The actual change is in the remoting 1.20.

Reworked UnprotectedRootAction display to be in configure page for better discoverability and possibility of support from reverse-proxy-auth-plugin.

Implementation according to Jesse Glick's comments on the issue.

[FIXED JENKINS-15889] Saving the update center list after the metadata has been fetched results in the metadata being persisted twice

now it is done properly on Javascript side so the current server
implementation triggers javascript errors.

Result can be observed on DynamicComboBox within ui-samples-plugin

Solves the issue for newly created builds by not attempting to persist the original file upload record, which is useless after the build has run (the fileParameters dir in the build already archives them).
Does not help loading pre-fix builds in which the upload temp file has been deleted; for these, you must manually delete <file class="org.apache.commons.fileupload.disk.DiskFileItem" serialization="custom">…</file> from the build.xml.
(Did not find a straightforward way to just instruct XStream to ignore this bit of XML: it is easy to avoid serializing a field, but deserializing is different.)

[FIXED JENKINS-15940] WARNING: Caught exception evaluating: descriptor.getHelpFile(attrs.field). Reason: java.lang.NullPointerException