Changelog for 2.107.1

What's new in 2.107.1 (2018-03-14)

• Make JEP-200 serialization allowlist more reliable on old versions of Tomcat 8. (issue 49543)
• Don't show input validation errors in optional numeric form fields. (regression in 2.105) (issue 49387, issue 49520)

• Switch Remoting/XStream denylist to an allowlist. (issue 47736, upgrade guidelines for admins and plugin maintainers, list of plugins known to be impacted)
• Jenkins now creates XML 1.1 files to be more accepting of unusual contents. (issue 48463)
• Use Java NIO library instead of native code to create and detect symbolic links and Windows junctions to improve compatibility and robustness. (issue 36088, issue 39179)
• Use Java NIO to read and write Unix file permissions by default. The previous behavior can be restored by setting the Java system property hudson.Util.useNativeChmodAndMode to true. (issue 36088, Jenkins features controlled by system properties)
• Improve robustness and error handling of various file operations by switching to NIO. (issue 47324, issue 48405)
• Update Remoting from 3.14 to 3.17 to integrate multiple fixes and improvements. (full changelog, issue 37566, issue 37670, issue 38696, issue 46724, issue 47965, issue 48055, issue 48130, issue 48133, issue 48309, issue 47736, issue 48686, issue 27035, issue 49027)
• Remove support for unbounded number of SCM polling threads. Previously, the default was infinite and could be set to between 10 and 100. Existing installations with unbounded SCM polling threads will now use the default of 10, and it is no longer possible to use a value outside of this range. (pull 3258)
• Do not require CSRF crumb to be provided when the request is authenticated using API token. (issue 22474)
• Introduce new hudson.lifecycle.ExitLifecycle to exit instead of restart. (issue 47043, Jenkins features controlled by system properties)
• Upgrade Executable War from 1.36 to 1.37 to allow supplying jenkins.war command-line arguments via standard input using the --paramsFromStdIn parameter. (pull 3223, documentation)
• Update SSHD Module 2.0 to 2.4 to update Apache Mina SSHD Core from 1.6.0 to 1.7.0, and fire authentication events in SecurityListeners when a user connects using SSH. (pull 3278, pull 3111, SSHD module changelog)
• Export assignedLabels for agents and labelExpression for applicable job types in remote API. (issue 25286)
• Re-style the Manage Jenkins page, including administrative monitors. (issue 43786, blog post)
• Define a minimum required version of the Remoting library (agent communication) and print warnings when an older version is connecting. (pull 3250)
• When Jenkins fails to load plugins, show failures that users need to take action on separate from those due to other plugins failing to load. (pull 3256)
• Updating Jenkins jobs and views by XML left fields at their old value if not defined in the new XML. (issue 21017)
• Fix HTTP 404 error when clicking on New View sidebar link from another view. (issue 48447)
• Upgrade Executable War from 1.36 to 1.37 to prevent multiple copies of winstone-*.jar in the temp folder from using up disk space needlessly. (issue 22088)
• Update to task reactor version 1.5 to prevent hanging of Jenkins on startup/reload when an initialization task throws an unhandled exception. (issue 48725, full changelog)
• Developer: Jenkins#getInstance() is now deprecated as its semantics have been a source of confusion for some time. Use #get() in typical cases and Jenkins#getInstanceOrNull() in rare cases (see Javadoc). (issue 48638)
• Developer: Deprecate the ambiguous User#getUser(String) in favor of the User#getById() or the new User#getOrCreateByIdOrFullName() methods. (issue 47718)
• Developer: Capture more authentication-related events in SecurityListener. (issue 27027)
• Developer: Deprecate hudson.util.Service in favor of Java's ServiceLoader. (pull 3191)