Changelog for 2.426.1

Legend:

security fix
major bug fix
bug fix
major enhancement
enhancement

Community feedback:

no major issues
notable issues
required rollback

What's new in 2.426.1 (2023-11-15)

Short container image tags (without "jdk" in them) such as jenkins/jenkins:2.426.1 are now using Java 17. If you need to continue using Java 11, use tags like jenkins/jenkins:2.426.1-jdk11. The Windows container images of this release switch from a windowsservercore-1809 Temurin base image to a windowsservercore-ltsc2019 Microsoft base image. Note also that a proper set of tags is now published for these Windows images and they include "ltsc2019" instead of only "2019".

Changes since 2.426:

Show form validation results for form elements that are initially hidden. Remove previous form validation errors when the form validation is updated with new content (regression in 2.355). (issue 71252 , issue 70793 )
Fix multibranch Pipeline Add source and other uses that mix inputs and buttons (regression in 2.422). (issue 72170)
Add sleep call when -noReconnect is not specified for Kubernetes agents. (Remoting PR 675)
Add proxy support for Remoting. (issue 65368)
Fix agent allocation due to label issue detected by vSphere Cloud plugin (regression in 2.421). (issue 71937)
Fix drag and drop handle for existing repeatables (regression in 2.335). (issue 72189)
Add telemetry for Jenkins uptime. (issue 72248)
Upgrade Winstone from 6.12 to 6.14. This includes the upgrade of Jetty from 10.0.15 to 10.0.17. The Jetty upgrade includes fixes for several CVEs. (Winstone 6.13 changelog, Winstone 6.14 changelog, Jetty 10.0.16 changelog, Jetty 10.0.17 changelog, CVE-2023-44487)
Show the description of boolean build parameter values on the Parameters view (regression in 2.179). (issue 72179)
Allow clouds to be reordered. This was previously possible, but disappeared when the cloud management was moved to a separate page (regression in 2.403). (issue 72020)
Update SnakeYAML plugin to 2.2 to silence security scanners. (issue 70994)

Notable changes since 2.414.3:

Important security fixes. (2023-09-20 security advisory, 2023-07-26 security advisory)
Support Java 21 in addition to Java 11 and Java 17. (issue 71800 , Java 21 supported in 2.426.1)
Remove outdated Prototype.js library. (issue 70906 , pull 7781, Prototype removal blog post)
Stop delivering CentOS 7 container images as part of the end of support for Red Hat Enterprise Linux 7 and its derivatives. (Red Hat Enterprise Linux 7 and CentOS 7 end of life blog post, Docker pull request 1777)
Replace browser confirm with modal dialogs in many places. Add API for alert, confirm, prompt, modal and form dialogs. (issue 71438)
Updates to various UI elements. Modernize buttons, menus, link design, and content blocks. (pull 8381, pull 8376, pull 8375, pull 8363, pull 8180)
Add Appearance system configuration page to customize Jenkins' look and feel. (pull 8403)
Various performance optimizations. Optimizations for loading, label parsing, and project deletion. (pull 8494, pull 8395, pull 8299)
Prevent incorrect readResolve implementations from breaking agent label parsing. (pull 8448)
Automate the display of an administrative monitor when approaching Java end of life (EOL) dates. (pull 8526)
Remove System V initialization scripts from RPM based installers. The System V initialization scripts were replaced in March 2022 with systemd initialization. RPM users with a custom log directory no longer have a logrotate(8) configuration out-of-the-box. (pull 409 (packaging), Linux install packages migrated from System V init to systemd)
Add a nicer 404 error page. (issue 71087)
The minimum required Remoting version has been increased from 4.7 to 4.13. (pull 8503)
List plugins in deterministic order to improve diagnosability of plugin linkage errors. (issue 71950)
Display a notice when plugin updates are available or when there are no plugins installed. (pull 8208)
Remove the treeview option for artifactList. (issue 71054)
Log agent usage by job. (pull 8283)
Make tab panes accessible via keyboard. (issue 71496)
Add allow-same-origin to the sandbox ContentSecurityPolicy directive of workspace and artifact browsers if the Resource Root URL feature is not used. Allow requests to resources like stylesheets and images, even if a reverse proxy prohibits cross-site requests. (issue 71366)
Add last build status to job page. (pull 8129)
Updates to Turkish localization for jobs. (pull 8368)
Remove the rebuild plugin from the setup wizard plugin selection. (pull 8258)
Stop shipping net.sf.kxml:kxml2 because Jenkins no longer depends on it. (pull 8503)
Fix invalid CSS which caused some buttons to become invisible on hover. (issue 71479)
Reduce high memory usage from XStream2.AssociatedConverterImpl. (issue 72067)
Prevent log spam when using the Jenkins security database and users signup. (pull 8474)
Show a confirmation popup when triggering a task action from a context menu. (issue 71880)
Hide the delete button from the only repeatable element in configuration forms when at least one element is expected. (issue 72018)
Do not create a large number of threads when making numerous HTTP requests. (issue 72016)
Symbols display in breadcrumbs now. (issue 71983)
Message no longer appears twice when the agentLog option is used. (issue 38520)
Hide administrative monitors icons/popup in the header of Manage Jenkins, as they're shown directly on the page. (issue 71848)
Fix link to job in the message informing administrators of trigger computations that run for an unusually long time. (issue 71833)
Use standard size node icon even with long node names. (pull 8089)
Add the X-Content-Type-Options HTTP header to the response from the agent listener. Silence security scanners that incorrectly report an issue when the HTTP header is missing. (issue 71186)
Only disable the plugin manager "install" button if no plugins are selected. (issue 71698)
Estimate project duration accurately in more cases. (pull 8233)