Merge branch 'master' into restyle-help-button

.github/PULL_REQUEST_TEMPLATE.md

@@ -40,17 +40,17 @@ For examples, see: https://www.jenkins.io/changelog/
 
 N/A
 
+```[tasklist]
 ### Submitter checklist
-
 - [ ] The Jira issue, if it exists, is well-described.
-- [ ] The changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see [examples](https://github.com/jenkins-infra/jenkins.io/blob/master/content/_data/changelogs/weekly.yml)).
-  - Fill in the **Proposed upgrade guidelines** section only if there are breaking changes or changes that may require extra steps from users during upgrade.
+- [ ] The changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see [examples](https://github.com/jenkins-infra/jenkins.io/blob/master/content/_data/changelogs/weekly.yml)). Fill in the **Proposed upgrade guidelines** section only if there are breaking changes or changes that may require extra steps from users during upgrade.
 - [ ] There is automated testing or an explanation as to why this change has no tests.
 - [ ] New public classes, fields, and methods are annotated with `@Restricted` or have `@since TODO` Javadocs, as appropriate.
 - [ ] New deprecations are annotated with `@Deprecated(since = "TODO")` or `@Deprecated(forRemoval = true, since = "TODO")`, if applicable.
 - [ ] New or substantially changed JavaScript is not defined inline and does not call `eval` to ease future introduction of Content Security Policy (CSP) directives (see [documentation](https://www.jenkins.io/doc/developer/security/csp/)).
 - [ ] For dependency updates, there are links to external changelogs and, if possible, full differentials.
 - [ ] For new APIs and extension points, there is a link to at least one consumer.
+```
 
 ### Desired reviewers
 
@@ -60,13 +60,14 @@ N/A
 If you need an accelerated review process by the community (e.g., for critical bugs), mention @jenkinsci/core-pr-reviewers.
 -->
 
-### Maintainer checklist
-
 Before the changes are marked as `ready-for-merge`:
 
+```[tasklist]
+### Maintainer checklist
 - [ ] There are at least two (2) approvals for the pull request and no outstanding requests for change.
 - [ ] Conversations in the pull request are over, or it is explicit that a reviewer is not blocking the change.
 - [ ] Changelog entries in the pull request title and/or **Proposed changelog entries** are accurate, human-readable, and in the imperative mood.
 - [ ] Proper changelog labels are set so that the changelog can be generated automatically.
 - [ ] If the change needs additional upgrade steps from users, the `upgrade-guide-needed` label is set and there is a **Proposed upgrade guidelines** section in the pull request title (see [example](https://github.com/jenkinsci/jenkins/pull/4387)).
 - [ ] If it would make sense to backport the change to LTS, a Jira issue must exist, be a _Bug_ or _Improvement_, and be labeled as `lts-candidate` to be considered (see [query](https://issues.jenkins.io/issues/?filter=12146)).
+```

.github/dependabot.yml

@@ -58,7 +58,7 @@ updates:
         versions: [">=7.0.0"]
   - package-ecosystem: "maven"
     directory: "/"
-    target-branch: "stable-2.401"
+    target-branch: "stable-2.414"
     labels:
       - "into-lts"
       - "needs-justification"

.github/release-drafter.yml

@@ -7,7 +7,7 @@ tag-template: jenkins-$NEXT_MINOR_VERSION
 
 template: |
   _This is an automatically generated changelog draft for Jenkins weekly releases.
-  See https://www.jenkins.io/changelog/ for the official changelogs._
+  See https://www.jenkins.io/changelog/#v$NEXT_MINOR_VERSION for the official changelog for this release, or https://www.jenkins.io/changelog-old/#v$NEXT_MINOR_VERSION for releases older than around 7 months._
 
   $CHANGES
 

.github/renovate.json

@@ -38,6 +38,24 @@
       "matchStrings": ["ARG MAVEN_VERSION=(?<currentValue>.*?)\n"],
       "depNameTemplate": "org.apache.maven:maven-core",
       "datasourceTemplate": "maven"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["lit@(?<currentValue>.*?)/"],
+      "depNameTemplate": "lit",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["webcomponentsjs@(?<currentValue>.*?)/"],
+      "depNameTemplate": "@webcomponents/webcomponentsjs",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["<version>(?<currentValue>.*?)<\/version>"],
+      "depNameTemplate": "org.apache.maven.skins:maven-fluido-skin",
+      "datasourceTemplate": "maven"
     }
   ],
   "labels": ["dependencies", "skip-changelog"],

