Jenkins 2.584 - Remoting Floor and config.xml Directories

Jenkins published weekly jenkins-2.584 on 29 September 2026. The change that matters on a live controller is the Remoting floor: agent.jar builds from before August 2024 are rejected, and the minimum moves from 3176.v207ec082a_8c0 to 3256.3258.v858f3c9a_f69d. The same weekly stops taking workspaceDir and buildsDir from $JENKINS_HOME/config.xml.

The full release notes and downloads are on the GitHub release page. That page is an automatically generated draft for the weekly, and it points at the official 2.584 changelog for the entries to trust. The tag sits on the weekly line.

#27439, from @MarkEWaite and @daniel-beck, raises the oldest Remoting version hudson.slaves.SlaveComputer will accept. The previous floor, 3176.v207ec082a_8c0, stayed so a controller could still speak to agents from before the August 2024 fix tracked as SECURITY-3430. The changelog line is direct: drop support for Remoting (agent.jar) releases prior to August 2024. The new minimum, 3256.3258.v858f3c9a_f69d, is the build from 7 August 2024.

The check runs while the channel is coming up. The launch log prints Remoting version: and compares it with the floor. An older agent, with the bypass unset, gets a fatal line rejecting the connection because the Remoting version is older than the minimum required version. The node stays offline. A static inbound agent, an SSH launcher, and a container image that still starts a pinned agent.jar all fail the same way. Fleets already on a current library lose the ability to connect an agent from before August 2024.

Set hudson.slaves.SlaveComputer.allowUnsupportedRemotingVersions to true and the connection is allowed. The next log line says compatibility is not guaranteed. Use the property to sequence the rollout, then turn it off. A good connect still ends with Agent successfully connected and online.

#27406 from jglick stops persisting workspaceDir and buildsDir. In jenkins.model.Jenkins the values are transient fields filled only from system properties. rawWorkspaceDir is read from jenkins.model.Jenkins.workspacesDir. rawBuildsDir is read from jenkins.model.Jenkins.buildsDir. When the property is absent, the defaults are ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} for workspaces and ${ITEM_ROOTDIR}/builds for build records.

The workspace property is workspacesDir, plural. The old config.xml element was workspaceDir, singular. buildsDir is spelled the same in both places. jenkins.model.Jenkins.workspaceDir is not read. The controller then uses the default root, with no startup error.

The UI for these paths was already gone, but the fields were still saved. A recorded default could outlive the real default, and a start with the property set followed by a start without it left the override in config.xml. Transient fields end both cases. XStream does not reload them, and it does not write them back.

A custom path that exists only as those elements is not applied on jenkins-2.584. Copy it to the matching system property before the controller restarts on this weekly. If the element is already the default template above, leave it. The same change removes isDefaultWorkspaceDir from the Jenkins object. A plugin that still calls that method fails to compile against this core. isDefaultBuildDir remains.

Log text, ZIP entries, and plugin collections ¶

#27331 only changes a log sentence. JNLP downloads still work. The warning used to blame the agent connection and mention -jnlpUrl. It now says the endpoint jenkins-agent.jnlp is deprecated, and it tells operators to launch agents with -url and -name instead. Alert rules that match -jnlpUrl go quiet while the download continues. The line is about how the file was fetched, not a failed handshake.

#27388 skips ZIP entries for input files that cannot be opened. Core omits an unreadable input instead of storing an entry that cannot be read back. The notes do not name a single caller. Jobs that archive paths the controller user cannot read should expect those paths to be absent from the ZIP. The permission failure belongs in the log.

#27396 fixes equality and hash codes on PackedMap entries so equal entries also hash equal. The changelog calls this honoring the entry contracts. Plugin tests that asserted the old identity can fail on this weekly. Job XML on disk does not gain a new schema.

#27414 stops a TypeError in breadcrumbs-overflow when the logo item is missing, or when breadcrumb nodes are not attached yet. Build execution and agent connectivity do not change. Nothing to configure.

Three checks belong in the rollout of jenkins-2.584.

Agents. Read the Remoting version: line from a fresh connect. It must be 3256.3258.v858f3c9a_f69d or newer. Older agents are rejected by hudson.slaves.SlaveComputer. The temporary bypass is hudson.slaves.SlaveComputer.allowUnsupportedRemotingVersions=true. While that property is set, the log says compatibility is not guaranteed.

Directories. Open $JENKINS_HOME/config.xml and compare workspaceDir with ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} and buildsDir with ${ITEM_ROOTDIR}/builds. Any other value has to move to jenkins.model.Jenkins.workspacesDir or jenkins.model.Jenkins.buildsDir. Pass those as JVM system properties on the controller process. A singular workspaceDir property does not select the workspace root.

Plugins. Drop calls to isDefaultWorkspaceDir before compiling against this core. Retest PackedMap equality if a plugin asserts entry identity. The JNLP reword and the breadcrumb TypeError fix need no config change.

The official 2.584 changelog records the Remoting drop and the directory change. The bypass property is part of #27439. The isDefaultWorkspaceDir removal is part of #27406.