Changelog

The bouncycastle API, Command Agent Launcher, Oracle Java SE Development Kit Installer, JAXB, Trilead API, SSH server, JavaBeans Activation Framework (JAF) API, JavaMail API, and Instance Identity plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins between 2016 and 2022 (Jenkins 2.16 through 2.356). Copies were bundled in the war since then so that instances upgrading from such old versions, or plugins built against them, would keep working.

Most instances are not affected. If the update center is reachable, Jenkins resolves and installs these plugins automatically over the network whenever something needs them, the same way it would for any other missing dependency, regardless of which Jenkins version you're running.

You are only affected if your instance has no access to the update center. In that case, upgrading core past one of the versions above, or installing a plugin built against an old baseline, can no longer pull these plugins in automatically. Download the plugin files from the update center and place them in the plugins directory of the Jenkins home directory before starting the new version, or before installing the plugin that needs them.

The JUnit, Mailer, Matrix Authorization Strategy, Matrix Project, and OWASP Markup Formatter plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins in 2014 (Jenkins 1.577) or earlier. Copies were bundled in the war since then so that instances upgrading from such old versions would keep working.

Most instances are not affected. If these plugins are already installed (they are among the plugins suggested by the setup wizard), or your instance was installed or last upgraded at any point in the last decade, nothing changes.

You are only affected if you upgrade an instance directly from Jenkins 1.577 or earlier, or if you install plugins built against Jenkins (then Hudson) 1.577 or earlier without using the Jenkins plugin manager. In those cases Jenkins can no longer install these plugins automatically from the war. If the update center is reachable, install the plugins through the plugin manager as usual. On instances without access to the update center, download the plugin files and place them in the plugins directory of the Jenkins home directory before starting the new version.

When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version.

Windows 2019 controller images have been dropped from this release, and the next LTS release line will not include them either. For users who must use Windows for their controller and are stuck on Windows 2019, the workaround is either to:

1. Install Jenkins controller via the MSI available via the "Windows" links on https://www.jenkins.io/download/
2. Build their own image

The Jenkins MSI installer is now signed by "LF Open Source, LLC" using the Microsoft Artifact Signing Service. The change causes the Edge browser on Windows to report that the file is not commonly downloaded. Users need to select "Keep anyway" to download the installer.
When running the Jenkins MSI installer with the new signature, Windows SmartScreen reports "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk." Users need to select "More info" to advance to the next screen and then select "Run anyway". A blog post provides screenshots and more details.
The Microsoft support forum says that Microsoft SmartScreen will stop prompting users once there are enough installations to increase its reputation score.