diff --git a/core/src/main/java/hudson/model/BuildAuthorizationToken.java b/core/src/main/java/hudson/model/BuildAuthorizationToken.java
index 48aea15b0897..f101eb3d6e74 100644
--- a/core/src/main/java/hudson/model/BuildAuthorizationToken.java
+++ b/core/src/main/java/hudson/model/BuildAuthorizationToken.java
@@ -29,7 +29,6 @@
 import hudson.security.ACL;
 import java.io.IOException;
 import javax.servlet.http.HttpServletResponse;
-import jenkins.model.Jenkins;
 import jenkins.security.ApiTokenProperty;
 import org.kohsuke.stapler.HttpResponses;
 import org.kohsuke.stapler.StaplerRequest;
@@ -68,9 +67,6 @@ public static BuildAuthorizationToken create(StaplerRequest req) {
     }
 
     public static void checkPermission(Job<?, ?> project, BuildAuthorizationToken token, StaplerRequest req, StaplerResponse rsp) throws IOException {
-        if (!Jenkins.get().isUseSecurity())
-            return;    // everyone is authorized
-
         if (token != null && token.token != null) {
             //check the provided token
             String providedToken = req.getParameter("token");
diff --git a/core/src/main/java/hudson/model/UpdateSite.java b/core/src/main/java/hudson/model/UpdateSite.java
index e5b7bb3f1228..1b7e3ef89c16 100644
--- a/core/src/main/java/hudson/model/UpdateSite.java
+++ b/core/src/main/java/hudson/model/UpdateSite.java
@@ -28,9 +28,7 @@
 import static java.util.concurrent.TimeUnit.DAYS;
 import static java.util.concurrent.TimeUnit.HOURS;
 import static java.util.concurrent.TimeUnit.SECONDS;
-import static jenkins.util.MemoryReductionUtil.EMPTY_STRING_ARRAY;
 import static jenkins.util.MemoryReductionUtil.getPresizedMutableMap;
-import static jenkins.util.MemoryReductionUtil.internInPlace;
 
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
@@ -80,6 +78,7 @@
 import jenkins.security.UpdateSiteWarningsConfiguration;
 import jenkins.security.UpdateSiteWarningsMonitor;
 import jenkins.util.JSONSignatureValidator;
+import jenkins.util.PluginLabelUtil;
 import jenkins.util.SystemProperties;
 import jenkins.util.java.JavaUtils;
 import net.sf.json.JSONArray;
@@ -1238,7 +1237,7 @@ public Plugin(String sourceId, JSONObject o) {
             }
             this.popularity = popularity;
             this.releaseTimestamp = date;
-            this.categories = o.has("labels") ? internInPlace((String[]) o.getJSONArray("labels").toArray(EMPTY_STRING_ARRAY)) : null;
+            this.categories = o.has("labels") ? PluginLabelUtil.canonicalLabels(o.getJSONArray("labels")) : null;
             this.issueTrackers = o.has("issueTrackers") ? o.getJSONArray("issueTrackers").stream().map(IssueTracker::createFromJSONObject).filter(Objects::nonNull).toArray(IssueTracker[]::new) : null;
 
             JSONArray ja = o.getJSONArray("dependencies");
diff --git a/core/src/main/java/jenkins/plugins/DetachedPluginsUtil.java b/core/src/main/java/jenkins/plugins/DetachedPluginsUtil.java
index 92c10b25d7ae..9a0bd3d4ed22 100644
--- a/core/src/main/java/jenkins/plugins/DetachedPluginsUtil.java
+++ b/core/src/main/java/jenkins/plugins/DetachedPluginsUtil.java
@@ -144,7 +144,7 @@ public static boolean isDetachedPlugin(@NonNull String pluginId) {
