Changelog for 2.277.1

Legend:

security fix
major bug fix
bug fix
major enhancement
enhancement

Community feedback:

no major issues
notable issues
required rollback

What's new in 2.277.1 (2021-03-10)

As described in the Major changes in the weekly release line blog post, this release improves key user interface components. Configuration user interfaces now use html div markup to present a better layout than the previous html table layout. Configuration pages are now easier to read, easier to understand, and work better on a wide range of screens. See the Jenkins issue tracker for a list of plugins known to have issues with the change.

As described in the Spring and XStream updates (breaking changes!) blog post, this release updates and replaces outdated internal components. The Acegi security library used for authentication has been replaced by Spring Security (JEP-227). See the Spring Security compatibility table for the latest plugin compatibility status. A fork of the XStream library used to read and write XML files has been replaced by the upstream version of XStream (JEP-228). See the XStream compatibility table for the latest plugin compatibility status.

Known IssuesIf your Jenkins instance was created before Jenkins 2.4 or 2.7.1 LTS, a Setup Wizard may appear on the startup after the upgrade. In such a case, a Jenkins admin may need to skip the plugin installation. See the upgrade guide for the detailed guidelines.

Changes since 2.277:

Important security fix. This vulnerability does not exist in any Jenkins LTS release. It was discovered in a weekly release and fixed in a weekly release without being part of an LTS release. (security advisory, Spring Security 5.4.4 release notes, Spring Security 5.4.3 release notes)
Show available plugin updates by reloading update center data on upgrade/downgrade. (issue 41727)
Fix Internet Explorer 11 rendering of the Available plugins tab (regression in 2.270). (issue 64805)
Include 'plugin-id' and 'plugin-version' data attributes in the Available plugins tab (regression in 2.270). (issue 64775)
Fix plugin search over multiple update sites (regression in 2.270). (issue 64840)
Restore, as deprecated, the old constructor based on acegisecurity Authentication parameter in order to keep backward compatibility. (issue 64746 , pull 5216, Spring Security 5.4.2 release notes)

Notable changes since 2.263.4:

Change Jenkins configuration UI from tables to divs for layout in forms. (issue 56109 , pull 3895, Table to div layout migration guide)
Massive performance enhancement to available plugins page of Plugin Manager. Exact matches of plugin name are moved to the top. (issue 64196)
Fix incorrect striping of rows on available page of Plugin Manager. (issue 63684)
Prevent user input of 'e' or 'E' as 'positive-number', 'non-negative-number', or 'number'. (issue 64439)
Change the standard URL for obtaining the inbound agent configuration file from ${agent_url}/slave-agent.jnlp to ${agent_url}/jenkins-agent.jnlp. The old name is obsolete and will be removed at a future time. (issue 35452)
Improve performance of authorisation strategies when the authentication realm is case insensitive. (issue 64039)
Add the ability to specify a reason for quieting down Jenkins ("Prepare for shutdown"). (issue 1877)
Dropped support for deprecated system properties: hudson.model.Hudson.logStartupPerformance, hudson.model.Hudson.initLogLevel, hudson.model.Hudson.parallelLoad, hudson.model.Hudson.killAfterLoad and hudson.model.Hudson.workspaceDirName. Please use jenkins.model.Jenkins.-prefixed SystemProperties. (pull 4962)
Remove administrative monitor offering to migrate $JENKINS_HOME on a ZFS filesystem. (pull 5047)
Show security and non-security notifications in separate categories with their associated icons. (issue 63977)
Reduce page load time by loading the administrative monitors popup on demand. Allow keyboard navigation even when there are active administrative monitors. (pull 5063)
Use a more accessible color palette in configuration form tabs. (pull 5176)
Improve fingerprint save performance. (pull 5190, pull 5198, issue 64670 )
Add a system property jenkins.agent.inboundUrl to provide an alternate URL for inbound TCP agents. (issue 63222)
Drop support for deprecated system properties: hudson.model.Hudson.logStartupPerformance, hudson.model.Hudson.initLogLevel, hudson.model.Hudson.parallelLoad, hudson.model.Hudson.killAfterLoad and hudson.model.Hudson.workspaceDirName. Please use jenkins.model.Jenkins.-prefixed SystemProperties. (pull 4962)
Reduce lock contention around Jenkins queue. (issue 58101)
Stop bundling CVS plugin. Jenkins will no longer automatically install CVS plugin on startup if a plugin depending on Jenkins (then Hudson) 1.340 or earlier is discovered. If you use a plugin that relies on the functionality provided by CVS plugin and manage plugins outside the Jenkins plugin manager, you will now need to ensure yourself that a recent release of CVS plugin is installed. Jenkins will attempt to load such plugins but may fail at any time during startup or afterwards with ClassNotFoundException or similar. (pull 5102)
Winstone 5.15: Update Jetty from 9.4.30.v20200611 to 9.4.38.v20210224 for bug fixes and enhancements. (issue 64035 , pull 5034, pull 5122, pull 5332, Winstone 5.12 changelog, Winstone 5.13 changelog, Winstone 5.14 changelog, Winstone 5.15 changelog, Jetty 9.4.31.v20200723 changelog, Jetty 9.4.32.v20200930 changelog, Jetty 9.4.33.v20201020 changelog, Jetty 9.4.34 changelog, Jetty 9.4.35 changelog, Jetty 9.4.36 changelog, Jetty 9.4.37 changelog, Jetty 9.4.38 changelog)
Upgrade from Remoting 4.5 to Remoting 4.6 with bugfixes and dependency updates. (pull 5043, Remoting 4.6 changelog)
Update stapler to 1.262 to fix a number of IllegalReflectiveAccessWarnings when running on Java 11. (pull 5111, Stapler 1.262 changelog)
Update jnr-posix library from 3.0.45 to 3.1.4. (pull 5129, Commits from jnr-posix 3.0.45 to 3.1.4)
Update Java native access (jna) library from 5.3.1 to 5.6.0 for more recent platform library fixes and enhancements. (pull 5125, JNA 5.6.0 changelog, JNA 5.5.0 changelog, JNA 5.4.0 changelog)
Developer: Use an updated version of the XStream serialization library without custom patches. (pull 4944, pull 5115, JEP-227, Spring and XStream updates (breaking changes!) blog post, XStream 1.4.14 changelog, XStream 1.4.15 changelog)
Developer: Use Spring Security rather than its predecessor, Acegi Security. Other bundled Spring libraries are also updated. (pull 4948, pull 5166, JEP-228, Spring and XStream updates (breaking changes!) blog post, Spring Security 5.4.2 release notes)
Developer: Upgrade jQuery from 2.1.4 to 3.5.1. (pull 4929, jQuery older release notes (3.1.1, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1), jQuery 3.5.0 release notes, jQuery 3.5.1 release notes)