Currently the PluginServletFilter class is not final, which allows faulty implementations like https://github.com/jenkinsci/audit-log-plugin/blob/a8206637889be84a966711ab69f76dc4a74ba5d5/src/main/java/io/jenkins/plugins/audit/filter/RequestContextFilter.java where a plugin can contribute a filter that will replace itself as the PluginServletFilter (which should really be a singleton) and prevent other filters from receiving requests.

Change is breaking.