Jenkins 2.571 - Script Security And Task Log Fixes

Jenkins jenkins-2.571 was published on July 1, 2026, with the bundled script-security update to 1402.1405 as the change most likely to matter during a controlled CI rollout. For data teams that still run extract, load, publication, or validation jobs through Jenkins, this release is mostly controller maintenance: plugin currency, operating system lifecycle data, task log completion, and a few Manage Jenkins fixes. It is not marked as a prerelease.

The full release notes and downloads are on the GitHub release page.

The bundled script-security dependency moves to 1402.1405. The release notes do not list policy changes, so this should be treated as a dependency movement rather than a new Pipeline feature. It still belongs in the canary lane for controllers that run shared libraries, sandboxed Groovy, credential bindings, or internal deployment jobs.

That matters for data engineering teams because Jenkins often sits between schedulers and mutable systems. A nightly warehouse load may call shell scripts, use credentials, touch workspaces, and publish artifacts from the same Pipeline. A script security update can expose old approvals or plugin interactions even when the release notes are quiet. The practical test is simple: run representative jobs that cover shared library calls, credential use, and workspace cleanup before moving the controller that owns production jobs.

Jenkins also updates operating system end of life data. That does not replace old agents or change a controller base image by itself. It changes the support context that Jenkins can report around platforms. For operators, the useful follow up is to compare that data with actual controller and agent inventory, especially any long running Windows or Linux images that survive because nobody wants to touch brittle jobs.

The System Log page under Manage Jenkins was refined. This is a UI surface, but it is still operator relevant. During queue stalls, plugin warnings, failed starts, or controller restarts, the system log is one of the first places people check. Less friction there is small, but it is not irrelevant.

The more interesting control flow fix is in TaskThread.run(), where log.markAsComplete() moved into a finally block. The notes do not describe a user visible failure mode, so avoid turning this into a larger claim. Still, the pattern is clear. A task log should be marked complete even when the thread exits through an error path.

For platform teams, incomplete logs waste time. They make a failed job look like a stuck job, or make a cleanup failure look like missing output. This change is internal, but it is exactly the kind of defensive path that reduces false leads during incident review.

The PathRemover retry failure message now has correct pluralization. That is not a pipeline behavior change. It is cleaner diagnostic text around retry failure, which matters when workspace deletion or artifact cleanup is already failing and the log needs to tell a human what happened.

Jenkins also fixes breadcrumb overflow dropdown rendering and an Apply click animation artifact tracked in the Jenkins issue. These are navigation and presentation defects. They should not alter job scheduling, executor behavior, SCM polling, or artifact retention. Treat them as controller UI cleanup, useful mostly because operator interfaces are read under pressure.

The release notes include a small set of changes, and some of them are plainly UI work. The parts worth scheduling around are the script-security update, platform lifecycle data, and the TaskThread.run() log completion path. The rest should be verified as part of ordinary smoke tests after restart.