 2.244). (pull 5081, issue 64071, issue 64125)
• Reduce page load time by loading the administrative monitors popup on demand. Allow keyboard navigation even when there are active administrative monitors. (pull 5063)
• Improve pipeline startup performance with faster comparison method. Add equals and hashCode to ParameterDefinition implementations. Equals works strictly for the same classes to preventing issues with extended classes. (pull 5014)
• Remove an unused FileSystemProvisioner framework. (pull 5048)
• Developer: Update Node.js version to latest LTS (14.15.1). (pull 5087)
• Internal: iconset library inlined into Jenkins core, developers using this should remove the dependency. (pull 5072)
• Internal: Remove JOnAS application server support. (pull 5076)

What's new in 2.268 (2020-11-24)

• Fix drag and drop with environment filter (regression in 2.264). (issue 64252)
• Update the bundled XStream library from 1.4.13 to 1.4.14. (pull 5074, XStream 1.4.14 changelog)

What's new in 2.267 (2020-11-17)

• Add the ability to specify a reason for quieting down Jenkins ("Prepare for shutdown"). (issue 1877)
• Show security and non-security notifications in separate categories with their associated icons. (issue 63977)

What's new in 2.266 (2020-11-10)

• Fix hidden page elements from radio blocks appearing when they should not. (issue 64040)
• Upgrade from Remoting 4.5 to Remoting 4.6 with bugfixes and dependency updates. (pull 5043, Remoting 4.6 changelog)
• Make the Maven Configuration of Global Tools compatible with configuration as code plugin. (issue 62446)
• Minor English cleanup for resource root URL setting. (issue 41891)
• Developer: Jenkins now uses an updated version of the XStream serialization library without custom patches. (pull 4944, JEP-227, Spring and XStream updates (breaking changes!) blog post)
• Developer: Jenkins now uses Spring Security rather than its predecessor, Acegi Security. Other bundled Spring libraries are also updated. (pull 4948, JEP-228, Spring and XStream updates (breaking changes!) blog post)
• Developer: Upgrade jQuery from 2.1.4 to 3.5.1. (pull 4929, jQuery older release notes (3.1.1, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1), jQuery 3.5.0 release notes, jQuery 3.5.1 release notes)
• Developer: Remove the deprecated zeroclipboard UI component and the unused dependency on ZeroClipboard. (pull 5042)
• Developer: Remove obsolete support for live class reloading with JRebel. (issue 64037)
• Internal: Modernize the hashing function of ConsistentHash. (issue 60563)

What's new in 2.265 (2020-11-03)

• Improve performance of authorisation strategies when the authentication realm is case insensitive. (issue 64039)
• French translation for the token paragraph in user configuration and the root breadcrumb ("Dashboard"). (pull 5009)
• Fix file handle leak when viewing corrupted build logs. (issue 62985)
• Fix redirects when renaming jobs with spaces or non-latin characters. (issue 63899)
• Developer: Deprecate UnbufferedBase64InputStream. (pull 5039)
• Developer: Added better parsing overloads to XMLUtils. (pull 5026)
• Internal: Remove inline resources for LoadStatistics. (issue 60866)
• Internal: Correct the scope of the restriction on TokenUuidAndPlainValue. (pull 5041)

What's new in 2.264 (2020-10-27)

• Change Jenkins configuration UI from tables to divs for layout in forms. (issue 56109)
• Winstone 5.12: Update Jetty from 9.4.30.v20200611 to 9.4.33.v20201020. (issue 64035, Winstone 5.12 changelog, Jetty 9.4.31.v20200723 changelog, Jetty 9.4.32.v20200930 changelog, Jetty 9.4.33.v20201020 changelog)
• Cleanup "esclave" references and fix terminology for jobs in the French localization. (pull 4985)
• Change the standard URL for obtaining the Inbound Agent configuration file from ${agent_url}/slave-agent.jnlp to ${agent_url}/jenkins-agent.jnlp. The old name is obsolete and will be removed at a future time. (issue 35452)
• Prevent the Build History Widget from crashing when users have Discover permissions without Read for folders. (issue 63868)

What's new in 2.263 (2020-10-20)

• Downgrade Jetty to 9.4.30.v20200611 to prevent a wrong port from appearing in URLs (regression in 2.261). (issue 63958, Winstone 5.11.1 changelog, Root cause in Jetty)
• Remove TFS Plugin suggestion from Setup Wizard. (pull 5016)
• Optimize memory allocations in TcpAgentListener, LogRotator and RunList. (pull 5011, pull 5012)
• Add missing French localization for the login page, setup wizard and the main page. (pull 4995, pull 4996, pull 4997)
• Clarify the list separator in file excludes fields. (issue 49523)
• Do not use null value for aria-hidden HTML attributes. (pull 4919)
• Prevent resource leak in the File Fingerprint Storage implementation. (pull 4992)

What's new in 2.262 (2020-10-15)

• Stop showing JavaScript in the footer (regression in 2.261). (issue 63798)
• Restore reporting of ClassNotFoundException stacktraces in AntClassLoader and ClassicPluginStrategy due to the regressions for some agent types (regression in 2.261). (issue 63937)
• Developer: Update ArtifactArchiver to no longer consult with environment variables injected by EnvironmentContributingAction added during the build, including ArtifactManager ones. (pull 4933)

What's new in 2.261 (2020-10-13)

• Fix docker build agent provisioning (regression in 2.259-260). (issue 63828)
• Fix extensions footer location (regression in 2.230). (issue 63798)
• Introduce LowResourceMonitor from Jetty by upgrading to Winstone 5.11. Bump jetty.version from 9.4.30.v20200611 to 9.4.32.v20200930. (pull 4975, Winstone 5.11 changelog, Jetty 9.4.31.v20200723 changelog, Jetty 9.4.32.v20200930 changelog)
• SSHD module 2.7: Remove deprecated key exchange and MAC algorithms. (pull 4951, SSHD module 2.7 changelog)
• SSHD module 2.7: Allow configuring disabled key exchange and MAC algorithms through system properties. (pull 4951, SSHD module 2.7 changelog)
• Reduce memory consumption when loading classes from plugins. (pull 4957)
• Do not render parts of a serialized ConsoleNote in truncated log output. (pull 4905)
• Replace "slave" reference with "agent" in Traditional Chinese translation. (issue 62347)
• Use 'Agent to controller' to describe agent access control system rather than 'agent to master'. (issue 63905)
• Hide description panel in sidebar if historyWidget.descriptionLimit is 0. (pull 4978)
• Developer: Pluggable Artifact Storage: Make the VirtualFile API generally available to plugin developers. (pull 4974, JEP-202)
• Developer: Allow omitting ClassNotFoundException in AntClassLoader and ClassicPluginStrategy. (pull 4957)
• Internal: Update slf4j-api from 1.7.26 to 1.7.30. (pull 4988, SLF4J changelog)
• Internal: Update parent pom. Updates various maven plugins and developer tools. (pull 4982, Parent pom 1.58 changelog)

What's new in 2.260 (2020-10-06)

• Fix docker build agent provisioning (regression in 2.259). (issue 63828)
• Improve the scripting capacity related to the API Token system. Provide a way to configure a fixed/default API Token for admin during installation phase. (issue 57484)
• Allow users with the Jenkins.MANAGE permission to restart and safe restart Jenkins. (issue 63795)
• Disable autocomplete of username on login form. (pull 4952)
• Internal: Update bundled version of Apache Ant from 1.10.8 to 1.10.9. (pull 4958)

What's new in 2.259 (2020-09-29)

• Show display names in change list again (regression in 2.243). (issue 63712)
• Update the bundled version of Script Security Plugin from 1.73 to 1.75. (pull 4947)
• Update the bundled version of Display URL API plugin from 2.0 to 2.3.1. (pull 4948)
• Developer: Cloud implementations are given more context about ongoing planned nodes. Add CloudState to be passed to Cloud#provision and Cloud#canProvision methods. (pull 4922)
• Developer: Provide WebAppMain#getDefaultRingBufferSize method for use by telemetry. (issue 50669)
• Developer: Improve the combobox component to support default value and readonly mode. (pull 4939)

What's new in 2.258 (2020-09-22)

• Migrate the view status filter from views in previous Jenkins releases (regression in 2.240). (issue 62661)
• Improve the layout and clarity of the page displayed when jobs are not yet created. (issue 63592)
• Update the bundled Mailer plugin from 1.21 to 1.32.1. (pull 4938)
• Prevent radio buttons from moving when they are clicked. (issue 63332)
• Developer: A SimpleBuildStep or SimpleBuildWrapper can now choose not to require a workspace context (working directory and launcher). (issue 46175)
• Developer: PluginServletFilter is now final, making it impossible for plugins to mistakenly define their own. (issue 63682)

What's new in 2.257 (2020-09-15)

• Name the first breadcrumb "Dashboard" for clarity. (issue 60972)
• Make sure Environments are always torn down in AbstractBuild. (issue 43889)
• Developer: New static utility method Result#combine(Result,Result) to get the worst of two (nullable) build results. (issue 43889)

What's new in 2.256 (2020-09-08)

• Avoid warning on logs about Anonymous Class in hudson.FilePath. (issue 63563)

What's new in 2.255 (2020-08-31)

• Developer: Ignore flaky UpdateCenter2Test.install test. (pull 4916)

What's new in 2.254 (2020-08-25)

• Stop pre-formatting agent logs to prevent deadlocks (regression in 2.231). (issue 63458)
• Graduate Overall/SystemRead permission to general availability (GA) status. (pull 4909, JEP-224)
• Set Cross-Origin-Opener-Policy to same-origin. (pull 4910)
• Avoid losing work in progress by using a new browser tab to open the plugin link in a configuration screen’s inline help. (issue 63429)
• Developer: Remove the unused description attribute from f:dropdownList. (issue 63220)

What's new in 2.253 (2020-08-18)

• Major update of the Alpine-based Jenkins Docker image. Jenkins Docker image for Alpine now uses Alpine 3.12 and AdoptOpenJDK 8u262. (LTS upgrade guide)
• Fix button that copies API token to clipboard (regression in 2.238). (issue 63274)
• Fix a deadlock in agent logging. (issue 63082)
• Fix Cmd + Enter not running the script in the Script Console on a Mac (regression in 2.248). (issue 63342)
• Fix backspace key sometimes did not delete text from the Script Console on a Mac (regression in 2.248). (issue 63342)
• Fix regular expression validator UI location (regression in 2.244). (issue 63308)
• Make alert colors consistent with 'Manage Jenkins' alert colors. (issue 63330)
• Add Japanese translations for user configuration screen. (pull 4904)
• Prevent concurrent build deletion. (issue 61687)
• Developer: Make unavailable plugin background themeable. (issue 63331)
• Developer: Expose fingerprint range set serialization methods for plugins. (pull 4888)
• Internal: Remove some text messages from Jenkins core which had already been moved to the LDAP and PAM Authentication plugins. Be sure to upgrade to LDAP 1.22 or newer and PAM Authentication 1.5 or newer. (pull 4866)
• Internal: Remove deprecated and unused ProcessTreeKiller class. (pull 4874)
• Internal: Exclude JUnit and Hamcrest libraries from the jenkins.war bundle. (issue 63269)

What's new in 2.252 (2020-08-12)

• Important security fixes. (security advisory)

What's new in 2.251 (2020-08-04)

• Restore wrapping tabs into multiple lines instead of overflowing (regression in 2.248). (issue 63180)
• Show build time data in the Build Time Trend Page (regression in 2.245). (issue 63232)
• Normalize widget colors to be consistent with the new color palette. (Fixes bread crumbs flash in Dark Theme)
• Empty installed plugins table text is readable again (regression in 2.249). (issue 63276)
• Replace text references to slave with agent in Japanese documentation and messages. (issue 63166)
• Prevent JavaScript error when registering validators in some cases. (issue 42228)
• Do not block rendering of Manage Jenkins while waiting for update center data. (pull 4881)
• Developer: Allow migration of fingerprints from local storage to external storage. (issue 62757)

What's new in 2.250 (2020-07-28)

• Internal: Fix UsageStatisticsTest failure in java.vendor vs. java.vm.vendor. (pull 4879)

What's new in 2.249 (2020-07-24)

• Do not throw exceptions when building environment for certain build steps (regression in 2.248). In particular, the Powershell step from the Powershell plugin was affected. (issue 63168)
• Align the Plugin Manager table headers. (pull 4858)
• Fix an issue where the header of certain elements such as the authorization matrix would have wrong styles. (pull 4861)

What's new in 2.248 (2020-07-21)

• Stop supporting .NET Framework 2.0 for launching Jenkins server and agents as a Windows service. .NET Framework 4.0 or above is now required. (announcement, upgrade guidelines, issue 60005, issue 61862, Windows support policy)
• Update Windows Service Wrapper (WinSW) from 2.3.0 executable for .NET Framework 2.0 to 2.9.0 for .NET Framework 4.0. Includes numerous improvements and bugfixes. Most notably, the service installer will now ask for permission elevation if the required. (changes summary, full WinSW changelog, Windows Agent Installer 2.0 changelog)
• Reorder configuration and delete buttons in the left sidepanel. (pull 4852)
• Add the ability to filter out environment variables for Shell and Windows batch build steps. (issue 62014)
• Revamp the tabs and tables with better spacing and a consistent color palette. (issue 63002)
• Remove page generation timestamp from the footer. (issue 61806)
• Add sorting to Old Data management tables. (issue 25259)
• Allow fingerprint storage engine to be selected from the configuration page. (issue 63022, JEP-226)
• Show warnings for deprecated plugins in the update manager and administrative monitors. (issue 59136)
• Update Jenkins form styling in preparation for changing form layout. (issue 56109, Configuration UI Accessibility: Tables to Divs migration)
• Show hints about the current time on the server’s zone when configuring your User Defined Time Zone. (issue 61806)
• Fix IllegalArgumentException: Method not found error caused by misbehaviour in Util.isOverridden() (regression in 2.241). (issue 62723)
• Avoid a stack trace when an older version of glibc was used by an agent. (pull 4830)
• Remove the fallback Jenkins URL from the JNLP launch file so that WebSocket agents can be connected over Java Web Start. (issue 63014)
• Fix the default domain name in Windows service serviceaccount configurations. (issue 12660, Windows Service Wrapper 2.7.0 changelog)
• Developer: Add new extension points to define build step environment filters (currently in beta). (issue 62014)
• Developer: Add theming support for alert-* classes. (Dark Theme repository)
• Developer: Add alert-success banner. (issue 62747)
• Developer: Allow theming the text area handle. (Dark Theme repository)
• Developer: Require FingerprintStorage descriptors so they can be configured from the configuration page. (issue 63022)
• Developer: Remove method BeanBuilder.loadBeans(String). (pull 4838)
• Internal: Allow JUnit 5 tests in the Jenkins core unit tests. Jenkins Test Harness-based integration tests still require JUnit 4. (pull 4699)
• Internal: Use built-in WinSW features for permission elevation and strong cryptography. (pull 4823, Windows Agent Installer 2.0 changelog)
• Internal: Upgrade to Remoting 4.5. This switches agent.jar and remoting.jar to a code-signing certificate owned by the CDF. (pull 4832, Remoting 4.4 changelog, Remoting 4.5 changelog)
• Internal: Remove inline resources from layouts. (issue 60866)
• Internal: Document the Jenkins core issue triage guidelines. (documentation)

What's new in 2.247 (2020-07-21)

No notable changes in this release.

What's new in 2.246 (2020-07-21)

No notable changes in this release.

