Document the || operator with a linux||macos example and clarify that
wildcards/regex are not supported, addressing JENKINS-28380 / #21113.
Co-authored-by: arimu1 <19286898+arimu1@users.noreply.github.com>
* Remove comments from properties files in shipped war
* Extend it to jelly as well
* Reduce scope to just license comments
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Remove pre 2.0 detached plugins
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix tests relying on unbundled detached plugins
PluginManagerInstalledGUITest copied matrix-auth.hpi out of the war;
switch to command-launcher, which is still bundled, has no dependents in
the test environment (unlike javax-activation-api, which jaxb and
javax-mail-api depend on), and whose only dependency (script-security)
is already provided as a test dependency.
ClassicPluginStrategyTest's foo4.hpi fixture declared a dependency on
junit, which is no longer bundled; regenerate it against
javax-activation-api, mirroring how ant was swapped for junit in #5338.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Delete test
* Remove local data fixture
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Refactor Security3630Test to eliminate ProcessBuilder flakiness
Replaces the heavyweight ProcessBuilder loop with direct HttpURLConnection handshakes using a CountDownLatch for simultaneous execution. This makes the test significantly faster, highly deterministic, and restores compatibility with Windows environments while retaining strict verification of the SECURITY-3630 ConcurrentModificationException regression.
* test: refactor Security3630Test to simulate CLI protocol in-process
* test: address PR review feedback on unused imports and exceptions
* test: filter out harmless InterruptedException and fix formatting
* test: apply copilot review suggestions for stability
* test: remove flawed successfulRuns assertion that causes false positives
* test: revert overly aggressive timeout that prevented bug reproduction
Amends pull request:
* https://github.com/jenkinsci/jenkins/pull/27038
Without this change, the "Manage Jenkins" / "Security" page fails to
open and reports that the config.jelly cannot be parsed.
Jenkins 2.573 did not include the pull request. I seem to have merged
it after the 2.573 build started.
Testing done:
* Confirmed that "Manage Jenkins" / "Security" on Jenkins 2.573 opens successfully
* Confirmed that "Manage Jenkins" / "Security" on master branch does not open
* Confirmed that "Manage Jenkins" / "Security" opens successfully with this change
* Make remember-me token validity configurable via system property
* Log invalid remember-me token validity and drop @VisibleForTesting
* Use Duration for the configurable remember-me token validity
* refactor: Address post-merge review feedback from daniel-beck
- Move password complexity classes from hudson.security to jenkins.security
- Fix special character regex: use \p{Punct} instead of [^a-zA-Z0-9]
so spaces and Unicode letters are no longer treated as special chars
- Document special character examples on the config UI
- Add violations list to PasswordComplexityException for better UX
- Remove redundant checkMethod="post" (already the default)
- Move message keys to jenkins/security/Messages.properties
- Update copyright year to 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Remove unused NonePasswordComplexityRule import
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: Add @Restricted(NoExternalUse.class) to built-in implementations
Plugins only need to extend PasswordComplexityRule — there is no need
to reference BasicPasswordComplexityRule or NonePasswordComplexityRule
directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: Update @since to acknowledge package move from hudson.security
Per daniel-beck's feedback: document that these classes were originally
added in 2.572 and moved from hudson.security to jenkins.security in
this release, so plugin authors are aware of the breaking change.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
Fix flaky ProcessTreeTest#processProperlyKilledUnix
Resolves JENKINS-70781 by using a randomly generated sleep duration instead of a hardcoded 100000. This prevents the test from failing when orphaned sleep processes from previous aborted test runs are present in the host system.
renovate[bot]