Merge branch 'master' into use-layer-system

.editorconfig

@@ -1,6 +1,6 @@
 root = true
 
-[*.{js, scss, css, hbs}]
+[*.{js, scss, css, hbs, svg}]
 indent_style = space
 indent_size = 2
 trim_trailing_whitespace = true

.github/PULL_REQUEST_TEMPLATE.md

@@ -28,12 +28,17 @@ For refactoring and code cleanup changes, exercise the code before and after the
 
 ### Proposed changelog entries
 
-- Entry 1: Issue, human-readable text
-- […]
+- JENKINS-XXXXX, human-readable text
 
 <!-- Comment:
 The changelog entry should be in the imperative mood; e.g., write "do this"/"return that" rather than "does this"/"returns that".
 For examples, see: https://www.jenkins.io/changelog/
+
+Remove JENKINS-XXXXX if there is no issue for the pull request.
+
+You may add multiple changelog entries if applicable by adding a new entry to the list, e.g.
+- JENKINS-123456, First changelog entry
+- Second changelog entry
 -->
 
 ### Proposed upgrade guidelines

.github/dependabot.yml

@@ -58,7 +58,7 @@ updates:
         versions: [">=7.0.0"]
   - package-ecosystem: "maven"
     directory: "/"
-    target-branch: "stable-2.414"
+    target-branch: "stable-2.426"
     labels:
       - "into-lts"
       - "needs-justification"

.github/renovate.json

@@ -16,7 +16,7 @@
     },
     {
       "matchPackageNames": ["node"],
-      "allowedVersions": "/18.[0-9]+.[0-9]+(.[0-9]+)?$/"
+      "allowedVersions": "/20.[0-9]+.[0-9]+(.[0-9]+)?$/"
     }
   ],
   "regexManagers": [

.github/workflows/changelog.yml

@@ -44,14 +44,17 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'jenkinsci'
     steps:
-      - uses: tibdex/github-app-token@v1
+      - uses: tibdex/github-app-token@v2
         id: generate-token
         with:
           app_id: ${{ secrets.JENKINS_CHANGELOG_UPDATER_APP_ID }}
+          installation_retrieval_mode: repository
+          installation_retrieval_payload: jenkins-infra/jenkins.io
           private_key: ${{ secrets.JENKINS_CHANGELOG_UPDATER_PRIVATE_KEY }}
-          repository: jenkins-infra/jenkins.io
+          repositories: >-
+            ["jenkins.io"]
       - name: Check out
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Publish jenkins.io changelog draft

.github/workflows/label-lts-prs.yaml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Check if PR targets LTS branch
         if: startsWith(github.event.pull_request.base.ref, 'stable-')
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/publish-release-artifact.yml

@@ -13,10 +13,11 @@ jobs:
     outputs:
       project-version: ${{ steps.set-version.outputs.project-version }}
       is-lts: ${{ steps.set-version.outputs.is-lts }}
+      is-rc: ${{ steps.set-version.outputs.is-rc }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set up JDK 11
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: "temurin"
           java-version: 11
@@ -34,16 +35,23 @@ jobs:
             is_lts=false
           fi
 
-          echo "Version is $version, is_lts: $is_lts"
+          is_rc=false
+          if [[ ${version} == *"-SNAPSHOT" ]]; then
+            is_rc=true
+          fi
+
+          echo "Version is $version, is_lts: $is_lts, is_rc: $is_rc"
 
           echo "is-lts=${is_lts}" >> $GITHUB_OUTPUT
           echo "project-version=$version" >> $GITHUB_OUTPUT
+          echo "is-rc=${is_rc}" >> $GITHUB_OUTPUT
   war:
     permissions:
       contents: write # to upload release asset (softprops/action-gh-release)
 
     runs-on: ubuntu-latest
     needs: determine-version
+    if: ${{ needs.determine-version.outputs.is-rc == 'false' }}
     steps:
       - name: Fetch war
         id: fetch-war
@@ -76,6 +84,7 @@ jobs:
 
     runs-on: ubuntu-latest
     needs: determine-version
+    if: ${{ needs.determine-version.outputs.is-rc == 'false' }}
     steps:
       - name: Fetch Deb
         id: fetch-deb
@@ -110,6 +119,7 @@ jobs:
 
     runs-on: ubuntu-latest
     needs: determine-version
+    if: ${{ needs.determine-version.outputs.is-rc == 'false' }}
     steps:
       - name: Fetch RPM
         id: fetch-rpm
@@ -145,6 +155,7 @@ jobs:
 
     runs-on: ubuntu-latest
     needs: determine-version
+    if: ${{ needs.determine-version.outputs.is-rc == 'false' }}
     steps:
       - name: Fetch MSI
         id: fetch-msi
@@ -180,6 +191,7 @@ jobs:
 
     runs-on: ubuntu-latest
     needs: determine-version
+    if: ${{ needs.determine-version.outputs.is-rc == 'false' }}
     steps:
       - name: Fetch suse rpm
         id: fetch-suse-rpm

