I confirmed that the failure happens in 2.459 and 2.460 and does not happen in 2.458. I assume that the incorrect dependencies that are being included in the plugin will need to be fixed. JENKINS-72498 is the issue that tracks that fix

Do you have a hot fix for it ?, i need to have the latest Jenkins version and this issue might take a long time to fix?

I do not have a hot fix for it. The plugin maintainer will need to make the fix. Since application automation tools is a commercial product, you should use your support processes to request a fix from the commercial vendor.

We created a support request at the vendors portal
https://portal.microfocus.com/s/customdetailpage?500Q4000008dyqwIAA=&language=en_US

Thanks markewaite for the information. I assumed, the vendor also trackts this issue board.

It seems that 2.459 introduced commons-fileupload2-core-2.0.0-M2.jar and commons-fileupload2-javax-2.0.0-M2.jar instead of commons-fileupload-1.5.jar which was used up to version 2.458 which breaks the plugin.

The workaround is to copy commons-fileupload-1.5.jar file into plugins `WEB-INF/lib` directory `plugins/hp-application-automation-tools-plugin/WEB-INF/lib`.

Thanks for finding a workaround ikolomiyets, that's very good to share with others.

The switch to Commons File Upload 2.x is part of the transition to upgrade from Spring Security 5.x to Spring Security 6.x. The Spring project has announced that August 31, 2024 is the end of life of Spring Security 5.x.

Upgrading to Spring Security 6.x requires that we upgrade to Commons File Upload 2.x, Jetty 12, and Jakarta EE 9. Each of those upgrades is a major upgrade. The upgrade to Spring Security 6.x requires Java 17. That is coming soon to Jenkins weekly as well.

The plugin maintainer needs to fix the excessive inclusion of dependencies in the plugin so that the workaround is not needed. That is described in JENKINS-72498

Thank you all, for your continuous support.
I relayed the information back to the maintainer/vendor.

There is a compatibility layer here in Stapler. As long as plugins only consume org.apache.commons.fileupload.FileItem via StaplerRequest#getFileItem (and not org.apache.commons.fileupload.FileItemFactory or org.apache.commons.fileupload.disk.DiskFileItemFactory) they will get the compatibility logic even if core is running FileUpload 2. See https://github.com/jenkinsci/miniorange-saml-sp-plugin/pull/6 for an example of how to make this change. I tried to do this for hpe-application-automation-tools-plugin but the plugin doesn't even compile right now and has many other issues as Mark alluded to, so I didn't bother to submit a PR. If you don't want to use StaplerRequest#getFileItem then you can update the plugin's core baseline to one that has FileUpload 2.x (that is, a recent weekly) and then migrate from org.apache.commons.fileupload.disk.DiskFileItemFactory to org.apache.commons.fileupload2.core.DiskFileItemFactory, but that would likely be even more work given how out-of-date the parent POM is in hpe-application-automation-tools-plugin. Either way hpe-application-automation-tools-plugin needs a bit of modernization work.

To summarize, yes this is a break in compatibility in core; sorry for that, but there is really nothing we can do to fix it. Core just needs to move forward here for the sake of the rest of the ecosystem, and this plugin has to adapt. I had attempted to proactively prepare this plugin but it was just too far behind the norm in core baseline, libraries, and plugin POM, and wouldn't even compile, so the maintainers need to fix that before the work can begin to make this plugin compatible with recent core changes.

I had a few mails with the vendor, who provided me with a hotfix (i checked it with our setup and seemed to work)
Unfortunately it's 18MB, which exceeds the maximum attachment size, otherwise I would love provide it.
Do you know a other official solution, I could upload it?

Regarding a official drop and release of this fix, I got following answer:

I have received feedback from the R&D Team.

The most recent plugin version 24.2 has already been published one week ago. See https://plugins.jenkins.io/hp-application-automation-tools-plugin/releases/
The Team has opened a defect ticket for this issue and marked it as Critical.

The next release 24.3 will be dedicated to upgrading the plugin Java version from 8 to 21 to support the latest Jenkins versions. This upgrade of the Java will address and solve this issue in your case too. We have not released it yet because we still need deeper testing from all teams involved in the release cycle.

The 24.3 indicates that the ETA is by the end of the 3rd quarter of this year.