Changelog for 2.414.3

Legend:

security fix
major bug fix
bug fix
major enhancement
enhancement

Community feedback:

no major issues
notable issues
required rollback

What's new in 2.414.3 (2023-10-18)

Short tags (without "jdk" in them) such as jenkins/jenkins:2.414.3-alpine are using Java 17 and not Java 11 like previously. If you need to keep using Java 11, use tags like jenkins/jenkins:2.414.3-jdk11. Also note that two new tags (2.414.3-alpine-jdk17 & 2.414.3-slim-jdk17) have been published without any content change a week later than the original ones.

Important security fix. (security advisory)
Use Java 17 as the default Java version in container images that do not specify a Java version in the container label. (Docker pull request 1724)
Update commons-compress from 1.23.0 to 1.24.0. (Apache Commons Compress 1.24.0 Release Notes)
Do not create a large number of threads when making numerous HTTP requests. (issue 72016)
Reduce high memory usage from XStream2.AssociatedConverterImpl (regression in 2.405). (issue 72076)
Add telemetry collecting basic information about the security configuration. (issue 71996)
Upgrade Winstone from 6.12 to 6.14. This includes the upgrade of Jetty from 10.0.15 to 10.0.17. The Jetty upgrade includes fixes for several CVEs. (Winstone 6.13 changelog, Winstone 6.14 changelog, Jetty 10.0.16 changelog, Jetty 10.0.17 changelog, CVE-2023-44487)
Restore context menus of model links in build history views and administrative monitors (regression in 2.402). (issue 71890)