What's new in 2.245 (2020-07-15)

• Important security fixes. (security advisory)

What's new in 2.244 (2020-07-07)

• Clean up more workspace related directories, e.g. @libs from Pipeline libraries. (issue 41805)
• Update Italian localization. (pull 4810)
• Internal: JavaScript refactoring in preparation for form layout modernization. (issue 56109)
• Developer: Extend the DownloadService.Downloadable API to make it easier to work with default IDs. (issue 62572)
• Developer: Introduce an API to check ParameterDefinition validity. (issue 62889)
• Developer: Make WorkspaceList.COMBINATOR accessible to plugins. (issue 41805)

What's new in 2.243 (2020-06-30)

• Update the styles for the links on the management page. (pull 4782)
• Restyle and improve accessibility for the RSS feed bar. (issue 62750)
• Winstone 5.10: Add --httpsRedirectHttp option that activates automatic HTTP request redirects to HTTPs. (pull 4811)
• Winstone 5.10: Update Jetty from 9.4.27.v20200227 to 9.4.30.v20200611. (pull 4811, 9.4.28.v20200408 changelog, 9.4.29.v20200521 changelog, 9.4.30.v20200611 changelog)
• Winstone 5.10: Fix --httpKeepAliveTimeout option which had no effect (regression in 2.224). (issue 61823)
• Shutdown gracefully when SCM triggers are configured. (issue 62695)
• Developer: Allow f:repeatableHeteroProperty to pick up field attribute from enclosing f:entry. (pull 4807)
• Developer: Switch to id from fullName in User.toString(). (issue 62688)
• Developer: auto-completion for labels is now available via LabelExpression.autoComplete(). Deprecate hudson.model.AbstractProject.LabelValidator in favour of jenkins.model.labels.LabelValidator. but the old version also has a new checkItem() method to allow it to validate non-Project items. Deprecate hudson.model.AbstractProject.DescriptorImpl.validateLabelExpression() in favour of LabelExpression.validate() (which takes any kind of Item object instead of only AbstractProjects). Aggregates all warnings and errors reported by LabelValidator (old and new). (issue 26097)

What's new in 2.242 (2020-06-23)

• Do not log exceptions when browsing to the plugin manager while private source plugins are installed (regression in 2.240). (issue 62622)
• Remove white background of 'Keep this build forever' when using dark theme. (pull 4814, Dark theme plugin)
• Restyle hyperlinks to make them look more modern and readable. (issue 62698)
• Update the Japanese messages for the scheduler on the setting page. (pull 4783)
• Fix IllegalArgumentException for Choice Parameter when saving job configuration. (issue 61438, Stapler 1.260 changelog)
• Correctly encode control and surrogate characters when exporting data to JSON. (pull 4813, Stapler 1.260 changelog)
• Replace esclave with agent in French documentation. (issue 62714)
• Developer: Add experimental External Fingerprint Storage API. (issue 62345, pull 4731, JEP-226, Reference Implementation)
• Developer: Introduce new Fingerprint API methods: Fingerprint#getPersistedFacets(), Fingerprint#delete(String) and file-independent CRUD methods. Deprecate Fingerprint#save(File). (issue 62345, pull 4731, Fingerprint API Javadoc)

What's new in 2.241 (2020-06-16)

• Restore colors on the Job configuration page, help page, and other controls (regression in 2.239). (pull 4781)
• Convert arrow icons from images to CSS. (issue 62496)
• Restyle side panel widgets to have a more modern look & feel. (issue 62175)
• Developer: Plugins can now more easily add support for using build steps in pipelines with access to the appropriate environment variables (such as from tools/environment blocks or steps like withEnv). The fingerprint and archiveArtifacts pipeline steps will no longer apply any environment substitution. (issue 29144)

What's new in 2.240 (2020-06-08)

• Make RSS field and agent disconnected images transparent for dark theme. (pull 4772)
• Show in plugin manager when newer releases of plugins exist but aren't being offered due to unsatisfied requirements. (issue 62332)
• Add support for Dark Theme in the login screen. (issue 62515, pull 4763, Dark Theme repository)
• Update bundled Script Security Plugin from 1.71 to 1.73. (pull 4769)
• Restore background colors on new item and job config pages. (pull 4771)
• Fix buttons lingering for a bit after closing modal (regression in 2.233). (pull 4770)
• Display correct time in the Build History Widget when a custom timezone is set in the user profile. (issue 61972)
• Internal: Remove inline resources for non-standard showDetails. (issue 60866)

What's new in 2.239 (2020-06-03)

• Release 'alpha' dark theme. (issue 60924, pull 4752, Dark Theme repository)
• Fix markup previews for disabled textareas shown to users with extended read permission. (issue 62433)
• Prevent side panel shrinking in specific resolutions (~1000px), regression in 2.238. (pull 4755)
• Make the CLI link in Manage Jenkins visible to users with Overall/SystemRead permission. (pull 4739)
• Improve accessibility by adding aria-labels for username and password fields in login forms. (issue 62421)
• Implement the read-only mode in Expandable Text Box configuration form elements. (issue 62434)
• Performance: Reduce number of calls and iterations through the list of jobs when displaying List Views. (issue 20052)
• Remove Subversion Plugin from suggested plugins in the setup wizard. (issue 62477)
• Fingerprints browser: Move fingerprint link into existing fingerprint artifact text. (issue 62470)
• Allow users with Overall/Manage permission to configure Node Monitoring. (issue 62264)
• Developer: Add support for CSS variables, useful in themes. (issue 60924, pull 4752, Dark Theme repository)
• Internal: Print stack trace from the originating thread if SlaveComputer#_connect fails. (pull 4754)
• Developer: Add source maps for CSS and JavaScript. (issue 62473)

What's new in 2.238 (2020-05-25)

• Fix a deadlock involving custom loggers during agent startup (regression in 2.231). (issue 62181)
• Support Bearer tokens in Jenkins-CLI -auth parameter. (pull 4673)
• Add system read support for 'Node Monitoring Configuration' and configuring clouds. (issue 61206)
• Add Agent/ExtendedRead support for viewing agent configuration, system information, and logs. (issue 61206)
• Fix a thread safety issue in Computer#getLogDir. (pull 4730)
• Revamp the sidebar task list with improved aesthetics and accessibility. (issue 61973)
• Allow users with Overall/Manage permissions to reload configuration from disk. (issue 61458)
• Developer: Add support for the permissions attribute to task.jelly. (issue 61206)
• Developer: Add hasAnyPermissions API to Functions to allow it to be called by views. (issue 61206)
• Developer: Add non-deprecated Jenkins core library dependencies to the BOM. (pull 4702)

What's new in 2.237 (2020-05-18)

• Prevent telemetry warnings about missing javax.annotation classes when running with Java 11 (regression in 2.231). (issue 61920)
• Prevent Old Data Monitor from failing plugin loading in the case of class field unmarshalling issues. (issue 62231)
• Ensure that UserLanguages telemetry initializer always runs after extensions are augmented. (issue 60118)
• Update Apache Ant from 1.10.7 to 1.10.8. (pull 4725)
• Internal: Update the JSTL API library from 1.2.1 to 1.2.7. (pull 4656, Changelog up to 1.2.5, Diff of 1.2.3 to 1.2.7, Diff of 1.2.1 to 1.2.3)
• Developer: Ensure that job/folder creation routines properly check the requested name for invalid characters. (issue 61956)
• Developer: Deprecate jenkins.model.Configuration in the Java API. (pull 4715)

What's new in 2.236 (2020-05-11)

• Make plugin manager work on Internet Explorer 11 again (regression in 2.231). (issue 62163)
• Security hardening: Always round-trip password form control values in an encrypted form, even if not backed by an encrypted Secret field. In case of problems, this can be disabled by setting the system property hudson.util.Secret.AUTO_ENCRYPT_PASSWORD_CONTROL to false on startup. (issue 61808)
• Security hardening: Always use a placeholder value for password form control values in item related configuration forms when the user is missing Item/Configure permission, even if not backed by an encrypted Secret field. In case of problems, this can be disabled by setting the system property hudson.util.Secret.BLANK_NONSECRET_PASSWORD_FIELDS_WITHOUT_ITEM_CONFIGURE to false. (issue 61808)
• Developer: Make the SystemProperties API available to plugins so that their properties could be managed by a standard engine. (pull 4707, Javadoc System Properties, Jenkins Features Controlled with System Properties)

What's new in 2.235 (2020-05-04)

• Prevent a form validation "404 Not Found" error when the resource root URL configuration points at a previously configured resource root URL (regression in 2.205). (issue 62133)
• Make Breadcrumbs displayed after notification alerts clickable again. (issue 62065)
• Allow system read to view more admin monitors. (issue 61208)
• Limit the number of exceptions thrown by some operations such as recursive directory deletion. Previously, in rare cases, exceptions thrown when failing to delete large directories could consume significant amounts of memory. (issue 61841)
• Indicate which component provides an URL that is always available without authentication in the global security configuration. (pull 4668)
• Fix a classloading issue while executing ProcessTree.get(). (issue 62006)
• Developer: Make it possible to look up extension implementations from more than one specific extension point at a time. (issue 62056)
• Developer: Add nogrid option to layout.jelly tag to allow suppressing the bootstrap 3 grid. See bootstrap4-api-plugin for details. (issue 61326)
• Developer: Update javax.mail to jakarta.mail 1.6.5. (pull 4660)
• Internal: Remove inline resources from ReverseProxySetupMonitor view. Add a specific warning when the Jenkins Root URL does not contain the contextPath. (issue 60866)
• Internal: Remove inline resources from LogRecorder views. Align the column headers of bigtables to the left (issue 60866)

What's new in 2.234 (2020-04-27)

• Fix sort order in "Available" tab of the plugin manager (regression in 2.233). (pull 4675)
• Fix a regression where the dropdown of the autocomplete widget would not be rendered correctly (regression in 2.233). (issue 62001)
• Restyle the help icon. (pull 4663)
• Allow users with system read permission to view the system logs. (issue 61207)
• Reword "Continue as admin" button of the plugin setup wizard. (issue 46669)
• The default number of executors for an agent created programmatically (or as-code) is now 1 rather than 2. (pull 4677)
• Session hijacking protection hardening. (issue 61738)
• Distinguish between defined (*****) and undefined (N/A) password on read-only configuration forms for users with Overall/SystemRead or Item/ExtendedRead permissions. (issue 61812)
• Developer: Remove unused deprecated HudsonExceptionNote. (pull 4667)

What's new in 2.233 (2020-04-20)

• Allow linking to plugin manager URLs with pre-filled filter field. Link labels in the plugin manager to pre-filtered lists. (pull 4591)
• Add system read support to admin monitors. (issue 61208)
• Allow users with system read permission to view the global tool configuration. (pull 4519)
• Sort plugins by popularity on the "Available" plugin manager tab if the update site provides popularity data. (pull 4588)
• Restyle buttons. Add support for large buttons, hyperlinks styled as buttons and icon-only buttons. (issue 61840)
• Forward Groovy view permission errors to login. Some views showed an error screen instead of forwarding to the login form when necessary permissions were missing. (issue 61905)

What's new in 2.232 (2020-04-16)

• Fix input field hints for tools like the git plugin that search the PATH for their executable (regression in 2.205 and 2.222.1). (issue 61711)
• Internal: Remove inline resources from Job views. (issue 60866)
• Internal: Introduce a new Jenkins core maintainer guide. (pull 4472)

What's new in 2.231 (2020-04-14)

• Add section headers to context menu of Manage Jenkins. (pull 4586)
• Improve the view shown when there are no jobs. (pull 4633)
• Configuration as code plugin support for configuring user timezones. (pull 4557)
• By default suppress log message about a missing optional extension. (pull 4617)
• Don't show all available plugins by default; use search field to find plugins. (pull 4580)
• Allow use of multiple space-separated filter terms in plugin manager. (pull 4580)
• Allow users with system read permission to view the Manage Plugins configuration. (issue 61203)
• Add support for serving file parameter values from the resource root URL, if set. (pull 4614)
• Set httpOnly header on cookie for iconSize storage. (pull 4609)
• Fix spacing between error messages in Setup Wizard (regression in 2.217). (issue 61660)
• Ensure that log messages are not missing numeric parameters when log entries are created on an agent. In particular, fix logs collected by the Support Core plugin. (pull 4621)
• Ensure that encoded console annotations are stripped from system logger messages. (pull 4632)
• Update crypto-util from 1.1 to 1.5 to fix the license link in Jenkins Web UI. (pull 4631)
• Developer: Switch bug detection annotations from JSR-305 to SpotBugs / net.jcp equivalents. (pull 4604)
• Developer: Upgrade commons-codec to 1.14. (pull 4636)

What's new in 2.230 (2020-04-06)

• Improve styling of alert banners to be more visually appealing and to better match existing user interface components. Alerts now fully cover the navigation bar while they are displayed instead of covering only a portion of the navigation bar. (issue 61478)
• Do not show disabled permissions in permission errors when checking for any of several permissions. (issue 61467)
• Allow hyperlinks to be used when displaying causes of blockage related to labels rather than individual nodes. (pull 4616)
• Add option to configure follow symlinks when archiving artifacts. (issue 5597)
• Prepare for Shutdown management link is now accessible to users with Overall/Manage permission in addition to the usual Overall/Administer. (issue 61453)
• Update footer styles. (issue 61496)
• Allow configuration-as-code plugin to disable admin monitors. (issue 56937)
• Update Groovy Init hooks to run after all job configurations are adapted. (issue 61694)
• Fix class cast exception in fingerprint cleanup thread. (issue 61479)

What's new in 2.229 (2020-03-29)

• Use the saved global build discarder configuration on restart. Jenkins 2.221 through 2.228 ignore the saved global build discarder configuration when they restart. (issue 61688)
• Fix proxy form validation when a password is set (regression in 2.205). (issue 61692)
• Update .NET version checks to be more correct for modern .NET versions. (pull 4554)
• About Jenkins management link is now accessible to users with Overall/Manage or Overall/SystemRead (as well as the usual Overal/Administer). (issue 61455)
• Robustness: Don't throw a NullPointerException when trying to convert null to Secret. (pull 4608)
• Upgrade to Remoting 4.3 to fix an issue with large payloads over WebSockets. Requires a matching agent.jar with remoting 4.3 or later. (pull 4601, pull 4596, issue 61409, Remoting 4.3 changelog, WebSockets blog post, JEP-222)
• Developer: Create symlinks atomically and log warning on failure. (issue 56643)
• Developer: Secret and ConfidentialKey implementations can now be used from unit tests without JenkinsRule. (pull 4603)

What's new in 2.228 (2020-03-25)

• Important security fixes. (security advisory)
• Security hardening related to request routing and CSRF protection. (related upgrade guide)

What's new in 2.227 (2020-03-22)

• System Information management link is now accessible to users with Overall/Manage, showing only plugins and memory usage information. (issue 61456)
• Limit max width of Manage Jenkins entries on very large screens. (pull 4582)
• Usage Statistics in Global Configuration is now configurable by users with Overall/Manage permission (as well as the usual Overal/Administer). (issue 61457)
• Make HTTP DELETE based item deletion behave more like an API, recommend it over POST /doDelete. (issue 61308)
• Increase scroll speed of context menus. (pull 4592)
• List plugins that failed to load on the Installed tab of the plugin manager. (pull 4589)
• Highlight in the plugin manager when plugins are looking for new maintainers ("Adopt this plugin"). (pull 4584)
• Developer: Add Javadoc for management link category definitions. (pull 4578)
• Internal: Permit core building using newer JDK than version 8. (issue 61105)

What's new in 2.226 (2020-03-15)

• Fix drag & drop for previously saved steps in the job configuration form (regression in 2.217). (issue 61429)
• Organize entries on the Manage Jenkins page into categories and show them in a grid. (pull 4546)
• Remove the unnecessary "monitor[s]" text next to the bell for a cleaner UI. Change the colors of the notifications next to the bell to make them more noticeable. (issue 61224)
• Allow usage statistics to be configured with the configuration-as-code plugin. (issue 54662)
• Allow ssh authorized keys to be configured with the configuration-as-code plugin. (pull 4563, ssh-cli-auth 1.8 changelog)
• Use modern system fonts provided by the browser when possible. Changes font size for body copy and headings to improve consistency and legibility. (issue 60921)
• Update bundled Script Security Plugin from 1.70 to 1.71. (pull 4561, Script security plugin 1.70 changelog, SECURITY-1754 sandbox bypass vulnerability)
• Show in plugin manager table when there are security issues in a currently installed plugin. (pull 4553)
• Add French translation for 'New View'. (issue 61424)
• Fix support of the default attribute in the Jelly enum form control. (issue 61385)
• Add ManagementLink#getCategory() for entries on Manage Jenkins to be grouped into category. See the ManagementLink.Category enum for supported return values. (pull 4546)
• Developer: Make h.checkAnyPermission and <l:layout permissions="…"> work on objects that aren't AccessControlled. (issue 61465)
• Document nullability of newInstanceFromRadioList() methods and callers. (pull 4543)
• Internal: Remove inline resources from restart views. (issue 60866)

What's new in 2.225 (2020-03-09)

• Don't lose SCM configuration when saving job (regression in 2.224). (issue 61398)

What's new in 2.224 (2020-03-08)

• Winstone 5.9: Fix propagation of the maximum form content size and form content keys number (regression in Jetty 9.4.20 and Jenkins 2.205). (pull 4542, issue 60409, Winstone 5.9 changelog)
• Winstone 5.9: Fix reverse improper proxy redirects to Host due to X-Forwarded-Host and X-Forwarded-Port ordering issue (regression in Jetty 9.4.20 and Jenkins 2.205). (pull 4542, issue 60199, Winstone 5.9 changelog, Jetty 9.4.27 changelog)
• Do not disable all controls on job configuration forms for some users with Job/Configure permission (regression in 2.223). (issue 61321)
• Show plugin release date in plugin manager. (pull 4535)
• Suppress error stack traces for non-administrator users as core capability. (issue 60410)
• Indicate when security issues would be addressed by an update in plugin manager. (issue 61166)
• Show plugin categories as labels in the plugin manager instead of grouping them into different table sections. (pull 4534)
• Prevent unhandled JSONException in DescriptorList#newInstanceFromRadioList() and ExtensionDescriptorList#newInstanceFromRadioList(). (issue 61345)
• Update size of the search box properly when screen is resized. (issue 61300)
• Remove grey bar below the textarea form elements for read only users. (issue 61284)
• Prevent NullPointerException when hitting "Check Now" against a custom update center without tool installer metadata. (issue 60788)
• Fix blank page on configure clouds page if no cloud plugin installed. (issue 61285)
• Update the descriptorRadioList form elements to honor DescriptorVisibilityFilter extension points. (issue 51495)
• Update the Version Number library from 1.6 to 1.7 to remove transient dependencies on FindBugs annotations. (issue 61279)

What's new in 2.223 (2020-03-01)

• Remove 'auto refresh' feature, including now obsolete auto refresh telemetry capability. (pull 4503)
• Allow users with system read permission to view the global security configuration page. (issue 61205)
• Allow users with system read permission to view the About Jenkins page. (issue 61201)
• Users with extended read permission now get a more read-only looking UI. (issue 61202)
• Prevent one occurrence of "Jenkins.instance is missing" (pull 4525, issue 55070, issue 59992, issue 60454, issue 61192)
• Reintroduce Build History description truncation by default. Allow managing/disabling the limit via the historyWidget.descriptionLimit system property. A negative value removes the limit, 0 forces empty descriptions. (pull 4529, issue 61004, issue 60299)
• Avoid a NullPointerException when starting a non-Pipeline build with a custom root directory set to a filesystem root (e.g., C:\). (issue 61197)
• Allow FingerprintFacet to block the deletion of fingerprint. (issue 28379)
• Internal: Remove unused class StringConverter2. (pull 4468)
• Internal: Remove unused internal class Memoizer - use ConcurrentHashMap. (pull 4470)
• Developer: Listen on loopback interface by default in debug mode. (pull 4515)

What's new in 2.222 (2020-02-23)

