Changelog

Major enhancement

Switch Remoting/XStream denylist to an allowlist. JENKINS-47736 , upgrade guidelines for admins and plugin maintainers, list of plugins known to be impacted
Use Java NIO library instead of native code to create and detect symbolic links and Windows junctions to improve compatibility and robustness. JENKINS-36088 , JENKINS-39179
Update Remoting from 3.14 to 3.17 to integrate multiple fixes and improvements. full changelog, JENKINS-37566 , JENKINS-37670 , JENKINS-38696 , JENKINS-46724 , JENKINS-47965 , JENKINS-48055 , JENKINS-48130 , JENKINS-48133 , JENKINS-48309 , JENKINS-47736 , JENKINS-48686 , JENKINS-27035 , JENKINS-49027

Enhancement

Jenkins now creates XML 1.1 files to be more accepting of unusual contents. JENKINS-48463
Use Java NIO to read and write Unix file permissions by default. The previous behavior can be restored by setting the Java system property hudson.Util.useNativeChmodAndMode to true. JENKINS-36088 , Jenkins features controlled by system properties
Improve robustness and error handling of various file operations by switching to NIO. JENKINS-47324 , JENKINS-48405
Remove support for unbounded number of SCM polling threads. Previously, the default was infinite and could be set to between 10 and 100. Existing installations with unbounded SCM polling threads will now use the default of 10, and it is no longer possible to use a value outside of this range. pull 3258
Do not require CSRF crumb to be provided when the request is authenticated using API token. JENKINS-22474
Introduce new hudson.lifecycle.ExitLifecycle to exit instead of restart. JENKINS-47043 , Jenkins features controlled by system properties
Upgrade Executable War from 1.36 to 1.37 to allow supplying jenkins.war command-line arguments via standard input using the --paramsFromStdIn parameter. pull 3223, documentation
Update SSHD Module 2.0 to 2.4 to update Apache Mina SSHD Core from 1.6.0 to 1.7.0, and fire authentication events in SecurityListeners when a user connects using SSH. pull 3278, pull 3111, SSHD module changelog
Export assignedLabels for agents and labelExpression for applicable job types in remote API. JENKINS-25286
Re-style the Manage Jenkins page, including administrative monitors. JENKINS-43786 , blog post
Define a minimum required version of the Remoting library (agent communication) and print warnings when an older version is connecting. pull 3250
When Jenkins fails to load plugins, show failures that users need to take action on separate from those due to other plugins failing to load. pull 3256
Developer: Jenkins#getInstance() is now deprecated as its semantics have been a source of confusion for some time. Use #get() in typical cases and Jenkins#getInstanceOrNull() in rare cases (see Javadoc). JENKINS-48638
Developer: Deprecate the ambiguous User#getUser(String) in favor of the User#getById() or the new User#getOrCreateByIdOrFullName() methods. JENKINS-47718
Developer: Capture more authentication-related events in SecurityListener. JENKINS-27027
Developer: Deprecate hudson.util.Service in favor of Java's ServiceLoader. pull 3191

Major bug fix

Updating Jenkins jobs and views by XML left fields at their old value if not defined in the new XML. JENKINS-21017

Bug fix

Fix HTTP 404 error when clicking on New View sidebar link from another view. JENKINS-48447
Upgrade Executable War from 1.36 to 1.37 to prevent multiple copies of winstone-*.jar in the temp folder from using up disk space needlessly. JENKINS-22088
Update to task reactor version 1.5 to prevent hanging of Jenkins on startup/reload when an initialization task throws an unhandled exception. JENKINS-48725 , full changelog

Changelog for 2.107.1