.gitpod/Dockerfile

@@ -1,6 +1,6 @@
 FROM gitpod/workspace-full
 
-ARG MAVEN_VERSION=3.9.4
+ARG MAVEN_VERSION=3.9.6
 
 RUN brew install gh && \
     bash -c ". /home/gitpod/.sdkman/bin/sdkman-init.sh && sdk install maven ${MAVEN_VERSION} && sdk default maven ${MAVEN_VERSION}"

CONTRIBUTING.md

@@ -14,7 +14,7 @@ This page provides information about contributing code to the Jenkins core codeb
    - Apache Maven 3.8.1 or above. You can [download Maven here](https://maven.apache.org/download.cgi).
      In the Jenkins project we usually use the most recent Maven release.
    - Any IDE which supports importing Maven projects.
-   - Install [Node.js 18.x](https://nodejs.org/en/). **Note:** only needed to work on the frontend assets found in the `war` module.
+   - Install [Node.js 20.x](https://nodejs.org/en/). **Note:** only needed to work on the frontend assets found in the `war` module.
      - Frontend tasks are run using [yarn](https://yarnpkg.com/). Run `npm install -g yarn` to install it.
 4. Set up your development environment as described in [Preparing for Plugin Development](https://www.jenkins.io/doc/developer/tutorial/prepare/)
 

README.md

@@ -1,5 +1,5 @@
 <a href="https://jenkins.io">
-    <img width="400" src="https://www.jenkins.io/images/jenkins-logo-title-dark.svg">
+    <img width="400" src="https://www.jenkins.io/images/jenkins-logo-title-dark.svg" alt="Jenkins logo"> 
 </a>
 
 # About
@@ -8,6 +8,7 @@
 [![Jenkins LTS Release](https://img.shields.io/endpoint?url=https%3A%2F%2Fwww.jenkins.io%2Fchangelog-stable%2Fbadge.json)](https://www.jenkins.io/changelog-stable)
 [![Docker Pulls](https://img.shields.io/docker/pulls/jenkins/jenkins.svg)](https://hub.docker.com/r/jenkins/jenkins/)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/3538/badge)](https://bestpractices.coreinfrastructure.org/projects/3538)
+[![Gitter](https://img.shields.io/gitter/room/jenkinsci/jenkins)](https://app.gitter.im/#/room/#jenkinsci_jenkins:gitter.im)
 
 In a nutshell, Jenkins is the leading open-source automation server.
 Built with Java, it provides over 1,800 [plugins](https://plugins.jenkins.io/) to support automating virtually anything,

ath.sh

@@ -6,7 +6,7 @@ set -o xtrace
 cd "$(dirname "$0")"
 
 # https://github.com/jenkinsci/acceptance-test-harness/releases
-export ATH_VERSION=5699.v27deb_ef5796c
+export ATH_VERSION=5740.vd30f30408987
 
 if [[ $# -eq 0 ]]; then
 	export JDK=17

bom/pom.xml

@@ -38,9 +38,9 @@ THE SOFTWARE.
   <description>The module contains dependencies that are used by a specific Jenkins version</description>
 
   <properties>
-    <asm.version>9.5</asm.version>
-    <slf4jVersion>2.0.7</slf4jVersion>
-    <stapler.version>1802.v9e2750160d01</stapler.version>
+    <asm.version>9.6</asm.version>
+    <slf4jVersion>2.0.9</slf4jVersion>
+    <stapler.version>1822.v120278426e1c</stapler.version>
     <groovy.version>2.4.21</groovy.version>
   </properties>
 
@@ -56,15 +56,15 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>5.3.29</version>
+        <version>5.3.31</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <dependency>
         <!-- https://docs.spring.io/spring-security/site/docs/5.5.4/reference/html5/#getting-maven-no-boot -->
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-bom</artifactId>
-        <version>5.8.6</version>
+        <version>5.8.8</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -82,7 +82,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
-        <version>32.1.2-jre</version>
+        <version>32.1.3-jre</version>
       </dependency>
       <dependency>
         <!-- Overriding Stapler’s 1.1.3 version to diagnose JENKINS-20618: -->
@@ -128,7 +128,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.13.0</version>
+        <version>2.15.1</version>
       </dependency>
       <dependency>
         <groupId>commons-jelly</groupId>
@@ -175,12 +175,6 @@ THE SOFTWARE.
         <artifactId>jcip-annotations</artifactId>
         <version>1.0</version>
       </dependency>
-      <!-- TODO remove after determining this will not break plugins -->
-      <dependency>
-        <groupId>net.sf.kxml</groupId>
-        <artifactId>kxml2</artifactId>
-        <version>2.3.0</version>
-      </dependency>
       <dependency>
         <groupId>org.antlr</groupId>
         <artifactId>antlr4-runtime</artifactId>
@@ -194,7 +188,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.23.0</version>
+        <version>1.25.0</version>
       </dependency>
       <dependency>
         <groupId>org.codehaus.groovy</groupId>
@@ -312,11 +306,6 @@ THE SOFTWARE.
         <artifactId>stapler-adjunct-codemirror</artifactId>
         <version>1.3</version>
       </dependency>
-      <dependency>
-        <groupId>org.kohsuke.stapler</groupId>
-        <artifactId>stapler-adjunct-timeline</artifactId>
-        <version>1.5</version>
-      </dependency>
       <dependency>
         <groupId>org.kohsuke.stapler</groupId>
         <artifactId>stapler-groovy</artifactId>
@@ -377,7 +366,7 @@ THE SOFTWARE.
         <!-- provided by jcl-over-slf4j -->
         <groupId>commons-logging</groupId>
         <artifactId>commons-logging</artifactId>
-        <version>1.2</version>
+        <version>1.3.0</version>
         <scope>provided</scope>
       </dependency>
     </dependencies>