         return false;
     }
 
-    private static Stream<String> configLines(InputStream is) throws IOException {
+    public static Stream<String> configLines(InputStream is) throws IOException {
         return IOUtils.readLines(is, StandardCharsets.UTF_8).stream().filter(line -> !line.matches("#.*|\\s*"));
     }
 
diff --git a/core/src/main/java/jenkins/util/PluginLabelUtil.java b/core/src/main/java/jenkins/util/PluginLabelUtil.java
new file mode 100644
index 000000000000..b50c111cc8fa
--- /dev/null
+++ b/core/src/main/java/jenkins/util/PluginLabelUtil.java
@@ -0,0 +1,68 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2022 Jenkins contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package jenkins.util;
+
+import static jenkins.util.MemoryReductionUtil.EMPTY_STRING_ARRAY;
+
+import hudson.Util;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.HashSet;
+import jenkins.plugins.DetachedPluginsUtil;
+import net.sf.json.JSONArray;
+
+public class PluginLabelUtil {
+    private static HashMap<String, String> renamedLabels;
+
+    private static String canonicalLabel(String label) {
+        if (renamedLabels == null) {
+            renamedLabels = new HashMap<>();
+            try (InputStream is = PluginLabelUtil.class.getResourceAsStream("/jenkins/canonical-labels.txt")) {
+                DetachedPluginsUtil.configLines(is).forEach(line -> {
+                    String[] pieces = line.split(" ");
+                    renamedLabels.put(pieces[0], pieces[1]);
+                });
+            } catch (IOException x) {
+                throw new ExceptionInInitializerError(x);
+            }
+        }
+        return renamedLabels.getOrDefault(label, label);
+    }
+
+    /**
+     * Replaces labels with their canonical form and removes duplicates
+     * @param labels labels array
+     * @return unique canonical labels
+     */
+    public static String[] canonicalLabels(JSONArray labels) {
+        HashSet<String> uniqueLabels = new HashSet<>();
+        for (Object label : labels) {
+            uniqueLabels.add(Util.intern(canonicalLabel(label.toString())));
+        }
+        return uniqueLabels.toArray(EMPTY_STRING_ARRAY);
+    }
+
+}
diff --git a/core/src/main/resources/hudson/model/Messages.properties b/core/src/main/resources/hudson/model/Messages.properties
index e06fc0fb2648..33e069d4bb73 100644
--- a/core/src/main/resources/hudson/model/Messages.properties
+++ b/core/src/main/resources/hudson/model/Messages.properties
@@ -309,7 +309,7 @@ UpdateCenter.PluginCategory.dotnet=.NET Development
 UpdateCenter.PluginCategory.external=External Site/Tool Integrations
 UpdateCenter.PluginCategory.groovy-related=Groovy-related
 UpdateCenter.PluginCategory.ios=iOS Development
-UpdateCenter.PluginCategory.library=Library plugins (for use by other plugins)
+UpdateCenter.PluginCategory.api-plugin=Library plugins (for use by other plugins)
 UpdateCenter.PluginCategory.listview-column=List view columns
 UpdateCenter.PluginCategory.maven=Maven
 UpdateCenter.PluginCategory.misc=Miscellaneous
@@ -326,7 +326,7 @@ UpdateCenter.PluginCategory.scala=Scala Development