• Revamp the layout and icons of the header bar and breadcrumbs. Instances with plugins that depend on details of the Jenkins layout (e.g. Simple Theme Plugin) may experience UI/layout problems. A new experimental header color scheme can be enabled by setting the jenkins.ui.refresh system property to true. (issue 60920)
• Introduce a new experimental UI that can be enabled by setting the jenkins.ui.refresh system property to true. Currently it includes a new header color scheme, more changes to be added as a part of the UI/UX revamp. (pull 4463, issue 60920, JEP-223, Jenkins UX SIG)
• Add a new experimental Overall/Manage permission which allows a user to configure parts of the global Jenkins configuration without having the Overall/Administer permission. This is an experimental feature, disabled by default, that can be enabled by setting the jenkins.security.ManagePermission system property to true. (pull 4501, issue 60266, JEP-223)
• Add a new experimental Overall/SystemRead permission, which gives (almost) full read access to the Jenkins instance. The permission is disabled by default, install the Extended Read Permission plugin to activate it. (pull 4506, issue 12548, JEP-224, Extended Read Permission plugin)
• Deprecate the Overall/RunScripts, Overall/UploadPlugins, and Overall/ConfigureUpdateCenter permissions. Permissions were announced as dangerous and disabled by default in major authorization plugins in 2017. Custom authorization strategy implementations that grant Overall/Administer without implying one or more of these three permissions will no longer work as expected. Configurations that grant any of these permissions to users without Overall/Administer will no longer work as expected. (pull 4365, issue 60266, JEP-223, 2017-04-10 security advisory for Matrix Authorization plugin, 2017-04-10 security advisory for Role-Based Authorization plugin)
• Remove the ability to have CSRF protection disabled. Instances upgrading from older versions of Jenkins will have CSRF protection enabled and the default issuer set if they currently have it disabled. (pull 4509)
• Order Admin Monitors in Global Configuration page. (issue 60966)
• Add memory usage monitor to system information page. (pull 4499)
• Improve performance when loading tied jobs. (pull 4497)
• Fix issue with too many open files error when using resource domain. (issue 61121)
• Add french translation for concurrent build help. (pull 4505)
• Developer: Add new checkAnyPermission, hasAnyPermission methods that allow access if a user has one of the supplied permissions. (pull 4506, issue 12548, JEP-224)
• Developer: Add a new f:possibleReadOnlyField jelly tag, wraps fields in an if readonly check and then outputs the result as text if the authenticated user only has read access. N/A is added if the field is empty. (pull 4506, issue 12548, JEP-224)
• Developer: Add a new l:hasAdministerOrManage jelly tag, hides the body of the tag if the user doesn't have Overall/Administer or Overall/Manage. (pull 4506, issue 12548, JEP-224)
• Developer: Allow plugins to force an update of an UpdateSite. (issue 61046)

What's new in 2.221 (2020-02-19)

• Add globally configured build discarders that delete old builds not marked as "keep forever" even if there is no, or a less aggressive, per-project build discarder configured, executed periodically and after a build finishes. (pull 4368)
• Jenkins will by default execute the configured per-project build discarder periodically even if no build is currently finishing. This may delete old builds of projects that got a more aggressive build discarder configuration since the last build was run. (pull 4368)
• Dynamically loading certain plugins could result in permission errors. (issue 61071)
• Update bundled Script Security Plugin from 1.68 to 1.70. (pull 4490)
• Do not show disabled permissions in permission errors. (pull 4482)
• Developer: Use correct alert box name in Javadoc description. (pull 4493)
• Developer: Introduce filtering overload to getAllItems(), allItems() and getItems(). (pull 4469)
• Developer: Add new extension point BackgroundBuildDiscarderStrategy to allow more flexible build discarding strategies for the global build discarder configuration. (pull 4368)
• Developer: Add findsecbugs plugin to spotbugs build plugin. (pull 4381)
• Internal: Remove inline resources from HudsonPrivateSecurityRealm views. (issue 60866)
• Internal: Changed exception presented when AtomicFileWriter fails to write to file. (pull 3989)

What's new in 2.220 (2020-02-09)

• Fix agent installation as a service on Windows (regression in 2.217). (issue 60926, Remoting 4.2 changelog, Agent Installer Module 1.7 changelog)
• Fix NullPointerException when getting a list of runs with a status threshold (regression in 2.202). (issue 60884)
• Remove network discovery services (UDP and DNS). Users of the Self-Organizing Swarm Modules plugin should update the plugin and its CLI client to 3.18. (issue 60913, Self-Organizing Swarm Modules Plugin 3.18 changelog)
• Extends the current milestones so plugins can update jobs and configuration during Jenkins initialization. Adds initialization milestones: SYSTEM_CONFIG_LOADED, SYSTEM_CONFIG_ADAPTED, JOB_CONFIG_ADAPTED. (issue 51856)
• Export the plugin compatibility flag in Update Site REST API. (pull 4385)
• Suggest Jenkins Configuration as Code plugin in the installation wizard. (pull 4410)
• Do not record the user creating an agent in some circumstances. (issue 21837)
• Avoid logging node monitoring exceptions caused by node deletion. (issue 54496)
• Improve RSS feed titles. (issue 60848)
• Display build duration as tooltip to build date/time in the job's build history. (pull 4453)
• Improve performance of List Views when listing items. (pull 4462)
• Improve performance of artifact archiving when using jenkins.model.StandardArtifactManager.disableTrafficCompression=true. (issue 60907)
• Prevent creation of duplicated SetupWizard singleton instances on Jenkins startup. (issue 60867)
• Fix IndexOutOfBounds exception in ChoiceParameterDefinition.getDefaultParameterValue. (issue 60721)
• Update Plugin manager pages to show icons while Jenkins is restarting. (issue 59486)

What's new in 2.219 (2020-01-29)

• Important security fixes. (security advisory)
• Security hardening related to Stapler routing.
• Security hardening: Set X-Content-Type-Options to nosniff in REST API responses.

What's new in 2.218 (2020-01-27)

• Winstone 5.8: Fix a KeyStores with multiple certificates are not supported error from Jetty when passing certain kinds of certificates, such as domain wildcards (regression in 2.217) (issue 60857, Winstone 5.8 release notes - regression in 5.6)
• Winstone 5.7: Fix support of system logging customization (regression in 2.177) (issue 57888, Winstone 5.7 release notes)
• Add the boolean disabled flag to applicable jobs' REST API output for classic project types like Freestyle, Maven, or Multi-configuration (Matrix). (pull 4436)
• Internal: Winstone 5.7: Change the Jetty thread pool name to "Jetty (winstone)" (pull 4452, issue 60821, Winstone 5.7 release notes)

What's new in 2.217 (2020-01-23)

• Fix localized versions to no longer report can't parse argument number: changelog.url (regression in 2.214). (issue 60822)
• Jenkins 2.212+ failed to load certain injected fields such as used by the Bitbucket Server Integration plugin. (issue 60816)
• Add experimental WebSocket support. (JEP-222, blog post)
• Upgrade Jetty from 9.4.22.v20191022 to 9.4.25.v20191220. (Jetty 9.4.23 release notes, Jetty 9.4.24 release notes, Jetty 9.4.25 release notes)
• Upgrade to Remoting 4.0. (Remoting 4.0 release notes)
• Prevent inaccurate warnings about missing classes on Java 11 triggered by JavaMelody when Monitoring Plugin is installed. (issue 60725)
• Fix java version check for AdoptOpenJDK 11. (issue 60678)
• Internal: frontend toolchain upgraded to use webpack. Enabled babel to transpile certain JS modules. (issue 60734)
• Developer: Update access-modifier to allow plugins to use suppressions (pull 4441)

What's new in 2.216 (2020-01-22)

• Build failed. Release bits were not deployed.

What's new in 2.215 (2020-01-19)

• If the Jenkins root URL has been configured by scripts prior to running the setup wizard, skip the location configuration panel even if selecting the option to skip creation of an admin user. (issue 60750)
• Prevent the RSS feed in Computer page from returning an error 404 (issue 60577)
• Include details in the system log when a build rotation fails. (issue 60716)

What's new in 2.214 (2020-01-11)

• Remove old, deprecated, unsupported agent protocols Inbound TCP Agent Protocol/1, Inbound TCP Agent Protocol/2, and Inbound TCP Agent Protocol/3. Update Remoting from 3.36 to 3.40 to remove unsupported protocols and minor maintenance improvements. (issue 60381, Remoting 3.40 release notes)
• Remove Enable Security checkbox in the Global Security configuration. (issue 40228)
• Clarify that build history does not include pipeline stages. (issue 59412)
• The environment variable WORKSPACE_TMP may now be used from (non-Pipeline) builds to access a temporary directory associated with the build workspace. (issue 60634)
• Internal: Add a method in EnvVars that extends TreeMap.putAll() functionality by filtering out the null values. (issue 59220)
• Internal: Allow usage of DescriptorVisibilityFilter to filter View properties on UI. (issue 60579)
• Fix null pointer exception in Agent API when the agent is offline (e.g. retrieving agent version or OS description). (issue 42658)
• Fix JavaScript error in Plugin Manager when optional dependency metadata cannot be retrieved. Improve wording in Plugin Manager UI. (issue 56152)
• Fix minor localization issues (escaping, incomplete entries, etc.). (pull 4420)
• Fix typos & spelling in Javadoc and WebUI. (pull 4418)

What's new in 2.213 (2020-01-06)

• Fix plugin class resource loading failures for plugins which include library JARs. At least the Script Security, Active Directory and Maven Integration plugins are known to be affected. (regression in 2.212) (issue 60641, issue 60644, issue 60648)

What's new in 2.212 (2020-01-05)

• Prevent Jenkins page rendering from being blocked when the update center data parsing is in progress. (issue 60625)
• Return error when invalid string is passed as a Run status CLI argument. (pull 4212)
• Fix an edge case of loading optional dependencies that cause Jenkins to blow up on startup. (pull 4393, pull 4417, issue 60449)
• Developer: Introduce new AntClassLoader.getUrl() method to prevent code duplication. (pull 4254)

What's new in 2.211 (2020-01-02)

• Make the queue/cancelItem REST API return meaningful result codes instead of a Error 404. (issue 60326)
• Remove unused commons-codec dependency from Jenkins CLI. (issue 60326)

What's new in 2.210 (2019-12-22)

• Resolve AtomicInteger and class-filter warnings in startup log. (issue 60513)
• User is no longer logged out when authenticating another user. (issue 59107)
• The text null could appear rather than blank text when rendering certain user-controlled strings. (issue 60554)
• Remove vulnerable Team Concert Plugin from setup wizard. (CSRF vulnerability, Credential enumeration vulnerability)
• Disable multiple deletion attempts if hudson.Util.maxFileDeletionRetries is zero. (issue 60351)

What's new in 2.209 (2019-12-15)

• improved stop button behavior in the executors widget of the classical GUI, to avoid accidentally interrupting the wrong job. (issue 59656)
• Fix spotbugs reported concurrency issue using an AtomicInteger in SCMDescriptor#generation. (pull 4337)

What's new in 2.208 (2019-12-09)

• Fix online example/documentation for File Access Rules. (pull 4383)
• Prevent Oops when Whitelisted Commands input is empty in 'Agent to Controller Access Control'. (issue 60278)
• Prevent 'zombie' executors on built-in node by removing one-off executors in Computer.removeExecutor. (issue 57304)

What's new in 2.207 (2019-12-01)

• Update bundled Script Security Plugin to 1.68. (pull 4367)
• Do not reload too early when Jenkins is behind a reverse proxy and is restarting. (issue 6798)

What's new in 2.206 (2019-11-24)

• Deprecate the macOS native installer packaging. (Jenkins macOS native installer deprecation)
• Open plugin and license links on a separate tab from Plugin Manager. (issue 60189)
• Set the HttpOnly flag for the page auto-refresh tokens. (pull 4363)
• Avoid exception when views are defined using job DSL. (issue 60092)
• Fix AtomicFileWriter performance issue on CephFS when creating an empty file. (issue 60167)
• Developer: ViewGroupMixIn#getPrimaryView() may return null, and needs to be checked by plugins depending on this version of weekly and beyond. It is an intermediate state until a default view is implemented. (issue 60092)
• Developer: Use junit5 for CLI tests. (pull 4220)

What's new in 2.205 (2019-11-17)

• Move cloud configuration from Configure System into its own configuration form on the Manage Nodes page. (pull 4339)
• Redesign password fields to prevent password auto-fill except for the login form. Reduce browsers offering to update stored passwords. Revert by setting the system property hudson.Functions.hidingPasswordFields to false. (pull 3991)
• Show agent error status on the dashboard as mouse over text. (issue 6722)
• Show a tooltip with the full link name when hovering over sidebar links. (issue 59508)
• Reduce logging level of run completion and update center polling events from INFO to FINEST. (pull 4345)
• Try to always execute flyweight tasks, such as the main builds for Pipeline or Matrix jobs, on the built-in node. (pull 3983)
• Update Winstone from 5.3 to 5.4 to update Jetty from 9.4.18 to 9.4.22. (full Winstone 5.4 changelog, Jetty 9.4.22 changelog, Jetty 9.4.21 changelog, Jetty 9.4.20 changelog, Jetty 9.4.19 changelog)
• Internal: Make ProxyConfiguration compatible with configuration-as-code plugin. Workaround on the configuration-as-code plugin side is no longer required. (issue 56553)
• Internal: Remove unused jenkins-slave.xml file template from core. Requires WMI Windows Agents plugin version 1.3.1 (Released Mar 14 2017) or newer. (pull 4330)
• Fix Uninstall column sorting in the Plugin Manager Install pane. (issue 59665)
• Fix build history table styling. (issue 59631)
• Prevent faulty subtask contributors from leaving builds running forever. (issue 59793)
• Internal: Remove unused remoting library from jenkins-cli.jar. (pull 4350)
• Developer: Switch from maven-jenkins-dev-plugin to upstream jetty-maven-plugin. (pull 4351)
• Disable HTTP TRACE to prevent security scanner complaints. The risk was significant with web browsers in 2003. Modern browsers forbid TRACE requests to prevent cross-site tracing (XST) attacks, so there is no real risk. (issue 60180)

What's new in 2.204 (2019-11-10)

• Plugin manager descriptions always link to the plugins site instead of the Jenkins wiki. (issue 59679)
• Increase the number of datapoints recorded for multistage time series graphs such as those used for load statistics. (pull 4341)
• Update Remoting from 3.35 to 3.36 to add new command line options "-help" and "-version". (Remoting release notes)
• Prevent coding errors in canTake() and canRun() implementations in NodeProperty and QueueTaskDispatcher extensions from hanging the queue. (issue 59886)

What's new in 2.203 (2019-11-05)

• Allow time zone to be set on a per-user basis. (issue 19887)
• Logging UI: Reorder sidepanel entries, add a note that "all log messages" will only include entries on level INFO and up. (pull 4305)
• Update the Plugin Manager Updates tab with more information about incompatible dependencies. (pull 4299)
• Build status balls on the build trend page now link to the respective build's console output. (issue 17459)
• Prevent permission problems when dynamically loading a plugin by making PluginManager#start() run as SYSTEM. (issue 59775)
• Properly handle user names containing : characters in resource root URL tokens. (issue 59859)
• Prevent NullPointerException when accessing the /logout without sending cookies. (issue 59904)
• Developer: Make some methods in ResourceDomainConfiguration accessible from plugins. (pull 4335)

What's new in 2.202 (2019-10-27)

• Revert changes in forms submission in Jenkins classic UI with Firefox have caused a regression on forms with "file" inputs. These were made to anticipate a bugfix in Firefox which has been backed out since. (regression in 2.173) (issue 58296, issue 53462, Firefox issue 1370630)
• Add telemetry on the use of the 'auto refresh' feature. (pull 3894)
• Add java.util.concurrent.ConcurrentLinkedDeque to the JEP-200 deserialization allowlist. (pull 4300)
• Developer: Introduce Run#getBuildsOverThreshold() method for getting runs above the desired execution result. (pull 4259)

What's new in 2.201 (2019-10-20)

• Resource URLs failed to serve files with nontrivial names due to encoding problems. (issue 59849)
• Fix presentation when localized headers span multiple lines in the setup wizard. (issue 59800)

What's new in 2.200 (2019-10-14)

• Add an option for a Resource Root URL through which Jenkins will serve user-generated static resources like workspace files or archived artifacts without the need for Content-Security-Policy headers. (issue 41891)
• Remove the ability to download update center metadata using the user's browser (deprecated since 2015). Jenkins will no longer inform about available updates without a connection to update sites. We recommend the use of a local mirror of our update sites, or a self-hosted update center like Juseppe in these situations. (pull 3970)
• Fix style of administrative monitors showing informational messages in the popup. (issue 59684)
• Add a missing "pressed" style for the Create Item button. (issue 34226)
• Fix labels to Atom feed links. (issue 48375)
• Developer: Add Functions#urlEncode(String) to ease encoding of URL query parameters from Jelly views. (pull 4278)
• Developer: TarOutputStream is now marked restricted so it is not used from plugins. (pull 4272)
• Internal: Various code cleanups. (issue 36720, pull 4248, pull 4258, pull 4260, pull 4256, pull 4257, pull 4261, pull 4267)

What's new in 2.199 (2019-10-06)

• Prevent calls to Jenkins#save persisting data before we have finished loading the in-memory model. This prevents possible corruption of the main Jenkins configuration. (issue 58993)
• Increase client-side keep-alive ping frequency on the HTTP-based CLI to prevent timeouts. (issue 59267)
• Reduce default soft-kill timeout from two minutes to five seconds so that builds that spawned other processes can finish more quickly. (issue 59152)
• Stop bundling Maven Plugin and Subversion Plugin with Jenkins. In very rare cases, this could result in problems when attempting to install plugins compatible with Jenkins before 1.310. The Jenkins project is currently not publishing any such plugins. (pull 4242)
• Remove plugins bundled only to promote their use, as they are not needed for compatibility with old plugins. Since Jenkins 2.0, the concept of plugins installed by default is replaced with the setup wizard. (pull 4040)
• Update bundled version of Script Security Plugin to 1.65. (pull 4245)
• Developer: ProcessTree#killAll no longer fails with NPE if proc argument is null. (pull 4232)
• Internal: hudson.util.ProcessTree.OSProcess#getEnvironmentVariables returned null when an error occurred even though it shouldn't. (issue 59580)

What's new in 2.198 (2019-09-29)

• Remove 100 character length limitation of build description in build history widget. (issue 19760, issue 31209)
• Update the minimum required Remoting client version to 3.14 to simplify the implementation. (pull 4208)
• Use different computer icon for temporary offline state. (issue 59283)
• Robustness: Do not allow users to resubmit requests using POST on URLs requiring a form submission, as that will fail anyway. (issue 59514)
• Better diagnostics in a failure message from Computer.getLogDir. (pull 4226)
• Update bundled versions of Ant, PAM Authentication, Mailer, and Script Security plugins for the rare cases they're installed from bundled versions. (pull 4230)
• Update commons-compress from 1.10 to 1.19. (pull 4221, changelog)
• Update jfreechart from 1.0.9 to 1.0.19 to pick-up recent improvements and bugfixes. (pull 4229, changelog)
• The lastCompletedBuild permalink was not being cached in the …/builds/permalinks file. (issue 56809)
• Developer: Add TcpSlaveAgentListener#getAdvertisedHost(). (pull 4227)

