Jenkins 2.577 - Detached Plugins Leave jenkins.war

Jenkins 2.577 was published on 11 August 2026 as a weekly core build. The change that matters for operators who run Jenkins as a batch scheduler is packaging: the last remaining detached plugins are no longer shipped inside jenkins.war, which cuts more than 20 MB from the archive. Controllers that cannot reach the update center now have to install those plugins themselves.

The full release notes and downloads are on the GitHub release page. Jenkins also publishes an official changelog for 2.577.

For years Jenkins core shipped copies of plugins that had already been split out of the product. Those copies lived in jenkins.war so a controller upgrading from an old baseline, or a plugin compiled against one, would still start. Pull 27129 finishes that cleanup.

The plugins that drop out of the war are bouncycastle-api, command-launcher, jdk-tool, jaxb, trilead-api, sshd, javax-activation-api, javax-mail-api, and Instance Identity. They were carved out of core between Jenkins 2.16 and Jenkins 2.356 (2016 through 2022) and then kept bundled so upgrades would not break. The code was already a plugin. The war just stopped carrying a copy.

If the update center is reachable, Jenkins still installs a missing dependency the same way it does for any other plugin. Most batch schedulers on a normal network path will not notice, aside from a smaller war file to copy onto disk.

The tradeoff sits on air gapped and tightly firewalled controllers. Those machines cannot ask the update center to fill the gap. An upgrade past 2.356, or the install of a plugin built against that old baseline, will no longer pull these modules in for free. Place the plugin files in the plugins directory of the Jenkins home directory before you start 2.577, or before you install the plugin that needs them.

That list is not decorative. command-launcher is how some agents are started. jdk-tool is the JDK installer used by jobs that provision a JDK at runtime. sshd and trilead-api sit under SSH access and SSH client calls. bouncycastle-api is the crypto provider many plugins depend on. JAXB, the activation API, and the mail API are XML and mail libraries that still show up in older plugin classpaths. Instance Identity holds the controller identity key. If any of those features are in your job graph, confirm the plugin is present after boot.

A smaller war also changes image builds. A process that copies jenkins.war into a controller image now ships less unused bytecode. That is useful when you rebuild images often. It is not a reason to skip the plugin inventory check, and it is not a substitute for pinning plugin versions in the image.

The weekly also includes controller UI work. Pull 26863 aligns experimental Jenkins pages, makes the side panel scroll on its own, and keeps the build bar stuck in view. This is layout work, not a change to job XML, agents, or the REST API.

For operators who sit on a long batch job, the sticky build bar keeps run controls on screen while console output moves. An independently scrollable side panel lets the job tree move without dragging the main pane. If your team drives Jenkins only through the remote API and never opens the classic UI, this pull does not affect the pipeline.

The notes call these pages experimental. Treat the layout as operator UI, not as a contract for scrapers or for screenshot tests that pin pixel positions.

Javadoc on QuotedStringTokenizer.quote(String) now matches the implementation. Pull 27165 records that quoting is unconditional. This is a documentation fix for plugin developers. Runtime behavior is not described as changed.

If you wrap CLI arguments or shell tokens through that helper, read the updated comment and keep tests that assert the actual quoted form. Do not treat the old Javadoc as a promise that some strings were left bare.

This weekly is not an LTS line. Pin jenkins-2.577 only if you already follow weeklies and have a rollback image.

Before you start the new war on a controller that cannot reach the update center:

• Confirm whether any of the unbundled plugins are required by your jobs or by plugins compiled against Jenkins 2.356 or earlier.
• Download those plugin files from the update center on a connected host.
• Copy them into the plugins directory under Jenkins home, then start 2.577.

Controllers that can reach the update center can let Jenkins resolve the same plugins at runtime. Still record the plugin list after first boot so image builds stay reproducible. The GitHub release page is the weekly tag; read the official changelog as well if you need the full operator note on bundling.

Job definitions, credentials, and agent launchers are not the subject of this weekly beyond the unbundling of command-launcher and the related APIs listed above. Glance at experimental pages after upgrade if people use the classic UI to watch builds.

• Release page: Jenkins 2.577 on GitHub
• Repository: jenkinsci/jenkins
• Tag: jenkins-2.577