.github/workflows/announce-lts-rc.yml

@@ -0,0 +1,30 @@
+name: Announce LTS RCs
+
+on:
+  release:
+    types: [prereleased]
+
+jobs:
+  post:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post on Discourse
+        uses: roots/discourse-topic-github-release-action@fc9e50fa1a1ce6255ba4d03f104382845b79ad5f # v1.0.0
+        with:
+          discourse-api-key: ${{ secrets.DISCOURSE_RELEASES_API_KEY }}
+          discourse-base-url: https://community.jenkins.io/
+          discourse-author-username: jenkins-release-bot
+          discourse-category: 23
+      - name: Post on mailing list
+        uses: dawidd6/action-send-mail@v3
+        with:
+          server_address: smtp.gmail.com
+          server_port: 465
+          username: ${{secrets.MAIL_USERNAME}}
+          password: ${{secrets.MAIL_PASSWORD}}
+          secure: true
+          subject: ${{ github.event.release.tag_name }} has been released
+          to: [email protected]
+          from: Jenkins Release Bot
+          html_body: ${{ github.event.release.body }}
+          convert_markdown: true

.github/workflows/label-lts-prs.yaml

@@ -0,0 +1,23 @@
+name: Label PRs targeting LTS branches
+
+on: [pull_request_target]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if PR targets LTS branch
+        if: startsWith(github.event.pull_request.base.ref, 'stable-')
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.payload.repository.owner.login,
+              repo: context.payload.repository.name,
+              issue_number: context.payload.pull_request.number,
+              labels: ['into-lts']
+            });

.gitpod/Dockerfile

@@ -1,6 +1,6 @@
 FROM gitpod/workspace-full
 
-ARG MAVEN_VERSION=3.9.2
+ARG MAVEN_VERSION=3.9.4
 
 RUN brew install gh && \
     bash -c ". /home/gitpod/.sdkman/bin/sdkman-init.sh && sdk install maven ${MAVEN_VERSION} && sdk default maven ${MAVEN_VERSION}"

.mvn/extensions.xml

@@ -2,6 +2,6 @@
   <extension>
     <groupId>io.jenkins.tools.incrementals</groupId>
     <artifactId>git-changelist-maven-extension</artifactId>
-    <version>1.6</version>
+    <version>1.7</version>
   </extension>
 </extensions>

Jenkinsfile

@@ -208,7 +208,7 @@ axes.values().combinations {
 
 def athAxes = [
   platforms: ['linux'],
-  jdks: [11],
+  jdks: [17],
   browsers: ['firefox'],
 ]
 athAxes.values().combinations {

ath.sh

@@ -6,10 +6,10 @@ set -o xtrace
 cd "$(dirname "$0")"
 
 # https://github.com/jenkinsci/acceptance-test-harness/releases
-export ATH_VERSION=5588.vd13b_52985008
+export ATH_VERSION=5686.vc3a_26a_d441a_9
 
 if [[ $# -eq 0 ]]; then
-	export JDK=11
+	export JDK=17
 	export BROWSER=firefox
 else
 	export JDK=$1

bom/pom.xml

@@ -40,7 +40,7 @@ THE SOFTWARE.
   <properties>
     <asm.version>9.5</asm.version>
     <slf4jVersion>2.0.7</slf4jVersion>
-    <stapler.version>1785.vf9cb_74a_b_ec5b_</stapler.version>
+    <stapler.version>1802.v9e2750160d01</stapler.version>
     <groovy.version>2.4.21</groovy.version>
   </properties>
 