What's new in 2.197 (2019-09-25)

• Security fixes. (security advisory)

What's new in 2.196 (2019-09-22)

• Gzip compression when transferring artifacts being archived from agents to the controller can now be disabled by setting the system property jenkins.model.StandardArtifactManager.disableTrafficCompression=true. (issue 26008, Jenkins features controlled by system properties)
• Make log rotation more robust. (issue 58779)
• Fix malformed XML in Atom and RSS 2.0 feeds. (regression in 2.194) (issue 59231)
• URLs of some projects with emojis in their name were inaccessible. (issue 59406)

What's new in 2.195 (2019-09-16)

• The setup wizard sometimes was removed improperly, and Jenkins would only show a blank screen. (issue 59017)

What's new in 2.194 (2019-09-08)

• Fix missing absolute URL in the RSS / Atom feeds. (regression in 2.190) (issue 59167)
• Update Remoting from 3.33 to 3.35 to allow inbound TCP agents to connect directly without querying Jenkins via HTTP for connection parameters first. (issue 59094, issue 53461, full changelog)
• Update Windows Service Wrapper from 2.2.0 to 2.3.0 to pick up fixes and improvements. (pull 4167, WinSW changelog, Windows Agent Installer module 1.12 changelog)
• Internal: Update dom4j library from Jenkins project fork to upstream release 2.1.1. (issue 53322)
• Internal: Replaced different base64 implementations with java.util.Base64. (pull 4169)

What's new in 2.193 (2019-09-01)

• Downgrade Remoting from 3.34 to 3.33 due to problems involving tunneled connections. (regression in 2.191) (issue 59094)
• Jenkins UI broke when a slow trigger administrative warning would be shown. (regression in 2.189). (issue 58938)

What's new in 2.192 (2019-08-28)

• Important security fixes. (security advisory)

What's new in 2.191 (2019-08-25)

• Update Remoting from 3.33 to 3.34 to allow inbound TCP agents to connect directly without querying Jenkins via HTTP for connection parameters first. (issue 53461, full changelog)
• Multiple minor code cleanups and internal fixes. (pull 4131, pull 4162, pull 4163, issue 36720)
• Internal: Update Mockito from 2.22.0 to 3.0.0. (pull 4154)

What's new in 2.190 (2019-08-18)

• Add support of emojis and other non-UTF-8 characters in job names. 🎉 (issue 23349)
• RSS and Atom feeds did not contain all necessary metadata. (regression in 2.186) (issue 58595)
• Expose real environment variables from an agent on the UI. (issue 54772)
• Use SHA-256 instead of MD5 for generating crumbs/CSRF tokens. (issue 58734)
• Truncate long build names on the UI to prevent alignment issues. (issue 58157)
• Developer: AbstractItem#renameTo now checks #isNameEditable before renaming. (issue 58571)

What's new in 2.189 (2019-08-07)

• A file handle leak in $JENKINS_HOME/jobs/*/builds/permalinks could prevent jobs from being deleted on Windows. (regression in 2.185) (issue 58733)
• Remove extra whitespace output from /scriptText endpoint. (regression in 2.186) (issue 58548)
• The install-plugin CLI command allowed files that aren't plugins to be installed, potentially breaking some functionality. (issue 29065)
• Add a warning when cron trigger spends a long time in its execution. (issue 54854)
• Batch up plugin installations in setup wizard to improve performance. (pull 4124)
• Stop using the name argument in the install-plugin CLI command. (pull 4123)
• Update versions of some detached plugins. These are typically installed when upgrading Jenkins from much older releases, or when implied dependencies are not specified for manually managed plugins. (pull 4125)
• Internal: Add support running JMH benchmarks for Jenkins core. (pull 4135)
• Internal: Update Jenkins Test Harness from 2.49 to 2.54 to add support for JMH benchmarks. (pull 4135, changelog)
• Internal: Omit WEB-INF/lib/jquery-detached-1.2.jar from jenkins.war. (pull 4120)

What's new in 2.188 (2019-08-07)

No notable changes in this release.

What's new in 2.187 (2019-07-21)

• The default interval for node monitors (e.g. free disk space) can now be changed by setting the system property hudson.node_monitors.AbstractNodeMonitorDescriptor.periodMinutes. (pull 4105, Jenkins features controlled by system properties)
• Robustness: Do not fail to render views when AdministrativeMonitor#isActivated fails. (pull 4114)
• Internal: Update slf4j version from 1.7.25 to 1.7.26. (pull 4118)

What's new in 2.186 (2019-07-17)

• Important security fixes. (security advisory)
• Remove Trilead SSH dependencies from the Jenkins core. These dependencies caused SSH build agent connection issues in 2.185. (issue 58483)
• Upgrade SSH CLI Auth Module from 1.5 to 1.7 to remove Trilead SSH references. (pull 4111, issue 43669, changelog for 1.7, changelog for 1.6)

What's new in 2.185 (2019-07-14)

• Jenkins no longer creates symbolic links inside project or build directories. The Build Symlink plugin may be installed to restore this functionality if desired. URLs such as /job/…/lastStableBuild/ are not affected, only tools which directly access the $JENKINS_HOME filesystem. (issue 37862)
• Remove Trilead SSH library from Jenkins core and make it available in a new detached plugin. (issue 43610)
• Do not throw exception when testing proxy configuration. (regression in 2.168) (issue 57383)
• Prevent occasional IllegalStateException on Jenkins restart and invalidate the user session. (issue 55945)
• Avoid duplicate screenResolution cookie for views. (pull 4103)
• Due to a mixture of old and new “detached” plugins, under certain circumstances it was possible to have two versions of an extension point used by the command launcher option for agents. (issue 58362)
• Add a warning to the Installed tab of the plugin manager alerting administrators to possible problems from disabling detached plugins, which became possible as of 2.181. (pull 4098)
• Remove unnecessary delay during cloud agent provisioning if the agent is available very quickly. (issue 24752)
• Update commons-codec library from 1.9 to 1.12. (pull 4052, changelog)
• Developer: Plugin Compatibility Tester did not skip bundled plugin installation even if a *.jpl file exists. (issue 58362)

What's new in 2.184 (2019-07-07)

• Remove obsolete session cookies when logging out, preventing errors related to headers being too large. (issue 25046)
• Add telemetry trial related to missing classes when running on Java 11. (issue 57223)
• Fix performance issue when using "Remember me". (regression in 2.160) (issue 56243)
• Developer: Clean up constructors of AbstractCloudSlave. (pull 4086)

What's new in 2.183 (2019-06-30)

• Add support for IPv6 addresses in the Jenkins URL configuration. (issue 58041)
• Update args4j from 2.0.31 to 2.33. (issue 57959)
• Developer: Allow plugins to provide onBlur() handlers for CodeMirror textarea controls. (issue 58240)
• Developer: Make WindowsUtil available to plugins. (pull 4038)
• Internal: update maven-war-plugin from 3.0.0 to 3.2.3. (issue 47127)

What's new in 2.182 (2019-06-23)

• When deleting directories, remove the read-only flag on Windows. (issue 57855)
• Update Remoting from 3.29 to 3.33. (issue 57959, issue 50095, issue 57713, full changelog)

What's new in 2.181 (2019-06-16)

• The plugin manager UI no longer prevents disabling a plugin when other plugins only have optional dependencies to it. (issue 33843)
• A thread pool used to wait for external processes to complete could leak class loaders. (issue 57725)
• Robustness: Exceptions thrown while scheduling jobs in the queue could prevent other jobs from being scheduled. (issue 57805)
• Replace some exception stack traces related to agent channels with simpler messages. (issue 57993)
• Update JNA from 4.5.2 to 5.3.1 to fix issue with shared library loading on AIX when using OpenJDK. (issue 57515)
• Developer: Update ant dependency from 1.9.2 to 1.9.14. (pull 4053)
• Internal: Switch from FindBugs to SpotBugs for static analysis. (pull 4062)
• Internal: Mark hudson.model.UpdateSite#isDue as synchronized. (issue 57466)

What's new in 2.180 (2019-06-09)

• Remoting reverted to 3.29 because JNLP agents failed to connect cloud agents in certain situations. (regression in 2.176) (issue 57759, issue 57713)
• Improve Configuration-as-Code compatibility of ListView. (issue 57121)

What's new in 2.179 (2019-05-26)

• Detached plugin handling changes in 2.178 could cause problems for some custom Jenkins home packaging schemes that use improper filenames. These cases are now at least warned about, and in some cases transparently handled. (issue 55582)
• Change the presentation of boolean (checkbox) options for most options on configuration forms. (issue 55787)
• Developer: Make the XMLUtils class with utility methods related to safe XML processing available to plugins. (pull 4032)

What's new in 2.178 (2019-05-20)

• Update jmDNS from 3.4.0-jenkins-3 to 3.5.5 to prevent unnecessary DNS Multicast error messages. (issue 25369)
• Update WinP from 1.27 to 1.28 to fix problems with a missing DLL and flickering console window in the Windows graceful process shutdown logic. (issue 57477, full changelog)
• Make sure detached plugins (plugins whose functionality used to be part of Jenkins itself) are installed upon Jenkins startup when needed as implied dependencies of other plugins which were already present. This simplifies compatibility for specialized installation scenarios not using the update center, such as when Jenkins is run from a Docker image prepackaged with some plugins. (issue 57528)
• Bring the bundled version of the Script Security plugin up to date with recent security advisories, in the unlikely case it is indeed installed from the WAR rather than the update center. (pull 4000)

What's new in 2.177 (2019-05-12)

• Support setting excludes and case sensitivity in the fingerprint() build step in Pipeline and other job types. (documentation, pull 3915)
• Allow distinguishing between new projects, disabled projects, and those with aborted builds through differently shaded build balls. (pull 3997)
• Update Windows Agent Installer from 1.10.0 to 1.11, enabling TLS 1.2 on agent downloads when running with .NET 4.6 or newer. (issue 51577, full changelog)
• Update Winstone-Jetty from 5.2 to 5.3 to update Jetty to 9.4.18. (pull 4016, full changelog, Jetty 9.4.18 changelog, Jetty 9.4.17 changelog, Jetty 9.4.16 changelog)
• Restore Chinese localized resources used by the setup wizard. (regression in 2.176) (issue 57412)
• Robustness: Do not put agent offline for runtime exceptions in ComputerListener#onOnline(). (issue 57111)
• Do not record fingerprints for files not included in archived artifacts due to exclude filter. (issue 41696)
• Developer: Make UserSeedProperty available to plugin developers. (pull 4018)
• Developer: Add support for titleClassMethod (from symbol-hetero-list in Pipeline) to f:hetero-list. (issue 56379)

What's new in 2.176 (2019-05-05)

• Some plugins would fail in 2.175 with an error related to serialization of FilePaths. This is now downgraded to a warning. Plugin updates should still be applied to correct the underlying mistake. (issue 57244)
• Add stop-job CLI command which allows aborting builds. (issue 11888)
• Update Remoting from 3.29 to 3.30 to fix a few minor issues. (issue 51004, issue 57107, issue 46515, full changelog)
• Migrate all Chinese localization resources into Localization: Chinese (Simplified) plugin. (pull 4008)
• NodeListener#onCreated was called when Jenkins#addNode or Nodes#addNode actually replaced an existing node. (issue 57273)
• Developer: include generated source files of CLI module in the classpath. (pull 4006)

What's new in 2.175 (2019-04-28)

• Update status icon of a build when the build is finished (issue 16750)
• The Plugin Manager now provides easier selection for applicable plugin updates with options to select "All", "Compatible" or "None". The selection of "Compatible" plugins (previously "All") has been fixed to exclude all that contain any compatibility warnings. (issue 56477)
• Remove misleading references to Java Web Start and JNLP from GUI surrounding inbound Jenkins agents. (pull 3998)
• Re-enable Stapler request dispatching telemetry. (pull 3999)
• Ensure that Remoting objects are being serialized only through Remoting channels. Certain classes which were never designed for persistence in XML will no longer be serialized to disk: FilePath, [Stream]TaskListener, and ProcessTree. (issue 47896)
• Fix some errors seen in the Linux agent installers. (issue 57071)
• Make Debian/Ubuntu launcher script work with Java 11. (issue 57096)
• Developer: Make ${port} be honored by mvn -f war hudson-dev:run. (pull 3984)

What's new in 2.174 (2019-04-21)

• Renaming an agent retained old agent configuration, causing it to re-appear on restart. (issue 56403)
• Nested views are now searchable by name. (issue 43322)

What's new in 2.173 (2019-04-14)

• Remove built-in support for CCtray (cc.xml) files. To restore this feature, install the CCtray XML Plugin. (issue 40750)
• Adjust stream flushing behavior for code running remotely on agents for better performance. This may lead to loss of messages for plugins which print to a build log from the agent machine but do not flush their output. Use -Dhudson.util.StreamTaskListener.AUTO_FLUSH=true to restore the previous behavior for freestyle builds. Note that Pipeline builds always expect remote flush. (pull 3961)
• Add a button to copy new API tokens to the clipboard. (issue 56733)
• Make form submit buttons on the Jenkins classic UI compatible with potentially upcoming Firefox bug fix. (issue 53462, Firefox bug 1370630)
• Do not offer a workspace lease to a new build if it is already in use by a (Pipeline) build running across an agent reconnection. (issue 50504)
• Remove Mailer related localized strings from core. Make sure you use Mailer Plugin 1.23. (issue 55292)
• Properly flush output from the Maven console annotator. (issue 56995)
• Developer: Update Stapler from 1.256 to 1.257 to add support for loading localized webapp resources from any plugin. Add jenkins.PluginLocaleDrivenResourceProvider interface for plugins to participate in localized resource lookup. (JEP-216, full changelog)
• Developer: SystemProperties may now be used from agent-side code. See SystemProperties#allowOnAgent. (pull 3961)
• Developer: Add LineTransformationOutputStream#Delegating for convenience. (pull 3959)
• Developer: hudson.util.ssh.SFTPClient was removed. Use com.trilead.ssh2.jenkins.SFTPClient from the Trilead SSH library instead. (issue 56166)
• Internal: Update commons-beanutils from 1.8.3 to 1.9.3. (pull 3948)

What's new in 2.172 (2019-04-10)

• Security fixes. (security advisory)

What's new in 2.171 (2019-04-07)

• Expose the minimum supported version of remoting to allow future releases to reject incompatible agent connections. (issue 50095)
• The setup wizard did not properly escape passwords, resulting in errors with certain special characters. (issue 56856)
• Revert accidental change to hashCode computation of jenkins.util.TreeString in 2.168. (pull 3930)
• Developer: Add Jelly UI component f:secretTextarea for multi-line secrets analogous to f:password for single-line. (pull 3967, Storing Secrets in Jenkins)
• Developer: Deprecated Run.getLogFile(), as it is not compatible with JEP-210. (pull 3963)

What's new in 2.170 (2019-03-31)

• Remove misleading nonStoredPasswordParam symbol for password parameter definitions, since it's actually stored encrypted. (issue 56776)
• Corrupted console notes could cause an uninformative NegativeArraySizeException to be thrown from ConsoleNote#readFrom and build log display to be broken. (issue 45661)

What's new in 2.169 (2019-03-24)

• Update Winstone from 5.1 to 5.2 to make HTTPS cipher exclusions configurable. (issue 56659, issue 56591, full changelog)
• Add the run parameter filter value to REST API responses. (issue 56554)
• Fix highlighting of table entries when using checkboxes on the Legacy API Token usage page. (pull 3932)

What's new in 2.168 (2019-03-10)

• Mobile friendly layout of the login, loading and restart screens. (issue 56398)
• Inform administrators about potentially unsafe permissions setup involving builds running as the virtual SYSTEM user. (issue 24513)
• Workspace and artifacts browsing did not work on Windows Server 2016 with Microsoft Docker. (regression in 2.154) (issue 56114)
• Developer: StringParameterValue.getValue() now returns a String avoiding an unnecessary cast. (pull 3146)

What's new in 2.167 (2019-03-03)

• Actually show spinner when select tries to load an async request. (issue 42443)
• Add a log message to build logs when builds run with the virtual SYSTEM authentication. (pull 3908)

What's new in 2.166 (2019-02-25)

• Add support for turning off a log recorder in the logger configuration. (issue 56200)
• Replace Trilead-SSH implementation of SSH key loader in CLI with Apache Mina. (issue 56167)
• Prevent NullPointerException when discarding unreadable fingerprint data. (issue 43218)
• Avoid deserialization errors with EnvVars in rare circumstances by adding a stable serialVersionUID. (issue 56161)
• Developer: Update Localizer library from 1.24 to 1.26 allowing plugins to override the lookup for localized resource files. (pull 3896, JEP-216, full changelog)
• Internal: Update Jenkins Test Harness from 2.46 to 2.47. (pull 3912)

What's new in 2.165 (2019-02-17)

• Support for the Remoting mode of the CLI (-remoting option) has been removed. (pull 3838, announcement blog post)
• Developer: Some public classes and methods which were already deprecated as specific to Remoting mode of the CLI have been removed, though those likely to be used by plugins have been retained for compatibility. (pull 3838)
• Internal: Replace Trilead SSH implementation of base64 with the JDK implementation. (issue 43780)

What's new in 2.164 (2019-02-10)

