Jenkins 2.574 - Pipeline Restart and Session Fixes

Jenkins 2.574, tagged jenkins-2.574, was published on July 21, 2026. The main operator facing fix prevents a null pointer failure after a controller restart when UpstreamCause refers to a Pipeline job, preserving a critical path for build provenance.

The full release notes and downloads are on the GitHub release page.

The restart fix targets an NPE involving UpstreamCause when the upstream build is a Pipeline job. This is the change to watch on controllers that restart during long running delivery flows or retain chains of downstream jobs. A cause record connects a build to the job that triggered it, so a failure while resolving that record can break inspection of execution history after the controller returns.

The notes describe the trigger narrowly. They do not claim a general Pipeline durability change, a new persistence format, or a repair step for stored build records. Operators should test the release against jobs that use upstream triggers and inspect cause data after a controlled controller restart. That keeps validation aligned with the actual fix.

Jenkins 2.574 also corrects PackedMap.values(). The method returned keys rather than values. That violates the collection contract and can send the wrong object set to callers even when the map itself is populated correctly. The release notes do not identify affected call sites, so this is best treated as a core correctness fix instead of evidence of a specific user visible failure.

The Jakarta HttpSessionListener bridge now delegates sessionDestroyed to the destruction callback. Before this release, it delegated that event to sessionCreated. For plugins or integrations that use session lifecycle callbacks, the old behavior could run creation logic at teardown and omit the expected cleanup path.

That fix is small in code shape but relevant to controller state. Session cleanup often sits far from the original request, which makes a reversed callback difficult to diagnose from an authentication symptom alone. Plugin owners with custom listeners should verify both callback counts and cleanup behavior under login, logout, and session expiry tests.

Remember me token validity is now configurable through a system property. This gives operators a controller level policy control instead of a fixed validity period. The generated notes do not provide the property name or its default, so they are not sufficient for copying a startup argument into production. Confirm the exact key and semantics in the official Jenkins changelog before changing controller arguments, then exercise token expiry in a staging controller.

The shipped WAR excludes an unused Bouncy Castle JAR. This reduces the controller artifact without claiming a change to cryptographic behavior. No byte count, startup result, or memory measurement is included in the notes, so the operational conclusion should stay narrow: image layers and artifact transfers contain one less unused library.

For immutable controller images, compare the resolved WAR and plugin set in the normal promotion pipeline. The release does not document a migration step or a breaking configuration change. Existing security scans may still show a package inventory difference because the unused JAR is no longer present.