@@ -56,15 +56,15 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>5.3.27</version>
+        <version>5.3.29</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <dependency>
         <!-- https://docs.spring.io/spring-security/site/docs/5.5.4/reference/html5/#getting-maven-no-boot -->
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-bom</artifactId>
-        <version>5.8.3</version>
+        <version>5.8.5</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -82,7 +82,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
-        <version>32.0.0-jre</version>
+        <version>32.1.1-jre</version>
       </dependency>
       <dependency>
         <!-- Overriding Stapler’s 1.1.3 version to diagnose JENKINS-20618: -->
@@ -113,7 +113,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
-        <version>1.15</version>
+        <version>1.16.0</version>
       </dependency>
       <dependency>
         <groupId>commons-collections</groupId>
@@ -128,7 +128,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.11.0</version>
+        <version>2.13.0</version>
       </dependency>
       <dependency>
         <groupId>commons-jelly</groupId>
@@ -225,7 +225,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.jenkins-ci</groupId>
         <artifactId>crypto-util</artifactId>
-        <version>1.8</version>
+        <version>1.9</version>
       </dependency>
       <dependency>
         <groupId>org.jenkins-ci</groupId>
@@ -260,7 +260,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.jvnet.hudson</groupId>
         <artifactId>commons-jelly-tags-define</artifactId>
-        <version>1.1-jenkins-20230124</version>
+        <version>1.1-jenkins-20230713</version>
       </dependency>
       <dependency>
         <groupId>org.jvnet.localizer</groupId>
@@ -295,7 +295,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.kohsuke.metainf-services</groupId>
         <artifactId>metainf-services</artifactId>
-        <version>1.9</version>
+        <version>1.11</version>
       </dependency>
       <dependency>
         <groupId>org.kohsuke.stapler</groupId>

cli/pom.xml

@@ -119,7 +119,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>
-        <version>3.4.1</version>
+        <version>3.5.0</version>
         <executions>
           <execution>
             <goals>

cli/src/main/java/hudson/cli/PlainCLIProtocol.java

@@ -277,7 +277,7 @@ protected final boolean handle(Op op, DataInputStream dis) throws IOException {
                 onStart();
                 return true;
             case STDIN:
-                onStdin(IOUtils.toByteArray(dis));
+                onStdin(dis.readAllBytes());
                 return true;
             case END_STDIN:
                 onEndStdin();
@@ -327,10 +327,10 @@ protected boolean handle(Op op, DataInputStream dis) throws IOException {
                 onExit(dis.readInt());
                 return true;
             case STDOUT:
-                onStdout(IOUtils.toByteArray(dis));
+                onStdout(dis.readAllBytes());
                 return true;
             case STDERR:
-                onStderr(IOUtils.toByteArray(dis));
+                onStderr(dis.readAllBytes());
                 return true;
             default:
                 return false;

cli/src/main/resources/hudson/cli/client/Messages_ru.properties

@@ -0,0 +1,26 @@
+CLI.Usage=Jenkins CLI\n\
+  Использование: java -jar jenkins-cli.jar [-s URL] command [opts...] args...\n\
+  Параметры:\n\
+  \ -s URL              : URL сервера (по умолчанию используется переменная окружения JENKINS_URL)\n\
+  \ -webSocket          : Подключиться с помощью WebSocket (по умолчанию; хорошо работает с большинством обратных прокси-серверов; требует Jetty)\n\
+  \ -http               : Использовать пару соединений HTTP(S), а не WebSocket\n\
+  \ -ssh                : Использовать протокол SSH вместо WebSocket (требуется -user; порт SSH должен быть открыт на сервере)\n\
+  \ -i KEY              : Файл закрытого ключа SSH, используемый для аутентификации (для использования с -ssh)\n\
+  \ -noCertificateCheck : Полностью обойти проверку сертификата HTTPS. Используйте с осторожностью\n\
+  \ -noKeyAuth          : Не пытайтесь загрузить закрытый ключ аутентификации SSH. Конфликты с -i\n\
+  \ -user               : Указать пользователя (для использования с -ssh; необходимо зарегистрировать открытый ключ)\n\
+  \ -strictHostKey      : Запрос строгой проверки ключей хоста (для использования с -ssh)\n\
+  \ -logger FINE        : Включить подробное ведение журнала с клиента\n\
+  \ -auth [ USER:SECRET | @FILE ] : Указать имя пользователя и пароль или API-токен (или загрузить оба из файла);\n\
+  \                                 для использования с -http.\n\
+  \                                 Рекомендуется передавать учетные данные по файлам.\n\
+  \                                 Более подробную информацию и варианты смотрите на сайте https://www.jenkins.io/redirect/cli-http-connection-mode.\n\
+  \ -bearer [ TOKEN | @FILE ]     : Указать аутентификацию с использованием токена (или загрузить токен из файла);\n\
+  \                                 Для использования с -http. Взаимоисключающий вариант с -auth.\n\
+  \                                 Рекомендуется передавать учетные данные через файл.\n\
+  \n\
+  Доступные команды зависят от сервера. Выполните команду ''help'', чтобы \
+  посмотреть список.
+CLI.NoURL=Не указаны ни -s, ни переменная окружения JENKINS_URL.
+CLI.NoSuchFileExists=Не существует такого файла: {0}
+CLI.BadAuth=Параметры окружения JENKINS_USER_ID и JENKINS_API_TOKEN должны быть оба установлены или оставлены пустыми.