• Make the plugin manager robust against Java version specification format mismatches while comparing versions (esp. after Java JEP 223). (issue 55980)
• Reduce the performance impact of the SECURITY-904 fix when downloading artifacts or workspaces as ZIP file. (issue 55050)
• Update Remoting from 3.28 to 3.29 to add a missing log call for severe protocol failures. (issue 55976, full changelog)
• Jenkins now uses the standard update center by default when running with Java 11. (issue 55085)
• Update Executable WAR from 1.44 to 1.45 to allow running Jenkins with Java 11 without setting the --enable-future-java flag or corresponding system property. (issue 52285, full changelog)
• Update SSHD Module from 2.5 to 2.6 to apply a proper Apache Mina idle timeout value when a custom value was set using the org.jenkinsci.main.modules.sshd.SSHD.idle-timeout system property. (issue 55978, full changelog)
• Suppress error message when first viewing the agent-to-controller security configuration page. (issue 55936)
• Fix log message when the built-in node runs out of disk space and is taken offline. (issue 55738)
• Developer: Improve discovery and readability of WebClient most popular options. (issue 53511)

What's new in 2.163 (2019-02-03)

• Support running Jenkins WARs on Java 11 without downloading JAXB JARs. A new JAXB plugin is marked as a detached one when running with Java 11 or higher. (issue 55681, pull 3711, plugin page)
• Report names of items being deleted in confirmation dialogs. (issue 55848)
• Replaced text references to slave with agent in various log entries and built-in help pages (issue 51320)
• Improve diagnostics of missing Old Data Administrative Monitor. (pull 3240, related issue)
• Prevent a potential startup deadlock situation in extension loading. (pull 3828, issue 55361, issue 54974, issue 50663, issue 44564, issue 31622)
• Improve robustness of the partial page refresh logic when Jenkins is not available. (issue 53077)
• Prevent NullPointerException in Run Parameter for jobs in rare race condition cases. (issue 47530)
• Prevent NumberFormatException when a symbolic link is published as an artifact. (issue 55049)
• Prevent NullPointerException when a fingerprint is loaded from a corrupted XML file without the usages section. (issue 49588)

What's new in 2.162 (2019-01-27)

• Jenkins did not use the configured proxy credentials for authentication unless they were saved since Jenkins was started. (regression in 2.152) (issue 54903)
• The list-jobs no longer lists items recursively when listing a specific folder. (issue 48220)
• Replace deprecated Warnings and Checkstyle plugins with Warnings Next Generation Plugin in installation wizard. (pull 3857)
• Do not print a warning about a changed workspace location on every startup when using the system property jenkins.model.Jenkins.workspacesDir. (issue 53284)
• Internal: Optimization in the method to read a remote file as text. (pull 3862)
• Internal: Add smoke-test JUnit category. To only run these tests, mvn -P smoke-test. (issue 53935)

What's new in 2.161 (2019-01-20)

• Update Windows Service Wrapper from 2.1.2 to 2.2.0 and Windows Agent Installer from 1.9.3 to 1.10.0 to support disabling, renaming and archiving service logs. (pull 3854, Windows Service Wrapper changelog, Windows Agent Installer Module changelog)
• Update Executable WAR from 1.41 to 1.44, allowing use of JENKINS_ENABLE_FUTURE_JAVA environment variable as an alternative to the --enable-future-java CLI switch. (pull 3847)
• Overhaul file deletion related code to be more reliable. (issue 55016, issue 55448, issue 55450)
• Improve robustness of console annotators such as the Timestamper plugin in conjunction with certain Pipeline steps such as git on an agent with an old agent.jar. (issue 55257)
• Developer: Add SecurityListener#userCreated API to inform about user account creation in the Jenkins user database security realm. (pull 3825)
• Developer: Deprecate ParserConfigurator. (pull 3852)
• Internal: Update frontend-maven-plugin from 1.4 to 1.6. (pull 3830)

What's new in 2.160 (2019-01-16)

• Important security fixes. (security advisory)
• Invalidate sessions and CLI authentication caches when changing the user password in the Jenkins user database.

What's new in 2.159 (2019-01-14)

• Fixed issue that prevented Jenkins from deleting files in many cases. (regression in 2.157) (issue 55448)

What's new in 2.158 (2019-01-13)

• Add support for plugins declaring a minimum Java version in manifest, showing warnings and refusing to load plugins with unsatisfied dependencies. Plugins should use the plugin POM 3.31 or newer to make use of this. (issue 55048)

What's new in 2.157 (2019-01-06)

• Update Trilead SSH library to add support for OpenSSH keys with AES256-CTR encryption. (issue 47603, issue 47458, issue 55133, issue 53653)
• Restarting and Loading pages did not get CSS resources from the correct URL when using a context path. (issue 55062)
• Internal: Update parent POM from 1.50 to 1.51. (pull 3829, changelog)
• Internal: update build-helper-maven-plugin from 1.7 to 3.0 to make Jenkins more easily importable in Eclipse IDE. (pull 3831)

What's new in 2.156 (2018-12-17)

• User account creation by administrators did not show error messages when it failed. (regression in 2.129) (issue 52869)
• Fix java.lang.IllegalStateException that could occur in rare cases on Jenkins startup. (issue 55197, issue 55070)
• Attempt to prevent NoClassDefFoundError: javax/servlet/ServletException under some conditions on agents. (issue 26677)
• Update Remoting from 3.27 to 3.28 to fix some minor issues and enhance NO_PROXY options. (full changelog, issue 47977, issue 48778, issue 49987, issue 50730, issue 51108, issue 54005)
• Replace the Flash implementation of the "copy to clipboard" feature with the native JavaScript equivalent. (issue 54933)
• Developer: Login and signup pages redesigned in 2.129 now can receive style contributions (footer view for SimplePageDecorator) from multiple plugins. (issue 54325)

What's new in 2.155 (2018-12-09)

• Java 11 Support Preview is available starting from this version (issue 52012, Announcement and run guidelines)
• When running on Java 11, Jenkins by default is now using an update center with alpha/beta plugin releases that require Java 11. (issue 55080, Experimental Update Center for Java 11 in JEP-211)
• Update SSHD Module from 2.4 to 2.5 to add support for the EdDSA signature algorithm. (issue 45318, SSHD Module changelog)
• Unix process manager and Agent Java Web Start UI now check the current Java version based on java.specification.version. (issue 55076)
• Internal: update parent POM from 1.49 to 1.50 to get the SUREFIRE-1588 workaround. (Parent POM changelog, SUREFIRE-1588)

What's new in 2.154 (2018-12-05)

• Important security fixes. (security advisory)

What's new in 2.153 (2018-11-25)

• Add support for the ed25519 key algorithm in Jenkins CLI. (issue 45318)
• Do not show the Launch agent from browser button (Java Web Start) if Jenkins is running on Java 11. (issue 52282)
• Do not hide newer releases of plugins from secondary update sites. (issue 45235)
• Check hudson.PluginManager.checkUpdateAttempts system property instead of hudson.PluginManager.CHECK_UPDATE_ATTEMPTS. (issue 54731, issue 54459)

What's new in 2.152 (2018-11-19)

• Revert compatibility fix for future releases of Firefox due to regressions it caused since 2.148. (issue 54261, issue 54333, issue 54570)
• Do not cache CSS/JS resource files for console annotations like Timestamper Plugin across Jenkins restarts. (issue 38719)
• In some cases, HTTP proxies with authentication did not work for HTTPS URLs. (issue 48775)
• Improve robustness when checking for updates. Add hudson.PluginManager.checkUpdateSleepTimeMillis and hudson.PluginManager.CHECK_UPDATE_ATTEMPTS system properties to adapt to unreliable networks. (issue 54459, Jenkins features controlled by system properties)
• Add support for killing child processes on AIX. (issue 16867)
• Only select compatible plugin updates when clicking Select All below the list. (issue 20155)
• Internal: Upgrade the Maven Jenkins Dev plugin from 9.4.5.v20170502 to 9.4.12.v20180830 to align it with the Jetty version. (issue 54599)
• Internal: Update Jenkins Test Harness from 2.36 to 2.41.1 to allow running tests with JDK11. (issue 53863, changelog)
• Internal: Introduce a new submodule for JDK8-only tests so that it is possible to run tests against codebase removed from JDK11. (issue 53716)

What's new in 2.151 (2018-11-11)

• Add a new CLI command disable-plugin to disable one ore more installed plugins and optionally restart Jenkins. (issue 27177)
• Add new category Languages to the plugin wizard, which automatically installs available localization plugins based on browser language. (pull 3626)
• Update Windows Agent Installer from 1.9.2 to 1.9.3 to reduce remote class loading when not actually using Windows. (pull 3723, Windows Agent Installer changelog)
• Avoid Premature EOF error when using the shutdown CLI command. (issue 49196)
• Prevent Stream is closed error in case a CLI command finishes before the input is entirely read. (issue 54310)

What's new in 2.150 (2018-11-04)

No notable changes in this release.

What's new in 2.149 (2018-10-28)

• Do not submit telemetry if there's no relevant data. (issue 54137)
• Use per-trial correlation IDs for telemetry submissions. (issue 54136)
• Fix concurrency bug that caused requests to hang since 2.147. (issue 54135)
• When using elastic agents (clouds), agent JVMs could be incorrectly relaunched and never terminated. (pull 3701)

What's new in 2.148 (2018-10-21)

• Make form submit buttons on the Jenkins classic UI compatible with potentially upcoming Firefox bug fix. (issue 53462, Firefox bug 1370630)

What's new in 2.147 (2018-10-14)

• Update Winstone-Jetty from 5.0 to 5.1 to update Jetty to 9.4.12, picking up TLS 1.3 support and fixes towards Java 11. (issue 51805, issue 53929, Winstone-Jetty changelog, Jetty changelog)
• Update Stapler from 1.254.2 to 1.255 to integrate a fix related to StaplerProxy#getTarget() return value handling. (pull 3690, stapler/stapler#149)
• Print a warning when the long deprecated method Secret#toString() is being used. (pull 3668)
• Add telemetry trials related to browser languages and Stapler request dispatching. (pull 3688, pull 3687, stapler/stapler#148)

What's new in 2.146 (2018-10-10)

• Important security fixes. (security advisory)
• Security hardening: Escape variables in Jelly views by default. (announcement blog post, LTS upgrade guide, list of affected plugins)
• Security hardening related to Stapler routing. (SECURITY-595 in the 2018-12-05 security advisory)
• Security hardening related to HTTP verb restrictions for web methods.

What's new in 2.145 (2018-10-07)

• Migrate most Simplified Chinese translations into Localization: Chinese (Simplified) Plugin. (pull 3667)
• Prevent NullPointerException on restart with an undefined update site URL. (issue 31448)
• Fix problems with update center metadata signature check on Java 11. (issue 53710)
• The initial visibility of nested groups of radio buttons did not accurately reflect the current values. (issue 48516)
• New JENKINS_USER_ID and JENKINS_API_TOKEN environment variables can be used to configure the CLI authentication. (issue 53792)
• Minor improvements to reduce minimum memory footprint for Jenkins, especially around update center & plugin metadata. (pull 3654)
• Developer: Add overridable Queue.Task#getAffinityKey() to allow consistent hashing for Pipeline builds in the future. (issue 36547)
• Developer: ConsoleAnnotatorFactory mishandled its type parameter, effectively forcing all implementations to use Object or raw types. (pull 3662)
• Internal: Update META-INF/services generator from 1.4 to 1.8 to fix compilation on JDK 10+. (issue 52024, META-INF/services generator)
• Internal: Update Parent POM to 1.49 to make the build flow compatible with Java 11. (Parent POM changelog)

What's new in 2.144 (2018-09-30)

• Update jnr-posix to 3.0.45 to prevent Illegal Reflective access warnings when running with Java 11. (issue 46725)
• Update Remoting from 3.26 to 3.27 to eliminate a potential deadlock. (full changelog, issue 53569)
• Prevent process termination failure when ProcessKiller extension fails with NoClassDefFoundError. (issue 53593)
• Remove unreliable action caching in views so that plugins installed after Jenkins startup can contribute to the UI. (issue 53353)
• Update Unix process management logic to support Process Tree termination when running with Java 11. (issue 46523)
• Developer: Introduce getPlatform() and setPlatform() methods in hudson.EnvVars. (issue 53721)
• Developer: Introduce new hudson.Util#fixNull(value, defaultValue) method. (pull 3656)

What's new in 2.143 (2018-09-25)

• Hyperlinks in build logs for builds run using Jenkins 2.138 or older were not displayed correctly in newer versions of Jenkins. As a side effect of this fix, build logs created with Jenkins between 2.139 and 2.142 (inclusive) will lose the hyperlink metadata. (issue 53729)
• Update Groovy from 2.4.11 to 2.4.12 to pick up fixes towards Java 11 support. (issue 52019, Groovy 2.4.12 changelog)
• Add extensibility mechanism for anonymous usage statistics with initial implementation collecting information about applied security fix escape hatches. (JEP-214)
• Fix a thread safety issue when creating multiple nodes in parallel. (issue 53401)
• Developer: Add Telemetry extension point. (JEP-214)
• Developer: Update PowerMock and Mockito to versions compatible with Java 11. (issue 53693)
• Internal: Incorrect API signatures on some classes performing custom deserialization. (issue 53608)
• Internal: Update sezpoz from 1.12 to 1.13 to enable building plugins with JDK 11. (issue 52024)

What's new in 2.142 (2018-09-20)

• Improve robustness when search items don't specify a display name. (issue 50795)
• Certain kinds of errors in build console display were being suppressed and ANSI escape sequences displayed instead. (pull 3612)
• Further improvements to not show scroll bar prematurely on long build display names in the sidepanel builds widget. (pull 3601)
• Developer: Make HashedToken and ApiTokenStore Serializable. (issue 53561)

What's new in 2.141 (2018-09-02)

• Update Winstone-Jetty from 4.4 to 5.0 to fix HTTP/2 support and threading problems on hosts with 30+ cores. (issue 53239, issue 52804, issue 51136, issue 52358)
• Update Remoting from 3.25 to 3.26 to remove some unhelpful warnings. (issue 42533, issue 52945)
• Wait up to two minutes for process termination before killing it (typically when aborting a build). (issue 17116)
• Reduce logging level of restart and shutdown related notifications from SEVERE to INFO. (issue 53282)

What's new in 2.140 (2018-08-26)

• A configured quiet period was interpreted as milliseconds, instead of seconds. (regression in 2.82) (issue 48770)

What's new in 2.139

• Allow use of the console command with Job/Read permission. (issue 52181)
• Upgrade libpam4j from 1.8 to 1.11. (issue 53055)
• CLI command enable-plugin -restart will no longer restart Jenkins if no plugins were actually enabled. (issue 52950)
• Nested f:repeatable/f:repeatableProperty form elements inherited minimum when they shouldn't. (issue 37599)
• Build logs were not displayed correctly when they contained hyperlinks whose link text contains newline characters. (issue 53016)
• Developer: Add support for the @PostConstruct lifecycle method annotation. (issue 52818)
• Developer: Add interface PersistentDescriptor that allows implementing Descriptors to skip explicit calls to load(). (issue 52818)

What's new in 2.138 (2018-08-15)

• Security fixes. (security advisory)
• Security hardening related to Stapler routing. (SECURITY-595 in the 2018-12-05 security advisory)

What's new in 2.137 (2018-08-12)

• Do not show scroll bar prematurely on long build display names in the sidepanel builds widget. (pull 3576)
• Developer: Downgrade errors about plugin dependency version mismatches to warnings when Maven snapshot versions are involved. Typically only relevant for developers, especially when using incrementals. (issue 52665)
• Internal: Update parent POM. Jenkins now requires Maven 3.5.4 or newer to build. (pull 3567)

What's new in 2.136 (2018-08-05)

• Add a new CLI command enable-plugin to enable one or more installed plugins and optionally restart Jenkins. (issue 52822)
• Update JNA from 4.2.1 to 4.5.2 to add support for s390x, update GNU C minimal requirement to 2.7 on Unix platforms. (issue 52771)
• Some types of builds, like pipelines, would sometimes run concurrently even when that was disabled. (issue 41127)
• Legacy API token monitoring did not work correctly for users with id null. (issue 52441)
• Launcher.ProcStarter.stdout(TaskListener) did not properly send its argument over a Remoting channel to an agent. (issue 52729)
• Developer: Add EnvironmentVariablesNodeProperty#getEnv() for better Configuration-as-Code support. (issue 52794)

What's new in 2.135 (2018-07-29)

• Some deserialization rejections are now logged on WARNING log level, instead of only on FINER. (issue 51666)
• Prevent warnings about deserialization of hudson.model.ParametersDefinitionProperty$1. (issue 50457)
• Developer: Make Jenkins#getInstallState and Jenkins#setInstallState(…) available to plugins. (issue 52718)

What's new in 2.134 (2018-07-22)

• Instruct browsers to not send referrer headers when following links to other sites. (pull 3547, referrer policy documentation)
• Improvements to Chinese localization. (pull 3550, pull 3555)

What's new in 2.133 (2018-07-18)

• Important security fixes. (security advisory)

What's new in 2.132 (2018-07-15)

• Don't log warnings when SHA-256 checksums are provided (but SHA-512 are not) for plugin downloads. (pull 3546)
• Allow java.time.Ser for use in XStream (XML serialization) and Remoting (agent communication). (issue 52534)
• Don't fail to archive artifacts when attributes cannot be preserved, instead log a message and proceed without preserving attributes (regression in 2.120). (issue 52325)

What's new in 2.131 (2018-07-08)

• Add support for Zip files larger than 4 GB (Zip64). (issue 52356)
• Developer: Remove hudson.FilePath#copyFromRemotely(URL) Beta API. (issue 52417)

What's new in 2.130 (2018-07-01)

• Check SHA-512 or SHA-256 checksums of update site and tool installer metadata and core and plugin downloads if the update site provides them. (pull 3356)
• Improve API token metadata to be able to distinguish between API tokens created today, and whose creation date is unknown (legacy API tokens). (issue 52161)
• Update Remoting from 3.22 to 3.23 to skip TCP Agent Listener port availability check when the -tunnel option is set (regression in Remoting 3.22 and Jenkins 2.129). (issue 52204)
• Instances of some item types could not be renamed (regression in 2.110). (issue 52164)
• Robustness: Don't break queue processing when the configured queue sorter throws exceptions. (issue 52159)
• Update instance identity module from 2.1 to 2.2 to improve Java 11 compatibility. (issue 51965, full changelog)

What's new in 2.129 (2018-06-24)