cli/pom.xml

@@ -15,7 +15,7 @@
   <url>https://github.com/jenkinsci/jenkins</url>
 
   <properties>
-    <mina-sshd.version>2.10.0</mina-sshd.version>
+    <mina-sshd.version>2.11.0</mina-sshd.version>
     <!-- Filled in by jacoco-maven-plugin -->
     <jacocoSurefireArgs />
   </properties>
@@ -65,7 +65,7 @@
     <dependency>
       <groupId>org.glassfish.tyrus.bundles</groupId>
       <artifactId>tyrus-standalone-client-jdk</artifactId>
-      <version>2.1.3</version>
+      <version>2.1.4</version>
       <optional>true</optional>
     </dependency>
     <dependency>
@@ -119,7 +119,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>
-        <version>3.5.0</version>
+        <version>3.5.1</version>
         <executions>
           <execution>
             <goals>

cli/src/test/java/hudson/cli/PrivateKeyProviderTest.java

@@ -42,7 +42,7 @@ private void assertKeyPairNotNull(File file, String password) throws IOException
     }
 
     /**
-    key command: ssh-keygen -f dsa-password -t dsa -b 1024 -m PEM -p password
+    key command: ssh-keygen -f dsa-password -t dsa -b 1024 -m PEM -P password
     */
     @Test
     public void loadKeyDSAPassword() throws IOException, GeneralSecurityException {
@@ -61,7 +61,7 @@ public void loadKeyRSA() throws IOException, GeneralSecurityException {
     }
 
     /**
-    key command: ssh-keygen -f rsa-password -t rsa -b 1024 -m PEM -p password
+    key command: ssh-keygen -f rsa-password -t rsa -b 1024 -m PEM -P password
     */
     @Test
     public void loadKeyRSAPassword() throws IOException, GeneralSecurityException {
@@ -80,7 +80,7 @@ public void loadKeyOpenSSH() throws IOException, GeneralSecurityException {
     }
 
     /**
-     key command: ssh-keygen -f openssh-unsupported -t rsa -b 1024 -m PKCS8 -p password
+     key command: ssh-keygen -f openssh-unsupported -t rsa -b 1024 -m PKCS8 -P password
      */
     @Test
     public void loadKeyOpenSSHPKCS8() throws IOException, GeneralSecurityException {

core/pom.xml

@@ -265,11 +265,6 @@ THE SOFTWARE.
       <groupId>net.jcip</groupId>
       <artifactId>jcip-annotations</artifactId>
     </dependency>
-    <!-- TODO remove after determining this will not break plugins -->
-    <dependency>
-      <groupId>net.sf.kxml</groupId>
-      <artifactId>kxml2</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.antlr</groupId>
       <artifactId>antlr4-runtime</artifactId>
@@ -384,10 +379,6 @@ THE SOFTWARE.
       <groupId>org.kohsuke.stapler</groupId>
       <artifactId>stapler-adjunct-codemirror</artifactId>
     </dependency>
-    <dependency>
-      <groupId>org.kohsuke.stapler</groupId>
-      <artifactId>stapler-adjunct-timeline</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.kohsuke.stapler</groupId>
       <artifactId>stapler-groovy</artifactId>
@@ -500,14 +491,6 @@ THE SOFTWARE.
       <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <!-- this helps us see the source code of the control while we edit Jenkins -->
-      <groupId>org.kohsuke.stapler</groupId>
-      <artifactId>stapler-adjunct-timeline</artifactId>
-      <version>1.5</version>
-      <classifier>tests</classifier>
-      <scope>test</scope>
-    </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>

core/src/main/java/hudson/ClassicPluginStrategy.java

@@ -290,6 +290,10 @@ protected ClassLoader createClassLoader(List<File> paths, ClassLoader parent, At
 
         List<URL> urls = new ArrayList<>();
         for (File path : paths) {
+            if (path.getName().startsWith("jenkins-test-harness")) {
+                throw new IllegalStateException("Refusing to load the Jenkins test harness in production (via "
+                        + atts.getValue("Short-Name") + ")");
+            }
             urls.add(path.toURI().toURL());
         }
         URLClassLoader2 classLoader;