Apache Commons Lang 2 removed from Jenkins core The Apache Commons Lang 2.6 library has been removed from Jenkins core. The Apache project last released Commons Lang 2.6 on January 16, 2011. The 2.x line is no longer maintained and includes known vulnerabilities that trigger software content analysis security scanners.
Many Jenkins plugins previously relied on Jenkins core to provide this library rather than declaring it as their own dependency. New releases have been published for most affected plugins that now provide their own dependency or otherwise no longer require Apache Commons Lang 2. Pull requests have been submitted for other plugins so that they no longer require Apache Commons Lang 2. Plugin that used Apache Commons Lang 2 are listed in the tracking spreadsheet.
Before upgrading Jenkins, upgrade your installed plugins to their most recent releases. In particular, make sure that plugins that previously depended on Commons Lang 2 have been updated. An outdated plugin may fail to load or may not function correctly after upgrading Jenkins because the Apache Commons Lang 2 classes are no longer provided by Jenkins core.
Jenkins plugin developers should ensure that plugins do not rely on Commons Lang 2 being provided by Jenkins core. The Jenkins plugin build tooling can help prevent new dependencies on Commons Lang 2.
Windows Server 2019 agent container images dropped
Container images (jenkins/inbound-agent and jenkins/ssh-agent) are no longer provided for Windows Server 2019. Users with Windows Server 2019 container agents may either:
- Upgrade to Windows Server 2022
- Upgrade to Windows Server 2025
- Build their own agent container image for Windows Server 2019