• Replace single per-user API token with new system of multiple, revocable, unrecoverable API tokens with usage tracking. (issue 32442, issue 32776, blog post)
• Dynamically loaded plugins now have any PeriodicWork/AperiodicWork extensions scheduled. (issue 28683)
• Upgrade Bytecode Compatibility Transformer from 1.8 to 2.0-beta-2, upgrading ASM from 5.0.1 to 6.2 to improve support of Java 9+ runtimes. (issue 51837, supported Java versions)
• Upgrade Remoting from 3.21 to 3.22 to have agents check availability of the controller's TCP Agent Listener port when connecting over TCP. (issue 51818, Remoting 3.22 changelog)
• Update Executable WAR from 1.40 to 1.41 to link the Jenkins Java support policy and to fix reflection warnings when running on Java 9+ (experimental support). (issue 51994, issue 46622, Executable WAR 1.41 changelog, supported Java versions)
• Developer API: Remoting 3.22 now offers a new Channel#readFrom(Channel, byte[]) method for a standardized command deserialization from the channel. (issue 51841)

What's new in 2.128 (2018-06-18)

• Redesigned login, signup, and Jenkins is (re)starting pages. Existing page decorators like Simple Theme Plugin will no longer work with these redesigned pages. (issue 50447, announcement blog post)
• The deprecated Jenkins CLI Protocol versions 1 and 2, and Java Web Start Agent Protocol versions 1, 2, and 3 have been disabled. If you still use these protocols (e.g. remoting-based CLI, or old agent.jars on agents), you need to re-enable these protocols after upgrade, or upgrade the clients. The same recommendations as in The 2.121.x upgrade guide for remoting changes apply here. (issue 48480)
• Upgrade Winstone from 4.3 to 4.4 to update Jetty from 9.4.8.v20171121 to 9.4.11.v20180605. (pull 3497, full changelog, Jetty 9.4.11 changelog, Jetty 9.4.10 changelog, Jetty 9.4.9 changelog)
• Jenkins remote API: Export fingerprints for builds which do not derive from AbstractBuild, like Pipeline builds. (issue 51667)
• Stop using deprecated com.google.common.io.NullOutputStream from Guava to avoid binary conflicts with plugins bundling newer Guava versions (regression in 2.127). (issue 51889)
• Developer: Introduce SimplePageDecorator extension point, which allows decorating the redesigned login page. (announcement blog post)
• Developer API: Prevent NullPointerException in SlaveComputer#setChannel(Channel,OutputStream,Channel.Listener) with null OutputStream. (issue 51955)
• Developer API: StreamTaskListener#getCharset() now returns the default charset when it is not configured. (issue 51971)

What's new in 2.127 (2018-06-11)

• Optional extensions are now loaded without requiring to restart Jenkins after installing an optional dependency. (issue 50336)
• Update Remoting from 3.20 to 3.21 to apply logging enhancements and better no_proxy support. (issue 51223, issue 50965, issue 51551, Remoting 3.21 changelog)
• Add modification timestamp to files in directory browser views such as archived artifacts and workspaces. (issue 20998)
• Improve diagnostics of corrupted plugin archives during plugin dynamic loading. (issue 51608)
• Update Executable WAR from 1.39 to 1.40 to allow running Jenkins with incompatible (too new) Java versions by setting the --enable-future-java flag. (issue 51155, Executable WAR 1.40 changelog)
• Have the setup wizard propose a root URL ending with a slash as is necessary. (issue 51660)
• Fix a potential deadlock between queue maintenance and asynchronous execution. (issue 46248)
• Security hardening: Prevent files in tar archives from being written to a path outside the destination directory. (issue 51777)
• If using the Artifact Manager on S3 plugin with the (non-default) option to delete artifacts, they were not deleted when the entire build was deleted. (issue 51819)
• Prevent Enter resulting in a broken presentation of the setup wizard. (issue 51816)
• Developer: PermissionGroups now expose their IDs to Java API. (issue 51598)
• Developer: ComputerLauncher implementations can now set channels with a custom CommandTransport implementation. (issue 51541)
• Developer/Internal: Remove use of a Guava method deleted in later versions, which could cause problems for plugins running functional tests. (issue 51779)

What's new in 2.126 (2018-06-03)

• Robustness: A buggy ComputerListener#onConfigurationChange implementation should not block Jenkins startup. (issue 50217)
• Diagnostics: Log stack traces in JEP-200 rejection messages when jenkins.security.ClassFilterImpl logging level is FINE or above. (issue 51355)
• Copying Run parameters did not work as expected as RunParameterDefinition#copyWithDefaultValue called the wrong constructor. (issue 51650)
• Actions created from a TransientActionFactory that got attached to an item in the queue are no longer persisted, which could previously lead to duplicate actions shown for builds. (issue 51584)
• Do not attempt to disconnect offline computers for not responding. (issue 20272)
• Restore implied dependency on JDK Tool Plugin from Apache HttpComponents Client 4 API Plugin to fix dependency problems. (issue 51483)
• Fix behaviour of Advanced button when a section element is nested inside. (issue 14632)
• Do not duplicate caller stack trace when FilePath#act fails. (issue 51082)
• Developer: Make various form validation related attributes in Jelly form taglib explicitly available. (pull 3470)

What's new in 2.125 (2018-05-27)

• Export path to agent file system root directory in remote API. (pull 3206)
• Do not remove workspaces for projects with builds in progress. (issue 27329)

What's new in 2.124 (2018-05-21)

• Fix release process issue that resulted in 2.123 not being properly released. (pull 3452)

What's new in 2.123 (2018-05-21)

• Upgrade Winstone from 4.2 to 4.3, adding an option to enable JMX when running Jenkins using java -jar jenkins.war. (pull 3422, full changelog, JMX Documentation for Jetty, full list of options)
• Improve Jenkins root URL validation. (issue 51158)
• Prevent unhandled ClassCastException when loading fingerprints from corrupted files. (issue 51179)

What's new in 2.122 (2018-05-14)

• Faster list rendering of Plugin Manager » Available. (issue 51205)
• Improve Chinese translation. (pull 3423, pull 3440)
• Internal: Various improvements related to incremental Maven releases. (issue 51187, issue 51247, pull 3430, JEP-305)

What's new in 2.121 (2018-05-09)

• Important security fixes. (security advisory)

What's new in 2.120 (2018-05-06)

• The Job/Build permission no longer implies the Job/Cancel permission. The latter needs to be granted explicitly to users who previously got it via this relationship. (issue 14713)
• Fix issue preventing process killing vetoes being effective on agents. (issue 9104, ProcessKillingVeto extension point implementations)
• Allow additional administrative monitors to be dismissed directly from their warning messages. (pull 3416)
• Make fingerprint logs less verbose. (issue 50412)
• Be more lenient when validating the root URL (regression in 2.119). (issue 51064)
• Archiving artifacts now preserves file permissions and last modification time. (issue 13128)
• Don't extract files from plugin archives to outside their destination directory. (issue 32778)
• Internal: Add support for incremental Maven releases. (JEP-305)
• Internal: Further simplify storage of the Jenkins setup wizard’s installation state. (pull 3405)
• Developer: Extend ClassFilterImpl#isLocationWhitelisted Maven-oriented exclusions to plugin under test during Gradle builds. (issue 51062)

What's new in 2.119 (2018-04-25)

• Ensure as much as possible that the Jenkins root URL is defined by adding a new setup wizard page and an administrative monitor. (issue 31661)
• Default Crumb Issuer proxy compatibility can be enabled on first startup by setting the system property jenkins.model.Jenkins.crumbIssuerProxyCompatibility to true on startup. (issue 50767, Jenkins features controlled by system properties)
• Remove the options to define custom Build Record Root Directory and Workspace Root Directory on the Configure System form to prevent unexpected failures during runtime. Instead, these locations can now be customized using system properties on startup. (issue 50164, Jenkins features controlled by system properties)
• Allow java.util.EnumMap and org.jruby.RubyNil for use in XStream (XML serialization) and Remoting (agent communication). (issue 50939, issue 50616)
• Developer: Add a new overload for HttpResponses#errorJSON. (pull 3082)

What's new in 2.118 (2018-04-18)

• Update Remoting from 3.19 to 3.20 in order to refresh the code signing certificate. (pull 3398, full changelog)
• Update WinP from 1.25 to 1.26 to fix loading of WinP libraries on Windows inside Weblogic web container. (issue 48347, full changelog)
• Developer: JEP-202: Extend VirtualFile API to streamline external artifact storage. API additions are marked beta and may change at any time. (JEP-202, pull 3302)

What's new in 2.117 (2018-04-15)

• Update Winstone from 4.1.2 to 4.2 to update Jetty from 9.4.5 to 9.4.8 for various bugfixes and improvements. (full changelog, Jetty 9.4.6 changelog, Jetty 9.4.7 changelog, Jetty 9.4.8 changelog)
• Improve Chinese translation. (pull 3368, pull 3385, pull 3386, pull 3387, pull 3391)
• Don't log null pointer exceptions on some forms with validation button (regression in 2.116). (issue 50748)
• Make the logic for adding nodes atomic, so that if a newly added node fails to be persisted it will not exist in a partly-initialized state. (issue 50599)
• Internal: Add new update center root CA certificate. (Help desk issue 1236)

What's new in 2.116 (2018-04-11)

• Security fixes. (security advisory)

What's new in 2.115 (2018-04-08)

• Sort nodes matching labels on UI. (issue 25910)
• Internal: Run threadPoolForRemoting threads in the context of the SYSTEM user to be consistent with executor threads. (issue 50296)
• Developer: Add new overloads for HttpResponses#errorJSON. (pull 3379)

What's new in 2.114 (2018-04-01)

• Introduce hudson.triggers.SafeTimerTask.logsTargetDir system property to write logs usually written to $JENKINS_HOME/logs to another location. (issue 50291)
• Update Executable War from 1.38 to 1.39 to remove an irrelevant warning on Jenkins startup. (issue 50439)
• Make Cancel Shutdown link in side panel work without requiring the page to be reloaded. (issue 44402)
• Prevent f:combobox input fields from breaking customized form submission handlers. (issue 21613)
• Fix a race condition in the Setup Wizard that could lead to it being skipped on the first startup when groovy scripts or init scripts are pre-installed. (issue 49401)
• Internal: Minimize visibility of readResolve methods. (pull 2567)

What's new in 2.113 (2018-03-25)

• Update Remoting from 3.18 to 3.19 so that Jenkins core can always deserialize exceptions even if they're not permitted. To benefit from this improvement, Remoting needs to be updated on the agent side as well. (issue 50237, issue 49618, full changelog)
• JEP-200: Allow org.apache.tools.ant.Location deserialization to prevent exception when listing agent files in non-existent directory or invalid filter. (issue 50237)
• Prevent some cases of linkage errors relating to Servlet classes when code is run on an agent. (issue 46386)
• Allow users without Overall/Read access to use the who-am-i and logout commands. (issue 50324)
• Show more entries in the search results dropdown and search results page. (issue 47020)

What's new in 2.112 (2018-03-18)

• Install from java.sun.com installation method for JDK tools has been moved to a new JDK Tool Plugin. (issue 22367)
• Update Remoting from 3.17 to 3.18 in order to apply various performance and diagnosability improvements, such as logging warnings when anonymous classes are serialized over a Remoting channel. (issue 49415, issue 49472, issue 48561, issue 49994)
• Allow use of lists of options as provided by the Pipeline snippet generator for choice parameters. (issue 26143)
• Restore serialVersionUID of AbstractTaskListener (regression in 2.91). (issue 50124)
• Use case-insensitive autocompletion for item selection dialogs if the current user prefers case-insensitive search. (issue 38812)
• Better autocompletion for loggers supporting multiple tokens and proposing useful parent loggers. (pull 3345)
• Internal: Move "Submit" button localization from various forms to the button control. (pull 3319)

What's new in 2.111 (2018-03-11)

• Pipeline builds could not be started if the Authorize Project plugin was configured to associate the build with a user to whom the authorization strategy was configured to deny Agent/Build permission on the built-in node. (issue 46652)
• Reduce memory footprint of jenkins.model.lazy.AbstractLazyLoadRunMap#search in descending order. (issue 50056)
• Update Executable War from 1.37 to 1.38 to show an error when an attempt is made to run Jenkins on Java 9. (issue 49737, full changelog)
• Display estimated remaining time again for Pipeline jobs (regression in 2.92). (issue 48821)
• Revert update of PrototypeJS in 2.110 due to regression. (issue 49968)
• Do not show an error message when renaming an item before changing the name. (issue 49906)
• Improve robustness in case a build with parameters was stored with a null list of parameters. (issue 39495)
• Setup wizard did not properly display form validation errors in "Create First Admin User" form. (issue 45387)
• Prevent FileNotFoundException in hudson.Util#loadFile in case of race condition. (issue 49971)
• Ignore misplaced config.xml file directly in users/ directory. (issue 32599)
• Developer: Introduce hudson.util.TextFile#linesStream for file stream processing with proper error propagation. (pull 3211, pull 3340)
• Internal: Choose more mnemonic artifactIds for modules not consumed externally. (pull 3311)

What's new in 2.110 (2018-03-05)

• It is no longer possible to rename jobs from their configuration page. Jobs now have a link in the side panel titled "Rename" that links to a page specifically dedicated to renaming jobs. (issue 22936)
• Show the "Add" button in lists of tool installations also on the top. (issue 43581)
• Add ConcurrentLinkedQueue to white-listed classes for use in XStream (XML serialization) and Remoting (agent communication). (issue 49788)
• Issue warnings to the system log when attempts are made to use classes with unpredictable names and serial forms (such as anonymous classes) in Remoting or XStream (de)serialization. (issue 49795)
• Make JEP-200 serialization allowlist more reliable on old versions of Tomcat 8. (issue 49543)
• Clean up the build.xml files of parameterized projects that contained unnecessary serialized data. (issue 49795)
• Upgrade Winstone from 4.1.0 to 4.1.2 to prevent User session memory leak by setting the default idle session eviction timeout to 30 minutes. (issue 49596, full changelog)
• Make proxy views work inside folders. (issue 49642)
• Prevent NullPointerException in AbstractProject#checkout when the agent disconnects during a build. (issue 29470)
• Developer: Subclasses of AbstractItem can implement AbstractItem#isNameEditable and return true to get automatic support for renames. Subclasses are also able to dynamically validate renames by implementing AbstractItem#checkRename. (issue 22936)
• Developer: Add support for also showing the "Add" button on top for lib/form/repeatable Jelly controls when the enableTopButton attribute is set to true. (pull 2926)
• Internal: Upgrade PrototypeJS 1.7.0 to 1.7.3. (issue 49319, PrototypeJS blog/changelog)
• Internal: Improve the implementation of Util#createTempDir. (pull 3226)
• Internal: Make Apply buttons localizable. (pull 3287)

What's new in 2.109 (2018-02-25)

• Periodically persist the build queue so it can be restored on abnormal process termination. (issue 30909)
• Add agent symbol for a permanent agent in Structs Plugin based configuration. (issue 49661)
• Match more date formats for sortable tables. (pull 3125)
• Prevent NullPointerException when saving a parameterized job without parameters defined. (issue 46638)
• Don't link to a non-existing user profile from the build log of a build started by an anonymous user. (issue 48467)

What's new in 2.108 (2018-02-18)

• Always show the built-in node in the executors widget, even when it is offline. (issue 34712)
• archiveArtifacts in a Pipeline failed to throw a normal exception when there were no matches. (issue 47142)
• Update Apache Mina SSHD Core from 1.6.0 to 1.7.0 in CLI client. (issue 49565, changelog)
• Don't show input validation errors in optional numeric form fields (regression in 2.105). (issue 49387, issue 49520)
• Fix translation of 'sign up' in Dutch, used to be 'sign in'. (issue 49498)
• Extensibility: Allow SecurityRealm and AuthorizationStrategy implementations to be hidden on Configure Global Security form using DescriptorVisibilityFilter. (issue 49044)

What's new in 2.107 (2018-02-14)

• Important security fixes. (security advisory)
• Security hardening to prevent problems like SECURITY-624 in the future. (2017-12-05 security advisory, Ant Plugin fix in 2018-01-22 security advisory)

What's new in 2.106 (2018-02-11)

• Update Remoting library from 3.16 to 3.17 to improve diagnostic logging for channel read/write events and JEP-200 related class filtering. (issue 27035, issue 49027, full changelog)
• Integrate SSHD module 2.4 which updates Apache Mina SSHD Core from 1.6.0 to 1.7.0. (pull 3278, SSHD module changelog)
• Internal/API: Add DataBoundConstructor to LegacySecurityRealm to facilitate reflective instantiation in Jenkins-related tools and frameworks. (pull 3279)

What's new in 2.105 (2018-02-04)

• When Jenkins fails to load plugins, show failures that users need to take action on separate from those due to other plugins failing to load. (pull 3256)
• Upgrade Executable War from 1.36 to 1.37 to allow supplying jenkins.war command-line arguments via standard input using the --paramsFromStdIn parameter. (pull 3223, documentation)
• Jenkins now creates XML 1.1 files to be more accepting of unusual contents. (issue 48463)
• Form validation for number of executors now properly shows validation errors and user-friendly message on form submission. (issue 47793)
• Ensure that threads for background tasks cannot be created with a custom classloader to prevent possible Groovy memory leaks. (issue 49206)
• Upgrade Executable War from 1.36 to 1.37 to prevent multiple copies of winstone-*.jar in the temp folder from using up disk space needlessly. (issue 22088)
• Update to task reactor version 1.5 to prevent hanging of Jenkins on startup/reload when an initialization task throws an unhandled exception. (issue 48725, full changelog)
• Developer: Introduce ACL#lambda convenience method. (pull 3260, Javadoc)

What's new in 2.104 (2018-01-28)