core/pom.xml

@@ -468,7 +468,7 @@ THE SOFTWARE.
       <!-- working around MCOMPILER-97 -->
       <groupId>org.jenkins-ci</groupId>
       <artifactId>core-annotation-processors</artifactId>
-      <version>1.0</version>
+      <version>13.v2dcfc22a_a_b_29</version>
       <scope>provided</scope>
       <optional>true</optional>
     </dependency>
@@ -654,7 +654,7 @@ THE SOFTWARE.
         <!-- Version specified in grandparent POM -->
         <configuration>
           <!-- Make sure to keep the directives in test/pom.xml and war/pom.xml in sync with these. -->
-          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.desktop/com.sun.beans.introspect=ALL-UNNAMED</argLine>
+          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED</argLine>
           <reuseForks>false</reuseForks>
         </configuration>
       </plugin>
@@ -679,8 +679,8 @@ THE SOFTWARE.
     <plugins>
       <plugin>
         <!-- generate Jelly tag lib documentation -->
-        <groupId>org.kohsuke.stapler</groupId>
-        <artifactId>maven-stapler-plugin</artifactId>
+        <groupId>io.jenkins.tools.maven</groupId>
+        <artifactId>stapler-maven-plugin</artifactId>
         <!-- Version specified in grandparent POM -->
         <configuration>
           <patterns>

core/src/main/java/hudson/AbstractMarkupText.java

@@ -83,7 +83,7 @@ public final int length() {
      * @since 1.349
      */
     public void addHyperlink(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**
@@ -93,7 +93,7 @@ public void addHyperlink(int startPos, int endPos, String url) {
      * @since 1.395
      */
     public void addHyperlinkLowKey(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a class='lowkey' href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a class='lowkey' href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**

core/src/main/java/hudson/ClassicPluginStrategy.java

@@ -40,6 +40,7 @@
 import java.io.FilenameFilter;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
 import java.lang.reflect.InvocationTargetException;
 import java.net.URL;
 import java.nio.file.Files;
@@ -60,7 +61,6 @@
 import jenkins.ExtensionFilter;
 import jenkins.plugins.DetachedPluginsUtil;
 import jenkins.util.URLClassLoader2;
-import org.apache.commons.io.output.NullOutputStream;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Project;
 import org.apache.tools.ant.taskdefs.Expand;
@@ -503,7 +503,7 @@ private static void createClassJarFromWebInfClasses(File archive, File destDir,
 
         final long dirTime = archive.lastModified();
         // this ZipOutputStream is reused and not created for each directory
-        try (ZipOutputStream wrappedZOut = new ZipOutputStream(NullOutputStream.NULL_OUTPUT_STREAM) {
+        try (OutputStream nos = OutputStream.nullOutputStream(); ZipOutputStream wrappedZOut = new ZipOutputStream(nos) {
             @Override
             public void putNextEntry(ZipEntry ze) throws IOException {
                 ze.setTime(dirTime + 1999);   // roundup