Changelog

Apache Commons Lang 2 removed from Jenkins core

The Apache Commons Lang 2.6 library has been removed from Jenkins core. The Apache project last released Commons Lang 2.6 on January 16, 2011. The 2.x line is no longer maintained and includes known vulnerabilities that trigger software content analysis security scanners.

Many Jenkins plugins previously relied on Jenkins core to provide this library rather than declaring it as their own dependency. New releases have been published for most affected plugins that now provide their own dependency or otherwise no longer require Apache Commons Lang 2. Pull requests have been submitted for other plugins so that they no longer require Apache Commons Lang 2. Plugin that used Apache Commons Lang 2 are listed in the tracking spreadsheet.

Before upgrading Jenkins, upgrade your installed plugins to their most recent releases. In particular, make sure that plugins that previously depended on Commons Lang 2 have been updated. An outdated plugin may fail to load or may not function correctly after upgrading Jenkins because the Apache Commons Lang 2 classes are no longer provided by Jenkins core.

Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2.

Windows Server 2019 agent container images dropped

Container images (jenkins/inbound-agent and jenkins/ssh-agent) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either:

• Upgrade to Windows Server 2022
• Upgrade to Windows Server 2025
• Build their own agent container image for Windows Server 2019

The bouncycastle API, Command Agent Launcher, Oracle Java SE Development Kit Installer, JAXB, Trilead API, SSH server, JavaBeans Activation Framework (JAF) API, JavaMail API, and Instance Identity plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins between 2016 and 2022 (Jenkins 2.16 through 2.356). Copies were bundled in the war since then so that instances upgrading from such old versions, or plugins built against them, would keep working.

Most instances are not affected. If the update center is reachable, Jenkins resolves and installs these plugins automatically over the network whenever something needs them, the same way it would for any other missing dependency, regardless of which Jenkins version you're running.

You are only affected if your instance has no access to the update center. In that case, upgrading core past one of the versions above, or installing a plugin built against an old baseline, can no longer pull these plugins in automatically. Download the plugin files from the update center and place them in the plugins directory of the Jenkins home directory before starting the new version, or before installing the plugin that needs them.

The JUnit, Mailer, Matrix Authorization Strategy, Matrix Project, and OWASP Markup Formatter plugins are no longer bundled inside jenkins.war, reducing its download size by more than 20 MB. This functionality was split out of Jenkins core into these plugins in 2014 (Jenkins 1.577) or earlier. Copies were bundled in the war since then so that instances upgrading from such old versions would keep working.

Most instances are not affected. If these plugins are already installed (they are among the plugins suggested by the setup wizard), or your instance was installed or last upgraded at any point in the last decade, nothing changes.

You are only affected if you upgrade an instance directly from Jenkins 1.577 or earlier, or if you install plugins built against Jenkins (then Hudson) 1.577 or earlier without using the Jenkins plugin manager. In those cases Jenkins can no longer install these plugins automatically from the war. If the update center is reachable, install the plugins through the plugin manager as usual. On instances without access to the update center, download the plugin files and place them in the plugins directory of the Jenkins home directory before starting the new version.

When upgrading an instance from Jenkins 1.577 or earlier, install these five plugins before starting the new Jenkins version. Configuration that depends on them, such as matrix-based security, matrix (multi-configuration) jobs, JUnit test result publishing, email notification settings, and markup formatter settings, cannot be loaded without them. Jenkins may fail to start (for example, if matrix-based security is your authorization strategy), and configuration that fails to load may be discarded the next time the affected item is saved. Alternatively, upgrade in two steps: first to an intermediate version that still bundles these plugins (any LTS release before this change), let Jenkins install them automatically, then upgrade to the current version.

Windows 2019 controller images have been dropped from this release, and the next LTS release line will not include them either. For users who must use Windows for their controller and are stuck on Windows 2019, the workaround is either to:

1. Install Jenkins controller via the MSI available via the "Windows" links on https://www.jenkins.io/download/
2. Build their own image

The Jenkins MSI installer is now signed by "LF Open Source, LLC" using the Microsoft Artifact Signing Service. The change causes the Edge browser on Windows to report that the file is not commonly downloaded. Users need to select "Keep anyway" to download the installer.
When running the Jenkins MSI installer with the new signature, Windows SmartScreen reports "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk." Users need to select "More info" to advance to the next screen and then select "Run anyway". A blog post provides screenshots and more details.
The Microsoft support forum says that Microsoft SmartScreen will stop prompting users once there are enough installations to increase its reputation score.