• Permit additional safe Java platform types for use in XStream (XML serialization) and Remoting (agent communication). (pull 3251, pull 3252, pull 3253, issue 49070, issue 49071)
• Remove support for unbounded number of SCM polling threads. Previously, the default was infinite and could be set to between 10 and 100. Existing installations with unbounded SCM polling threads will now use the default of 10, and it is no longer possible to use a value outside of this range. (pull 3258)
• Define a minimum required version of the Remoting library (agent communication) and print warnings when an older version is connecting. (pull 3250)
• Improve robustness in case of faulty SCM#guessBrowser implementations. (pull 3267)
• Improve error message when failing to read some files to actually mention the file name. (issue 49060, issue 49112)
• Restore Manage Jenkins submenu in the context menu accessible from the breadcrumb (regression in 2.103). (issue 49129)
• Fix MalformedInputException or UnmappableCharacterException when reading the log file after finishing a build (regression in 2.102). (issue 49112)
• Jenkins 2.102 and later could fail to start or run properly when loaded inside certain containers, including old versions of Tomcat. (issue 49147)
• Don't attempt to export information about arbitrary offline causes as part of the /computer/(name)/api output, which could result in errors. (issue 24452)

What's new in 2.103 (2018-01-21)

• Permit additional safe types for use in XStream (XML serialization) and Remoting (agent communication). (issue 48946, issue 49000, issue 49025)
• Re-style the Manage Jenkins page, including administrative monitors. (issue 43786, blog post)
• Make Blue Ocean work on Wildfly by excluding its outdated Jackson implementation from the Jenkins class path. (issue 48957)
• Do not downgrade detached plugins when upgrading Jenkins while its previous version was not properly recorded. (issue 48899)
• Restore file permissions granted to group and other for file created by Jenkins (regression in 2.93). (issue 48407)
• Fix a race condition in Initializer implementations creating Items that resulted in their deletion. (issue 47406)
• A ClassCastException or NoSuchMethodException could under certain circumstances mask the actual error when loading erroneous data from an XML file. (issue 49054)
• Properly add apostrophes to several localized strings that were missing them before. (pull 3203)
• Developer: Improve detection of current plugin's or test's classes for exclusion from JEP-200 filtering. (pull 3237)

What's new in 2.102 (2018-01-14)

• Switch Remoting/XStream denylist to an allowlist. (issue 47736, upgrade guidelines for admins and plugin maintainers, list of affected plugins)
• Update Jenkins Remoting from 3.15 to 3.16. (full changelog, issue 47736, issue 48686)
• Limit which section headers are added to the breadcrumb config outline. (issue 48773)
• Reduce memory consumption for concurrent jobs when retrieving cause of blockage. (pull 3227)
• Introduce new hudson.lifecycle.ExitLifecycle to exit instead of restart. (issue 47043, Jenkins features controlled by system properties)
• AtomicFileWriter was not fully atomic. Now it uses a FileChannel internally and forces a disk sync when committing. (issue 34855)
• Developer: Add a constructor to ToolDescriptor so that subclasses are not required to be an inner class of their Describable. (pull 3220)

What's new in 2.101 (2018-01-07)

• Log EOF exceptions on a FINE level instead of WARNING when the Jetty connection is closed by peer. (pull 3214)
• Fix HTTP 404 error when clicking on New View sidebar link from another view. (issue 48447)
• Improve Chinese and French localizations. (pull 3209, pull 3204, pull 3216, pull 3179)

What's new in 2.100 (2018-01-03)

• Restore binary compatibility with agents running Remoting versions older than 3.15 (regression in 2.98). (issue 48761, issue 48754, Retrospective thread in the developer mailing list)

What's new in 2.99 (2017-12-31)

• Updating Jenkins jobs and views by XML left fields at their old value if not defined in the new XML. (issue 21017)

What's new in 2.98 (2017-12-24)

• Update Remoting from 3.14 to 3.15 to fix several issues. (full changelog, issue 37566, issue 37670, issue 38696, issue 46724, issue 47965, issue 48055, issue 48130, issue 48133, issue 48309)
• Make the system property hudson.consoleTailKB actually work. (issue 48593, Jenkins features controlled by system properties)
• Developer: Jenkins#getInstance() is now deprecated as its semantics have been a source of confusion for some time. Use #get() in typical cases and Jenkins#getInstanceOrNull() in rare cases (see Javadoc). (issue 48638)

What's new in 2.97 (2017-12-19)

• Fix regression in 2.96 that caused a downgrade of Script Security when upgrading Jenkins. (issue 48604)

What's new in 2.96 (2017-12-17)

• Make sure detached plugins (plugins whose functionality used to be part of Jenkins itself) are installed when upgrading Jenkins past the version at which the plugin was detached. (issue 48365)
• Do not require CSRF crumb to be provided when the request is authenticated using API token. (issue 22474)
• Improve robustness and error handling of various file operations by switching to NIO. (issue 47324, issue 48405)
• Improve Chinese translation. (pull 3176)
• Update Stapler from 1.253 to 1.254 to make the form that shows up when a URL requiring POST is accessed using a different HTTP verb work with CSRF protection enabled. (issue 34254, Stapler changelog)
• Fix a performance regression in Jenkins 2.86 due to lock contention in ExtensionList. (issue 48505)
• Trigger SecurityListener#loggedIn events on programmatic login during self-registration when using HudsonPrivateSecurityRealm. (issue 48383)
• Developer: Capture more authentication-related events in SecurityListener. (issue 27027)
• Developer: Deprecate hudson.util.Service in favor of Java's ServiceLoader. (pull 3191)
• Developer: Introduce Cause.UserIdCause(String) constructor, which allows creating causes for specified users without switching the user context. (pull 3162)

What's new in 2.95 (2017-12-14)

• Security fixes. (security advisory, announcement blog post)

What's new in 2.94 (2017-12-11)

• Export assignedLabels for agents and labelExpression for applicable job types in remote API. (issue 25286)
• Optimization: Don't consult the authorization strategy about whether the internal SYSTEM pseudo-user has a given permission. (issue 20474)
• Update SSHD Module 2.0 to 2.3 to fire authentication events in SecurityListeners when a user connects using SSH. (changelog)
• The setup wizard is now resumed upon restart if it hasn't been completed yet, instead of showing the regular login screen (regression in 2.81). (issue 47439)

What's new in 2.93 (2017-12-03)

• Use Java NIO to read and write Unix file permissions by default. The previous behavior can be restored by setting the Java system property hudson.Util.useNativeChmodAndMode to true. (issue 36088, Jenkins features controlled by system properties)
• Better handling of certain unreproducible XML file load/save errors. (pull 3167)
• Improve user lookup performance, for example from Git changelog calculation. (issue 47429)
• Reduce memory usage when scheduling pipelines on big clusters. (issue 48348)
• Use atomic file moves if available on the underlying file system from AtomicFileWriter. (issue 34855)
• Prevent setup wizard from hanging when the two provided passwords differ, instead show a validation error. (issue 48080)
• Developer: Add ItemGroup#allItems and similar default methods to ItemGroup. (pull 3148)
• Developer: Add default implementations of deprecated methods to BuildableItem and Item so they don't need to be implemented. (pull 3142)
• Internal: Add documentation and convenience methods for the User.CanonicalIdResolver extension point. (pull 3140)

What's new in 2.92 (2017-11-26)

• Revert internal change that broke assumption in ruby-runtime in 2.91, impacting plugins based on it. (issue 48116)
• Improve UI performance with long list of running builds by caching the estimated duration. (issue 48350)
• Cache permission names, allowing Jenkins to recover faster after "stop-the-world" Java GC pauses. (issue 48349)
• Prevent potential NullPointerException when migrating the default "All View" name for a "My Views" user property. (issue 48157)
• Developer: Add AccessControlled#hasPermission(Authentication, Permission) for convenience. (pull 3149)

What's new in 2.91 (2017-11-19)

• Use Java NIO library instead of native code to create and detect symbolic links and Windows junctions to improve compatibility and robustness. (issue 36088, issue 39179)
• Prevent concurrent installation of Maven on the same node to prevent problems. (issue 34138)
• Developer: Deprecate the ambiguous User#getUser(String) in favor of the User#getById() or the new User#getOrCreateByIdOrFullName() methods. (issue 47718)
• Developer: Implement default methods in TaskListener and BuildListener interfaces so they don't have to be implemented in subclasses. (pull 3122)

What's new in 2.90 (2017-11-12)

• Recover from legacy user configuration folders with $ characters that are not part of hex escape sequences. (regression in 2.89) (issue 47909)
• Fix Download from java.sun.com installation method for JDK for downloads requiring an Oracle login after change to the Oracle site (again). (issue 47448)
• Update Remoting from 3.13 to 3.14 in order to apply various performance and stability improvements. (full changelog, issue 37566, issue 45294, issue 47425, issue 47901, issue 47942)
• Add option to trim specified string parameter values. (issue 47115)
• Update Windows Agent Installer from 1.9.1 to 1.9.2: Do not try to update jenkins-slave.exe on Unix agents when they connect. (full changelog, issue 47015)
• Add a note explaining that the nodes count in label selection does not take into account permissions or other plugins. (issue 47940)
• Improve Chinese localization. (pull 3127)
• Updated default workspace directory naming for new installations to use filesystem-safe variable ITEM_FULL_NAME. (issue 12251)
• Fix icon for Manage Jenkins link in the sidebar of the Global Tool Configuration form. (pull 3139)
• Prevent caching of captcha on the login form. (issue 43852)
• Ensure that the authenticated group is not added twice to the authorities for a user. (issue 47768)

What's new in 2.89 (2017-11-08)

• Security fixes. (security advisory)

What's new in 2.88 (2017-11-05)

• Add sidebar link to create new view. (issue 6290)
• Improve robustness of the /user/(username)/configure page when a UserProperty is missing its descriptor. (issue 45977)
• Improve Russian localization. (pull 3113, pull 3115)

What's new in 2.87 (2017-10-29)

• Stapler library upgraded from 1.252 to 1.253 with Servlet 3.1 support, improved Blue Ocean performance and changes of interest to plugin developers. (issue 37062, Stapler changelog)
• Commons Codec library upgraded from 1.8 to 1.9. (pull 3033)
• Agents JVM must be 1.8+ and a clear message is shown in connection logs if it is not. (issue 44851)
• Major improvement to Italian localization. (pull 3075)
• Improvements to Chinese localization. (pull 3104, pull 3105)
• Retrieving the list of installed plugins now consumes much less memory. (issue 47713)
• When the Jenkins root URL was not configured, the login CLI command did not work.
• Allow users with Job/Cancel permission to abort pipeline builds from the builds history widget. (pull 3101)
• Jobs no longer disappear from NestedView lists after renaming. (issue 25276)
• Internal: Move metadata about plugins split from core into a resource file. (pull 3110)
• Developer: Add ExtensionList#lookupSingleton convenience method. (pull 3021)

What's new in 2.86 (2017-10-22)

• Launch agent via execution of command on the master has been moved to a new Command Launcher plugin and integrated with the Script Security plugin. (issue 47393, Command Launcher plugin site entry, related security advisory)
• Add link to recursive cc.xml output on build history page. (issue 36282)
• Fix Download from java.sun.com installation method for JDK for downloads requiring an Oracle login after change to the Oracle site. (issue 47448)
• Secret threw ArrayIndexOutOfBoundsException trying to decrypt {}. (issue 47500)
• Race conditions in agents going offline could result in an exception when picking a workspace for a build. (issue 47455)
• Prevent duplicated elements with incorrect URL when using the search on Dashboard View plugin based views. (issue 35459)
• StackOverflowError thrown under some conditions when using Pipeline on 2.85. (issue 47517)
• Prevent NullPointerException updating a folder with a primary view specified in Folders plugin 6.2.0. (issue 47416)
• Developer: Add an empty default implementation for previously abstract methods of SecurityListener. (pull 3077)
• Developer: Deprecate hudson.util.Memoizer and replace its usage in core. (pull 3091)
• Developer: Slave.JnlpJar.getURL did not work in some modes when core had a snapshot dependency on the Remoting library. (pull 3069)

What's new in 2.85 (2017-10-15)

• Upgrade Remoting from 3.12 to 3.13. (issue 47132, issue 38711, full changelog)
• Restart agent communication related threads on both controller and agents when encountering an unhandled exception, if possible, to improve stability. (issue 38711)
• Improve performance by not querying queue dispatchers from the UI. (issue 20046)
• Use node display name when printing "built on" message in the build log. (issue 47168)
• Enable cc.xml to export jobs in folders recursively when accessed with a query parameter named recursive. (issue 36282)
• Add new administrative monitor warning users about disabled CSRF protection. (issue 47372)
• In rare configurations, agents tried to load unloadable classes from the controller, resulting in ClassNotFoundException: javax.servlet.ServletContextListener on agents. (issue 46386)
• Jenkins did not correctly show parts of pipeline builds in side panel widgets if the current view is configured to filter their content. (issue 46759)
• Developer: Make Xstream2#addCriticalField available for use in plugins. (pull 3066)

What's new in 2.84 (2017-10-11)

• Important security fixes. (security advisory)

What's new in 2.83 (2017-10-08)

• Fix potential HTTP 414 error in form validation of long Batch/Shell tool installer scripts. (issue 47058)
• Fix link from build cause or page header to user profile in case of unusual user names. (issue 32623)
• Properly display agent launch arguments when using nested launch methods. (issue 47056)

What's new in 2.82 (2017-10-01)

• favicon.ico and other binary resource files were broken since 2.79 because they were incorrectly filtered during the build. (issue 47127)
• Don't log warning when an anonymous user sends an invalid crumb, usually just an expired session. (issue 40344)
• Developer: Fix TimeDuration time unit handling and its incorrect usage. TimeDuration uses milliseconds as the default unit. It was supposed to parse sec or secs suffix to interpret the number as seconds, but that never worked. (issue 44052)
• Developer: Create a copy of a list of parameters in ParametersAction constructor before storing them to improve robustness when the caller reuses that list. (issue 45472)

What's new in 2.81 (2017-09-27)

• Jenkins 2.80 did not initialize the setup wizard on new installations, causing various security options including authentication and authorization to be turned off by default, granting anonymous administrator access. (security advisory, notification, issue 47139)

What's new in 2.80 (2017-09-24)

• Improve error reporting when failing to archive artifacts. (pull 2976)
• Save the current Jenkins version whenever saving the Jenkins object, e.g. when saving the global security configuration. Plugins may rely on this information for data migration that would be triggered unnecessarily. (issue 42577)
• Prevent possible NullPointerException when removing an item from a list view due to a race condition. (issue 23411)
• Avoid a possible server-side timeout on long-running CLI commands using plain HTTP mode by sending periodic pings from the client. (issue 46659)
• Renaming or moving a folder failed to properly move build directories of its children when using custom build directory, resulting of loss of their builds. (issue 44657)
• Developer: Deprecate hudson.util.TimeUnit2 and replace with java.util.concurrent.TimeUnit. (pull 2892)

What's new in 2.79 (2017-09-17)

• Fix random failures to use passphrase-protected ed25519 SSH private keys (regression in 2.73). (issue 46754)
• Update Remoting library from 3.11 to 3.12 to fix regression in Jenkins 2.68 when using non-writable home directories. (issue 45755, full changelog, issue description in 2.73.1 upgrade guide)
• Add description of nodes to their remote API. (issue 42854)
• Disconnect node on ping timeout instead of leaving the channel half open. (issue 46680)
• Internal: Require Java 8u101 to build Jenkins, as that's the minimum required to run it since 2.77. (pull 3015)

What's new in 2.78 (2017-09-10)

• Moved Jenkins agent runtime to agent.jar file name, and deprecate (but still support) use of legacy slave.jar. Introduce the AGENTJAR_URL environment variable as replacement for SLAVEJAR_URL. (issue 35451)
• Accept Basic authentication headers case-insensitively. (issue 44663)
• Internal: Implement DescriptorByNameOwner using Java 8 interface default method. Make Computer a DescriptorByNameOwner allowing its use as @AncestorInPath. (pull 3009)

What's new in 2.77 (2017-09-03)

• Default the built-in Jenkins Update Center URL to https://updates.jenkins.io instead of obsolete HTTP endpoint. This requires a JRE compatible with Let's Encrypt, e.g. Oracle JRE 8u101. (pull 2996)
• Fix problem with auto upgrade when using custom JENKINS_HOME on Windows. (issue 13153)
• Administrative monitor did not detect when Tomcat's URL escaping does not permit forward slashes. (issue 31068)
• Fix broken UI for users with Discover permission when renaming a job. (issue 41637)
• Internal: Avoid code duplication using default methods. (pull 2999)

What's new in 2.76 (2017-08-27)

• Update Remoting from 3.10 to 3.11 to improve stability and diagnosability. (issue 37567, issue 43985, issue 45023, issue 45233, issue 45522, issue 46259, full changelog)
• Major update of the Bulgarian translation. (pull 2983)
• Internal: Allow EnvironmentContributingAction to support Run in addition to AbstractProject. (issue 29537)
• Internal: Updated parent POM; Jenkins core now requires Maven 3.3.9 or newer to build. (pull 2985)

What's new in 2.75 (2017-08-20)

• Update Windows service wrapper from 2.1.0 to 2.1.2 and Windows Agent Installer from 1.9 to 1.9.1. (Windows service wrapper changelog, Windows agent installer changelog, pull 2987, issue 46282)
• Disable obsolete JNLP, JNLP2, and CLI protocols on new Jenkins installations during Setup Wizard. (issue 45841, announcement blog post)
• Button to validate proxy configuration in Manage Plugins now works correctly with NTLM authorization. (issue 46288)

What's new in 2.74 (2017-08-15)

• Upgrade Stapler library from 1.250 to 1.252. (pull 2956, Stapler changelog)
• Stapler 1.252: Prevent file handle leak in LargeText#GzipAwareSession. (issue 45903)
• Prevent core or plugin code from mistakenly attempting to serialize jobs, builds, and users except in their intended top-level XML file positions, preventing a class of serious deserialization-related errors. (issue 45892)
• Stapler 1.252: Restore ability to attach views to interfaces (regression in Jenkins 2.46). (issue 43715)
• Improve Polish localization. (pull 2974)
• Log name of the executor thread that died to improve diagnosability. (issue 42376)
• Prevent caching of the item categories list by the browser to prevent stale data. (issue 43848)
• Update Agent Installer module to 1.6 for minor fixes and enhancements. (pull 2965, changelog)
• Show display name of the current view in window title. (pull 2969)
• Include culprits in XML and JSON API again (regression in 2.60). (issue 46082)
• Improve robustness of the reverse build trigger ("Build after other projects are built"). (issue 45909)
• Internal: Cleanup of Maven dependencies in Jenkins core, allowing plugins depending on this version or later to build without “upper bound” dependency warnings on recent Maven HPI Plugin releases. (pull 2956)