 UpdateCenter.PluginCategory.scm=Source Code Management
 UpdateCenter.PluginCategory.scm-related=Source Code Management related
 UpdateCenter.PluginCategory.security=Security
-UpdateCenter.PluginCategory.slaves=Agent Management
+UpdateCenter.PluginCategory.agent=Agent Management
 UpdateCenter.PluginCategory.test=Testing
 UpdateCenter.PluginCategory.theme=UI Themes
 UpdateCenter.PluginCategory.trigger=Build Triggers
diff --git a/core/src/main/resources/hudson/model/Messages_bg.properties b/core/src/main/resources/hudson/model/Messages_bg.properties
index 1c80a23398b1..66e2a4ecad58 100644
--- a/core/src/main/resources/hudson/model/Messages_bg.properties
+++ b/core/src/main/resources/hudson/model/Messages_bg.properties
@@ -433,7 +433,7 @@ UpdateCenter.PluginCategory.groovy-related=\
  \u0421\u0432\u044a\u0440\u0437\u0430\u043d\u0438 \u0441 Groovy
 UpdateCenter.PluginCategory.ios=\
  \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u0438\u0440\u0430\u043d\u0435 \u0437\u0430 iOS
-UpdateCenter.PluginCategory.library=\
+UpdateCenter.PluginCategory.api-plugin=\
  \u041f\u0440\u0438\u0441\u0442\u0430\u0432\u043a\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 (\u0438\u0437\u043f\u043e\u043b\u0437\u0432\u0430\u0442 \u0441\u0435 \u043e\u0442 \u0434\u0440\u0443\u0433\u0438 \u043f\u0440\u0438\u0441\u0442\u0430\u0432\u043a\u0438)
 UpdateCenter.PluginCategory.listview-column=\
  \u041a\u043e\u043b\u043e\u043d\u0438 \u0432 \u0441\u043f\u0438\u0441\u044a\u0447\u043d\u0438\u044f \u0438\u0437\u0433\u043b\u0435\u0434
@@ -637,7 +637,7 @@ ComputerSet.SpecifySlaveToCopy=\
 Slave.WindowsSlave=\
  \u0422\u043e\u0432\u0430 \u0435 \u0430\u0433\u0435\u043d\u0442 \u0437\u0430 Windows
 # Agent Launchers and Controllers
-UpdateCenter.PluginCategory.slaves=\
+UpdateCenter.PluginCategory.agent=\
  \u0421\u0442\u0430\u0440\u0442\u0438\u0440\u0430\u043d\u0435 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0430\u0433\u0435\u043d\u0442\u0438
 MultiStageTimeSeries.EMPTY_STRING=\
  
diff --git a/core/src/main/resources/hudson/model/Messages_de.properties b/core/src/main/resources/hudson/model/Messages_de.properties
index 620e5088f892..9de8c93e009d 100644
--- a/core/src/main/resources/hudson/model/Messages_de.properties
+++ b/core/src/main/resources/hudson/model/Messages_de.properties
@@ -311,7 +311,7 @@ UpdateCenter.PluginCategory.dotnet=.NET-Entwicklung
 UpdateCenter.PluginCategory.external=Integration externer Sites und Werkzeuge
 UpdateCenter.PluginCategory.groovy-related=Groovy (weiteres Umfeld)
 UpdateCenter.PluginCategory.ios=iOS-Entwicklung
-UpdateCenter.PluginCategory.library=Programmbibliotheken (von anderen Plugins verwendet)
+UpdateCenter.PluginCategory.api-plugin=Programmbibliotheken (von anderen Plugins verwendet)
 UpdateCenter.PluginCategory.listview-column=Spalten f\u00FCr Listenansichten
 UpdateCenter.PluginCategory.maven=Maven bzw. Plugins mit besonderer Maven-Unterst\u00FCtzung
 UpdateCenter.PluginCategory.misc=Verschiedenes
@@ -326,7 +326,7 @@ UpdateCenter.PluginCategory.scala=Scala-Entwicklung
 UpdateCenter.PluginCategory.scm=Versionsverwaltung
 UpdateCenter.PluginCategory.scm-related=Versionsverwaltung (weiteres Umfeld)
