Last checked and updated on 03 May 2026What Is New in Jenkins 2.528.x
Jenkins 2.528.x is a Long-Term Support (LTS) line that packages UI modernization, agent reliability fixes, and updated JDK runtimes into a stable release stream. The two patch releases (2.528.1 and 2.528.2) refine what landed in the 2.528 baseline without introducing new breaking changes.
| Category | Highlights |
|---|---|
| Major Enhancements | Debian 13 (Trixie) container base; sweeping header, sidebar, and app-bar UI refresh |
| Performance | Additional Java class caching; minor optimization for administrative monitor badge rendering |
| Security / Crypto | SSH CLI now uses native EdDSA via Apache Mina + Bouncycastle instead of a third-party shim |
| Bug Fixes | Race condition in WebSocket agent init; queue-item loss on node disconnect; form validator number comparison; plugin setup wizard button visibility |
| Deprecations / Removals | /extensionList/ HTTP endpoint removed (Timestamper 1.29+ required) |
| Runtime Updates | JDK 21 bumped to 21.0.9+10; JDK 17 bumped to 17.0.17+10; Debian Trixie image refreshed |
| Localization | Polish added; Bulgarian spacing adjusted; German Global Build Discarder strings added |
How Did the UI Change, and Will It Break Anything?
The header, app bar, and side panel received the most visible overhaul in this cycle. Color tokens, border styles, and button shapes were standardized across the interface, and dropdowns now use a secondary text color that improves contrast without requiring a theme plugin.
Breadcrumbs gained a visual indicator and were updated to meet accessibility guidelines (WCAG-compatible). In practice this is one of those changes that screen-reader users will notice immediately, while everyone else just benefits from cleaner navigation.
The User page and Console URL Provider page were also refined. Parameters for a run are now displayed in read-only mode rather than editable fields when you are just viewing -- a small UX win that prevents accidental edits mid-review.
None of these changes touch the plugin API surface, so existing plugins will not break. Custom CSS themes that hard-code Jenkins color variables may need minor adjustments.
What Changed with Containers and the Debian Base Image?
The official Jenkins Docker images moved from Debian 11 (Bullseye) to Debian 13 (Trixie). This is a major base-image jump, so if your pipeline installs OS-level packages with apt-get, verify that package names and repository URLs are still valid on Trixie.
JDK bundles inside the image were also refreshed: JDK 21 moves to 21.0.9+10 and JDK 17 moves to 17.0.17+10 (both Temurin builds). The patch-level bumps address upstream CVEs and GC improvements -- nothing that changes runtime behavior for typical CI workloads.
A subtle but useful Docker fix landed in 2.528.2: the versionLT and Compare-VersionLessThan functions in jenkins-support scripts now correctly parse Jenkins version strings. This matters for custom entrypoints that gate logic on the running Jenkins version.
# Verify your running base inside a container
cat /etc/os-release | grep "VERSION_CODENAME"
# Expected output for 2.528.x images:
# VERSION_CODENAME=trixieWhat Agent and Queue Reliability Fixes Shipped?
Two fixes here are worth flagging for anyone running distributed builds at scale.
- Queue items lost on node disconnect -- A timing window existed where a build item could be dropped from the queue if the assigned node disconnected during allocation. This race has been closed.
- WebSocket agent race condition -- The connection initialization sequence for WebSocket-based agents had a race that could leave an agent in a broken state without a clear error. The fix serializes the relevant handshake steps.
- ClosedChannelException stack trace noise -- Agent launch logs no longer emit full stack traces for expected channel closures. Log volume drops noticeably on environments with frequent agent churn.
In practice, the queue-item fix is the most impactful for teams that use ephemeral cloud agents (Kubernetes, EC2) where nodes disappear mid-allocation. Upgrading from any 2.5xx LTS release gets you all three without needing to change agent configuration.
What Got Removed or Deprecated -- and What Do You Need to Update?
The /extensionList/ HTTP endpoint has been removed entirely. This endpoint was used internally for telemetry collection. If you are running Timestamper plugin older than version 1.29, upgrade it before moving to 2.528.x -- older versions called this endpoint and will throw errors after the upgrade.
The user directory layout under $JENKINS_HOME/users/ changed: subdirectories now use a new naming format, and $JENKINS_HOME/users/users.xml is no longer written. Existing data migrates automatically on first startup. Custom scripts that parse users.xml directly need to be updated.
SSH CLI authentication dropped its third-party EdDSA implementation in favor of the one natively provided by Apache Mina via Bouncycastle. Connections using EdDSA keys continue to work -- the change is internal -- but if your CI tooling pins specific cipher negotiation parameters, test the SSH connection after upgrade.
What Performance Improvements Are in 2.528.x?
Two targeted performance changes shipped in this cycle, both on the controller side:
- Java class caching -- Additional caching of reflective class lookups reduces CPU overhead during high-frequency API calls. This shows up most on controllers handling large numbers of concurrent pipeline steps.
- Administrative monitor badge -- The badge that shows pending system warnings in the header now has a minor rendering optimization. Not dramatic, but it removes a repeated DOM query that fired on every page load.
Neither change requires configuration. The class-caching improvement is the one with measurable impact -- if you profile your controller under load, expect a small but consistent reduction in time spent in class-loading code paths.
FAQ
Do I need to rebuild my Docker images after upgrading to 2.528.x?
Yes, if you extend the official Jenkins image with a custom Dockerfile. The base switched to Debian 13 (Trixie), so any apt-get install commands that rely on Bullseye package names or repository URLs should be re-validated. Pull the new official image and run your build steps in a test environment before deploying to production.
Will removing /extensionList/ affect any plugins other than Timestamper?
Timestamper is the only known plugin that called this endpoint in its stable release line. If you run community or internal plugins that make HTTP calls to the Jenkins controller itself, grep for extensionList in their source to check. The endpoint served no documented public-API purpose, so legitimate plugin usage should be limited.
I use WebSocket agents -- do I need to change anything after the race condition fix?
No configuration changes are needed. The fix is entirely server-side: the handshake sequence is now serialized, so agents connect cleanly without a restart. If you had workarounds in place (like retry loops in your agent startup scripts), they can stay -- they will just become no-ops.
The $JENKINS_HOME/users/users.xml file is no longer written -- will my backup scripts break?
If your backup or audit scripts read users.xml to enumerate Jenkins users, they will stop finding new users created after the upgrade. The source of truth moved to per-user subdirectories under $JENKINS_HOME/users/. Update any tooling to iterate those directories instead of parsing the top-level XML file.
Is there a risk in jumping from 2.516.x LTS directly to 2.528.x?
Skipping minor LTS releases is supported, but review the notable changes between 2.516.3 and 2.528.x -- particularly the Debian base image change, the /extensionList/ removal, and the user directory format change. Run a plugin compatibility check with the Plugin Manager before upgrading production. The Trixie base image change is the most likely source of friction for teams with custom Docker layers.