Jenkins 2.579 - Commons Lang 2 Removed From Core

Jenkins weekly 2.579 published on 25 August 2026. The change that matters for anyone running batch jobs on a Jenkins controller is not a new pipeline step. Core no longer ships commons-lang:2.6, so plugins that imported Apache Commons Lang 2 from the controller classpath will fail to load or fail at runtime.

The full release notes and downloads are on the GitHub release page. Weekly readers should also use the official changelog, which the GitHub notes treat as the canonical text.

Pull request 26105 removes Apache Commons Lang 2.6 from Jenkins core. Apache last shipped a 2.x release on 16 January 2011. The line is unmaintained. Content scanners flag known issues in that jar. For more than a decade, many plugins called org.apache.commons.lang.StringUtils and related 2.x types without declaring the library, because core put it on the shared classpath.

After this weekly those classes are gone from the war. An outdated plugin now surfaces ClassNotFoundException for org.apache.commons.lang.StringUtils or BooleanUtils instead of quietly resolving the type from core. The upgrade text is explicit: update installed plugins to their latest releases before you bump the controller. Plugin authors must stop treating core as a Lang 2 provider. The Jenkins plugin POM can reject new 2.x imports so the contract does not drift back in.

This is a classpath break, not an internal refactor you can ignore. Controllers with a long tail of unmaintained plugins are the blast radius.

Tool installation now retries the renamedTo operation up to 5 times before it gives up. Pull request 11216 landed because hudson.FilePath.MoveAllChildrenTo was throwing IOException: Failed to rename after DownloadFromUrlInstaller.performInstallation unpacked a tool tree. Freshly written files were not always visible to the following rename, especially on Windows agent workspaces and other slow or remote file systems.

The loop is a delay and retry around File.renameTo. It is not a new installer protocol and it does not change where tools are stored. If the fifth attempt still fails, the installer still throws IOException. Agents on NFS, SMB, or Windows volumes that lag after extract should see fewer flaky JDK, Maven, or vendor tool installs. Controllers on local disks should not notice the extra attempts.

Delayed form validation can now abort stale checks. Pull request 26595 adds abort support to FormChecker delayed checks in hudson-behavior.js. Those checks used to queue one after another. A filter change or a client side page flip on a long user list left the old requests running to completion. The new path cancels outdated checks and continues the remaining ones. That helps configuration screens with many doCheck callbacks. It does not change the agent protocol or the build queue.

Pull request 26467 fixes Unicode escape decoding in QuotedStringTokenizer.unquote. The user visible surface is label parsing, where quoted escape sequences were decoded incorrectly.

Artifact archiving in pull request 27201 prints a clearer error when a file cannot be read, typically because access is denied. The archive step still fails. The log should now name the permission problem instead of a generic unreadability message, which is the useful part when a job writes output as one user and archives as another.

UI work in this weekly is mostly cleanup. Pull request 27265 reverts the experimental independently scrollable side panel and sticky build bar from 26863. Pull request 27228 hides links the current user cannot access in the new Manage Jenkins side panel. Combobox double tap and flash fixes on touch devices (26923, 26922) do not change job execution.

This is a stable weekly, not a prerelease. Treat the Lang 2 removal as a hard dependency break for the plugin set.

  • Inventory plugins that still import org.apache.commons.lang (the 2.x package, not lang3).
  • Update those plugins from the update center before you install 2.579.
  • On air gapped controllers, stage the new .hpi files first. An old plugin will not pick Lang 2 back up from core after this tag.

The official changelog also records that jenkins/inbound-agent and jenkins/ssh-agent images for Windows Server 2019 are no longer published. Stay on 2022 or 2025 images, or build your own 2019 image. That drop lives in the image pipeline, not in the Java sources of this tag, but it is documented for the same weekly.