 UpdateCenter.PluginCategory.security=Sicherheit
-UpdateCenter.PluginCategory.slaves=Agenten-Start und -Steuerung
+UpdateCenter.PluginCategory.agent=Agenten-Start und -Steuerung
 UpdateCenter.PluginCategory.test=Testen
 UpdateCenter.PluginCategory.trigger=Build-Ausl\u00F6ser
 UpdateCenter.PluginCategory.ui=Benutzeroberfl\u00E4che
diff --git a/core/src/main/resources/hudson/model/Messages_es.properties b/core/src/main/resources/hudson/model/Messages_es.properties
index 4fa6ccd05f77..a40a0cb3d3ce 100644
--- a/core/src/main/resources/hudson/model/Messages_es.properties
+++ b/core/src/main/resources/hudson/model/Messages_es.properties
@@ -194,7 +194,7 @@ UpdateCenter.PluginCategory.post-build=Plugins que a\u00f1aden acciones de post-
 UpdateCenter.PluginCategory.report=Plugins para generar informes
 UpdateCenter.PluginCategory.scm=Plugins de repositorios de software
 UpdateCenter.PluginCategory.scm-related=Plugins relacionados con la gesti\u00f3n repositorios
-UpdateCenter.PluginCategory.slaves=Plugins para el control de nodos
+UpdateCenter.PluginCategory.agent=Plugins para el control de nodos
 
 
 UpdateCenter.PluginCategory.trigger=Plugins lanzadores de tareas
diff --git a/core/src/main/resources/hudson/model/Messages_it.properties b/core/src/main/resources/hudson/model/Messages_it.properties
index 695944168aca..498514bcf843 100644
--- a/core/src/main/resources/hudson/model/Messages_it.properties
+++ b/core/src/main/resources/hudson/model/Messages_it.properties
@@ -403,7 +403,7 @@ UpdateCenter.PluginCategory.dotnet=Sviluppo .NET
 UpdateCenter.PluginCategory.external=Integrazioni siti/strumenti esterni
 UpdateCenter.PluginCategory.groovy-related=Componenti legati a Groovy
 UpdateCenter.PluginCategory.ios=Sviluppo iOS
-UpdateCenter.PluginCategory.library=Componenti libreria (per l''utilizzo da \
+UpdateCenter.PluginCategory.api-plugin=Componenti libreria (per l''utilizzo da \
   parte di altri componenti aggiuntivi)
 UpdateCenter.PluginCategory.listview-column=Colonne visualizzazione elenco
 UpdateCenter.PluginCategory.maven=Maven
@@ -423,7 +423,7 @@ UpdateCenter.PluginCategory.scm=Gestione del codice sorgente
 UpdateCenter.PluginCategory.scm-related=Componenti legati alla gestione del \
   codice sorgente
 UpdateCenter.PluginCategory.security=Sicurezza
-UpdateCenter.PluginCategory.slaves=Avvio e controllo agenti
+UpdateCenter.PluginCategory.agent=Avvio e controllo agenti
 UpdateCenter.PluginCategory.test=Test
 UpdateCenter.PluginCategory.theme=Temi interfaccia utente
 UpdateCenter.PluginCategory.trigger=Trigger compilazione
diff --git a/core/src/main/resources/hudson/model/Messages_lt.properties b/core/src/main/resources/hudson/model/Messages_lt.properties
index 22eb9d968088..5d2571900abd 100644
--- a/core/src/main/resources/hudson/model/Messages_lt.properties
+++ b/core/src/main/resources/hudson/model/Messages_lt.properties
@@ -252,7 +252,7 @@ UpdateCenter.PluginCategory.dotnet=.NET k\u016brimas
 UpdateCenter.PluginCategory.external=I\u0161orin\u0117 svetain\u0117/\u012franki\u0173 integracija
 UpdateCenter.PluginCategory.groovy-related=Groovy-susij\u0119s
 UpdateCenter.PluginCategory.ios=iOS k\u016brimas