What's new in 2.73 (2017-08-06)

• Avoid unnecessary locking to improve performance related to actions. (issue 45244)
• Improve performance when reading the console text of a build. (issue 45915)
• Add Polish translations for setup wizard. (pull 2952)
• Reliably close build log file when using chained BuildListeners. (issue 45057, issue 43199)
• Modify the JNLPLauncher configuration page to work around regression in Docker Plugin (regression in 2.72). (issue 45895)

What's new in 2.72 (2017-07-30)

• Enable Remoting work directories by default for newly created agents launched via JNLP (Java Web Start Launcher). (issue 44112, feature documentation)
• Always follow redirects for downloading update center metadata, so misbehaving plugins cannot break it. (issue 38185)
• Minor optimization to queue maintenance routines and printing of console notes, mainly for the benefit of Pipeline node blocks. (issue 45553)
• Don't monitor response time on offline agents. (issue 20272)

What's new in 2.71 (2017-07-23)

• Winstone 4.1: Add Jetty HTTP/2 connector and corresponding options for Winstone-Jetty. (issue 45438, enabling HTTP/2 support in Winstone-Jetty)
• Don't reload user records from disk unless explicitly requested to improve performance of user record access. (issue 45737)
• Prevent NullPointerException in Jenkins#getRootURL() while the instance is not fully loaded yet. (issue 34914)
• Contributions to the PATH environment variable could result in malformed values on agents on a platform different from the controller's. (issue 14807)
• JNLP for launching agents now requests Java 8. (issue 45679)
• Prevent NullPointerException when a previous completed build is missing for upstream culprits check. (issue 45516)
• Correctly show or suppress warnings about undefined parameters based on hudson.model.ParametersAction.keepUndefinedParameters system property. (issue 45519)
• Internal: Delete obsolete SECURITY-144-compat exclusion that can break tests. (issue 25625)

What's new in 2.70 (2017-07-16)

• Fix version number shown in 2.0 upgrade wizard. (issue 45459)

What's new in 2.69 (2017-07-09)

• SSHD Module 2.0: Update from SSHD Core 0.14.0 to Apache MINA SSHD 1.6.0 in Jenkins core and Jenkins CLI. (changelog, plugin compatibility notice, issue 43668)
• SSHD Module 2.0: Enable aes192ctr and aes256ctr ciphers if JVM supports unlimited-strength encryption. (issue 39738)

What's new in 2.68 (2017-07-02)

• Update Remoting from 3.7 to 3.10 adding opt-in support for work directories and improving logging in Jenkins agents. (work directory documentation, logging documentation, Remoting changelog, issue 39370)
• The reload-configuration CLI command now waits until the reload is finished, and returns an error code if the reload failed. (issue 45256)
• Follow HTTP redirects while initiating CLI connection. (issue 44361)
• Add documentation for time zone specification for cron patterns (e.g. SCM polling). (issue 9283)
• Robustness improvements related to agent connections. (issue 43496, issue 38527)

What's new in 2.67 (2017-06-25)

• Enable simpler syntax for upstream build trigger in pipelines. (issue 34464)
• Remove the "JNLP" protocol references from the TCP Agent Listener log messages. (issue 44103)
• Internal: Update Annotation Indexer to 1.12 to work around JRE bug in tests. (JDK-8182744)

What's new in 2.66 (2017-06-18)

• When starting the jenkins.war directly, properly check for Java 8 as minimum instead of Java 7 before proceeding. (issue 44764)
• Allow overriding the Jenkins session ID suffix so it doesn't change on every restart, possibly resulting in too many cookies. (how to set session ID, issue 25046, issue 44894)
• Fix resource loading in plugins using the PluginFirstClassLoader, e.g. loading Groovy classes from plugin resources. (issue 44898)
• Prevent possible NullPointerException when listing remote directories using the FilePath#list() and FilePath#listDirectories() APIs. (issue 44942)

What's new in 2.65 (2017-06-11)

• Prevent NullPointerException when calling restart CLI command (regression in 2.57). (issue 44769)
• Packaging: Docker alpine image had a Jenkins-incompatible JDK installation (regression in 2.64). (issue 44733, corresponding Alpine Linux issue)

What's new in 2.64 (2017-06-04)

• Moved agent port and protocol configuration out of "security" (authentication and authorization) block in Configure Global Security. (issue 4478)
• Add section headers for Markup Formatter and CSRF Protection in Configure Global Security form to make these options more obvious. (pull 2900)
• Use one-column layout for REST API documentation (.../api URLs). (issue 44563)
• Update jnr-posix from 3.0.1 to 3.0.41 to pick up improvements and fixes in the POSIX platforms support. (pull 2904)
• Jenkins failed to perform some cleanup tasks, including saving the build queue, if stopped via REST /exit, CLI shutdown, or when restarting from Install as Windows Service. (issue 44589)
• Don't check whether disabled administrative monitors are active or not on the Manage Jenkins page. (issue 44608)
• Do not submit form when pressing Enter in the plugin manager's filter field. (issue 44523)
• Plugin Development: Jenkins now no longer publishes a war-for-test artifact. Plugins using this or a later version of Jenkins as baseline need to use plugin parent POM 2.30 or later. (issue 24064)

What's new in 2.63 (2017-05-28)

No notable changes in this release.

What's new in 2.62 (2017-05-21)

• Fixed Pipeline compatibility for a number of CLI commands (delete-builds, list-changes, console, set-build-description, and set-build-display-name), as well as some issues affecting error reporting in other commands when used with Pipeline. (issue 30785, issue 41527)
• If you have the Authorize Project plugin installed and configured, its configuration will now be treated as final with respect to the behavior of Job/Build checks from Build other projects and Build after other projects are built. Formerly, if a Per-project configurable Build Authorization was enabled globally but some projects did not specify an Authorization, the two aforementioned checks would automatically fall back to checking as anonymous (typically denying build permission). To restore the former behavior, explicitly configure a Project default Build Authorization to be Run as anonymous. Note that this will affect all build-scoped permission checks, including for example Agent/Build. (issue 22949)
• Internal API: Tasks.getAuthenticationOf now honors authentication contributed by QueueItemAuthenticatorProvider extensions. (pull 2880)
• Update WinP from 1.24 to 1.25 to improve performance and diagnostics of issues like JENKINS-30782. (full changelog)
• Fix for NullPointerException while initiating some SSH connections (regression in 2.59). (issue 44120)
• Prevent StackOverflowError in log recorder when Winstone-Jetty debug logging is enabled. (regression in 2.61) (issue 44330, corresponding Jetty issue)

What's new in 2.61 (2017-05-14)

• Upgrade Groovy from 2.4.8 to 2.4.11. (Groovy 2.4.9 changelog, Groovy 2.4.10 changelog, Groovy 2.4.11 changelog)
• Integration of Winstone 4.0: Upgrade bundled Jetty from 9.2.15.v20160210 to 9.4.5.v20170502. This removes support for the deprecated SPDY protocol. The --spdy parameter has been removed accordingly and Jenkins may refuse to start if it's set. (full changelog)
• Jetty 9.4.5: Prevent the 400 Bad Host header error for HttpChannelOverHttp when operating behind reverse proxy. (issue 40693, corresponding Jetty issue)
• Update the Mailer plugin version installed when updating from very old Jenkins releases to include the fix for SECURITY-372, the SSH Build Agents plugin for SECURITY-161, and the Script Security plugin for SECURITY-258. (SECURITY-372, SECURITY-161, SECURITY-258)
• Freestyle projects may now list Pipeline jobs as downstream and trigger them, without needing to use the Parameterized Trigger plugin or reverse triggers ("Build after other projects are built"). (issue 28113)
• Internal: Define enabling/disabling in ParameterizedJob rather than AbstractProject. (issue 27299)
• Internal: Offer default methods on ParameterizedJob to have less boilerplate code. (pull 2864)

What's new in 2.60 (2017-05-10)

• Update to Windows Service Wrapper 2.1.0 to support new features: download command with authentication, flag for startup failure on download error, Delayed Automatic Start mode. (issue 43737)
• Windows services: Add system property that allows disabling WinSW automatic upgrade on agents. (issue 43603, more information)
• Windows services: Restore compatibility of the WindowsSlaveInstaller#generateSlaveXml() method (regression in 2.50, no known external usages). (issue 42745)
• Windows services: Prevent fatal file descriptor leak when agent service installer fails to read data from the service startup.log. (issue 43930)
• Use full display name for runs in RSS feed to restore the project name there (regression in 2.59). (issue 44117)
• Internal: Generalize the changelog API to support non-AbstractBuild run types. (issue 24141)

What's new in 2.59 (2017-05-07)

• Move to latest version of Trilead to fix SSH connection issues following a previous Trilead upgrade. (issue 42959, issue 43979, issue 44046)
• Prevent Internet Explorer from caching AJAX requests using Cache-Control header. (issue 43929)
• Properly fail with error when updating view with CLI using input of a different view type. (issue 42728)
• Fix AccessDeniedException in "Build after other projects are built" when user has Discover permission but not Read. (issue 42707)
• Properly log failure due to empty archive in Pipeline. (issue 38005)
• Prevent rare NullPointerException if an admin user is created in the setup wizard after first disabling CSRF protection. (issue 44010)

What's new in 2.58 (2017-04-30)

• Use build display names in RSS feed titles. (pull 2845)
• Update the Trilead SSH library to get support of new Mac, Key, and Key Exchange Algorithms. (issue 33021, issue 26379, issue 31549)
• Migrate legacy users only once per restart to improve performance of the user retrieval logic. (issue 43936)
• Internal: Pick up the latest release of version-number library. (issue 43733)
• Internal: Refactor ProcessTree.Windows logic to propagate errors. (issue 43825)

What's new in 2.57 (2017-04-26)

• Important security fixes. (security advisory)

What's new in 2.56 (2017-04-23)

• Plugins did not expect InvalidPathException to be thrown in file-related methods, so wrap them in IOException to restore behavior (regression in 2.55). (issue 43531)
• Remove links in stack traces to the stacktrace.jenkins-ci.org service that has been shut down. (issue 42861)
• If an exception is thrown while rendering an HTTP response, just log the stack trace on the server side, without trying to send an error page to the client. (issue 21695)
• Prevent NullPointerException when a non-existent default view is specified in Configure System. (issue 42717)
• Deleting jobs with running builds could result in NullPointerException (regression in 2.55). (issue 43653)

What's new in 2.55 (2017-04-15)

• Packaging: Debian package now requires Java 8. (causes regression since 2.54). (issue 43495)
• Added fine-grain logging of FullDuplexHttpService to diagnose issues when establishing an HTTP Duplex connection. (pull 2481)
• Update LibZFS from 0.5 to 0.8 to fix compatibility issues with ZFS filesystem and illumos distributions. (issue 41932)
• Before deleting jobs, try to abort the running builds. Error will be thrown instead of the job deletion if its builds cannot be aborted. (issue 35160)
• Ensure that Cloud.PROVISION is properly initialized during the configuration loading. (issue 43279)
• Fix log message formatting when migrating AllView names due to JENKINS-38606". (issue 43611)
• Setup wizard gets into bad state when failures like network issues happen. (issue 41778)
• Catch and log RuntimeException in Computer#setNode() when updating the Computer list. (issue 42043)
• SSH CLI client authenticator 1.4. Add missing SSH Public Key field validation in user configuration. (issue 16337)
• Internal API: SSH CLI client authenticator 1.3. Expose PublicKeySignatureWriter to plugins. (pull 2840)

What's new in 2.54 (2017-04-09)

• Jenkins (controller and agents) now requires Java 8 to run. (issue 27624, issue 42709, pull 2802, announcement blog post)
• Non-Remoting-based CLI. (issue 41745, pull 2795, announcement blog post)
• Disable SSH server by default. (issue 33595)
• Use case-insensitive search by default for new and anonymous users. (issue 42645)
• Introduce status indicator for skipped download job. (issue 40848)
• Properly handle saving system configuration when disabling all, or all but one, administrative monitors. (issue 42852)
• When validating a cron expression, consider the specified time zone. (issue 43228)

What's new in 2.53 (2017-04-02)

• Update to Windows Service Wrapper 2.0.3 and Windows Agent Installer 1.8 to prevent conversion of environment variables to lowercase in the agent executable, regression in Jenkins 2.50. (issue 42744, WinSW Changelog, Windows Agent Installer changelog)
• GC Performance: Avoid using FileInputStream and FileOutputStream in the core codebase. (JDK-8080225, issue 42934)
• Packaging: Do not invoke recursive chown in JENKINS_HOME during the RPM post-install step unless owned by a different user. (issue 23273)
• Internal API: Add support of a new full screen mode in layout.jelly. (issue 34670)

What's new in 2.52 (2017-03-26)

• Computer#addAction would throw an UnsupportedOperationException since Jenkins 2.30. Such a call site was released in SSH Build Agents Plugin 1.15 for SECURITY-161. (issue 42969, security advisory including SECURITY-161)
• Update German localization. (pull 2777)
• Remove localizations with very low coverage: Albanian, Basque, Belarusian, Bengali, Esperanto, Galician, Georgian, Gujarati, Hindi, Icelandic, Indonesian, Irish, Kannada, Macedonian, Marathi, Mongolian, Occitan, Punjabi, Sinhala, Tamil, Telugu, Thai. (pull 2813)

What's new in 2.51 (2017-03-19)

• Restore WMI Windows Agents Plugin 1.2 compatibility by restoring windows-service/jenkins.xml, regression in 2.50. (issue 42724)
• SSHD 1.10: Move SSH server port configuration to security options page. (pull 2796)
• Update Russian localization. (pull 2798)
• Update French localization. (issue 42627)
• Internal: Make sure system threads run as SYSTEM. (issue 42556)
• Internal API: Add the ability for ItemListener to veto copy operations. (issue 34691)
• Internal API: Make Run#compareTo work across jobs. (issue 42319)
• Internal API: Save Jenkins after calling setSecurityRealm or setAuthorizationStrategy. (pull 2790)
• Internal API: Annotate PermissionGroup#owner @Nonnull. (pull 2805)

What's new in 2.50 (2017-03-11)

• Allow searching by build parameter values in the Build History widget. (issue 40718)
• Searching in the Build History widget takes into account user preferences (case sensitivity by default). (pull 2683)
• When creating temporary files, use the jenkins prefix instead of the old hudson one. (pull 2778)
• Fix relative links in the SCM polling administrative monitor. (pull 2780)
• Update Remoting from 3.5 to 3.7 in order to prevent file descriptor leaks on agents in the case of multiple connection attempts. (full changelog)
• Upgrade the Windows Agent Installer module from 1.6 to 1.7. This change picks major updates in Windows service management logic. This fix caused a critical regression in the WMI Windows Agents Plugin (JENKINS-42724). Update to WMI Windows Agents 1.3.1 in order to get the fix applied. (full changelog, guide to upgrading old Windows service agents)
• Windows services: Upgrade the bundled Windows Service Wrapper from 1.18 to 2.0.2. (full changelog)
• Windows services: Enable Runaway Process Killer by default in new agent and controller installations. (issue 39231)
• Windows services: Enable auto-upgrade of Remoting on newly installed agents if they are connected by HTTPS. (issue 39237)
• Windows services: Add support of shared directories mapping in Windows agent services. (Shared Directory Mapper documentation)
• Windows services: Change the default Agent service display name prefix to Jenkins agent %ID%. (issue 42468)
• Windows services: Prevent agent connection reset issues when WinSW gets terminated due to the system shutdown. (issue 22692)
• Windows services: Integrate various stability and performance fixes in Windows Service Wrapper from 1.18 to 2.0.2. There are many fixes around configuration options and process termination. (full changelog)
• Prevent file descriptor leaks when Windows Service installer fails to read data from the service startup log. (issue 42670)
• Select controls in Jenkins Web UI now show the spinner icon while waiting for the list of possible options during AJAX. requests. (issue 42443)
• Improve plugin access performance in the default PluginManager implementation. (issue 42585)
• Internal API: Allow providing a custom task name in Run/Schedule UI via the AlternativeUiTextProvider extension. (issue 34522)
• Search results page did not correctly encode query parameters. (issue 42390)

What's new in 2.49 (2017-03-05)

• Do not attempt to find the next occurrence of an impossible date such as June 31st in validation of trigger schedules. (issue 41864)
• Remove invalid translations in Slovene. (issue 41756)

What's new in 2.48 (2017-02-26)

• Upgrade Apache Commons Collections to version 3.2.2. Note: Jenkins has been using a denylist to prevent exploiting the serialization vulnerability in 3.2.1 since before 3.2.2 was released. (issue 31598)
• Use redirect URLs on jenkins.io instead of linking to wiki pages directly, allowing future reorganization of documentation without breaking links in Jenkins. (pull 2756)
• Fix performance issue in deduplication of lists of tool installers. (issue 42141)
• Use of the remote API to create items in views (/view/…/createItem) didn't actually add items to views since Jenkins 2.22. (issue 41128)
• Do not display a warning when an SCM trigger has no schedules (either to disable SCM post-commit hooks, or to enable them without polling). (issue 42194)
• Developer: Allow referencing radio buttons in f:validateButton validation methods. (pull 2734)

What's new in 2.47 (2017-02-19)

• Update Groovy to 2.4.8 to address memory leak issue. Do not use this version if you are running Pipeline builds unless you also update Pipeline: Groovy to 2.28 or higher. (issue 33358, issue 42189)
• Windows service restart did not retain build queue. (issue 32820)
• Exceptions during Jenkins cleanup step should not block restart. (issue 42164)
• Upgrade Remoting to version 3.5. (full changelog)
• Remoting 3.5: Remoting clients now accept lowercase (HTTP 2) headers sent by reverse proxies. (issue 40710)
• Remoting 3.5: Add option to specify the Remoting protocol to use on the client. (issue 41730)
• Remoting 3.5: Stability improvements. (issue 41513, issue 41852)
• Developer: Snapshot builds of plugins that had dependencies on other snapshot builds were not having their version numbers compared correctly. (issue 41899)