have you tested that? There is a risk that there are some nested types.

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

Thanks for the PR.
I have 2 questions:

1. All objects serialized by the plugin are in the whitelist of this PR or are basic classes already in the Jenkins whitelist, except java.lang.Thread$State. Is it necessary to add java.lang.Thread$State to this PR and to [JENKINS-47736] Switch Remoting/XStream blacklist to a whitelist jenkins#3120 ? (It's a simple enum).

2. Before 1.68.0 of the monitoring plugin, the same 11 classes were in the net.bull.javamelody package and not in the net.bull.javamelody.internal.model package. According to stats, about 5000 installations are 1.68+ and ok with the current whitelist, so about 6000 installations are not. Perhaps those 6000 installations will not upgrade to the latest Jenkins without upgrading the plugin, but we don't know that. So for those 6000 installations to work with the latest Jenkins, should the same 11 classes be added with the net.bull.javamelody package in the whitelists of [JENKINS-47736] Switch Remoting/XStream blacklist to a whitelist jenkins#3120?

have you tested that?

Yes, I ran mock-slave and tried to use all the plugin features I could find on a mock agent until I fixed all the errors.

All objects serialized by the plugin are in the whitelist of this PR or are basic classes already in the Jenkins whitelist

See JEP-200 for details. I believe this PR is all that is needed.

So for those 6000 installations to work with the latest Jenkins, should the same 11 classes be added

You should release this PR and people should just upgrade their plugin if they expect things to work. Anyway if you look at the correlation you will see that the vast majority of people who have updated Jenkins to a weekly release are also using the latest release of this plugin—there are only a handful of people who updated Jenkins but declined to update the plugin. That is the normal situation for most plugins.

Tested ok.
This will be released in the monitoring plugin 1.71.0 certainly in a few days.

Apparently the core's patch works only for 1.68 or above (5cb1c66). I will add the plugin to https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+fix+for+JEP-200

Created https://issues.jenkins-ci.org/browse/JENKINS-50280 as a placeholder