-UpdateCenter.PluginCategory.library=Bibliotek\u0173 priedai (naudojami kit\u0173 pried\u0173)
+UpdateCenter.PluginCategory.api-plugin=Bibliotek\u0173 priedai (naudojami kit\u0173 pried\u0173)
 UpdateCenter.PluginCategory.listview-column=Rodinio s\u0105ra\u0161o stulpeliai
 UpdateCenter.PluginCategory.maven=Maven
 UpdateCenter.PluginCategory.misc=\u012evair\u016bs
@@ -268,7 +268,7 @@ UpdateCenter.PluginCategory.scala=Scala k\u016brimas
 UpdateCenter.PluginCategory.scm=I\u0161eities kodo valdymas
 UpdateCenter.PluginCategory.scm-related=Susij\u0119 su i\u0161eities kodo valdymu
 UpdateCenter.PluginCategory.security=Saugumas
-UpdateCenter.PluginCategory.slaves=Agent\u0173 paleid\u0117jai ir valdytojai
+UpdateCenter.PluginCategory.agent=Agent\u0173 paleid\u0117jai ir valdytojai
 UpdateCenter.PluginCategory.test=Testavimas
 UpdateCenter.PluginCategory.trigger=Vykdymo trigeriai
 UpdateCenter.PluginCategory.ui=Naudotojo s\u0105saja
diff --git a/core/src/main/resources/hudson/model/Messages_sr.properties b/core/src/main/resources/hudson/model/Messages_sr.properties
index f75aca4c4ee1..ec285a88bbe3 100644
--- a/core/src/main/resources/hudson/model/Messages_sr.properties
+++ b/core/src/main/resources/hudson/model/Messages_sr.properties
@@ -27,7 +27,7 @@ UpdateCenter.PluginCategory.deployment=\u0418\u043D\u0441\u0442\u0430\u043B\u043
 UpdateCenter.PluginCategory.external=\u0418\u043D\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0458\u0430 \u0435\u043A\u0441\u0442\u0435\u0440\u043D\u0438\u043C \u0441\u0435\u0440\u0432\u0438\u0441\u0438\u043C\u0430 \u0438 \u0430\u043B\u0430\u0442\u0438\u043C\u0430
 UpdateCenter.PluginCategory.groovy-related=\u0423 \u0432\u0435\u0437\u0438 \u0441\u0430 Groovy
 UpdateCenter.PluginCategory.ios=iOS \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u0438\u0440\u0430\u045A\u0435
-UpdateCenter.PluginCategory.library=\u0411\u0438\u0431\u043B\u0438\u043E\u0442\u0435\u043A\u0435 \u0437\u0430 \u043C\u043E\u0434\u0443\u043B\u0435 (\u0443 \u043A\u043E\u0440\u0438\u0441\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043C\u043E\u0434\u0443\u043B\u0430)
+UpdateCenter.PluginCategory.api-plugin=\u0411\u0438\u0431\u043B\u0438\u043E\u0442\u0435\u043A\u0435 \u0437\u0430 \u043C\u043E\u0434\u0443\u043B\u0435 (\u0443 \u043A\u043E\u0440\u0438\u0441\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043C\u043E\u0434\u0443\u043B\u0430)
 UpdateCenter.PluginCategory.maven=Maven
 UpdateCenter.PluginCategory.cluster=\u0423\u043F\u0440\u0430\u0432\u0459\u0430\u045A\u0435 \u043A\u043B\u0430\u0441\u0442\u0435\u0440\u0430 \u0438 \u0440\u0430\u0441\u043F\u043E\u0434\u0435\u0459\u0435\u043D\u043E \u0438\u0437\u0433\u0440\u0430\u0434\u045A\u0435
 UpdateCenter.PluginCategory.android=Android \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u0438\u0440\u0430\u045A\u0435
@@ -38,7 +38,7 @@ UpdateCenter.PluginCategory.scm=\u0421\u0438\u0441\u0442\u0435\u043C \u0437\u043
 UpdateCenter.PluginCategory.scala=Scala \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u0438\u0440\u0430\u045A\u0435
 UpdateCenter.PluginCategory.scm-related=\u0412\u0435\u0437\u0430\u043D\u043E \u0441\u0430 \u0441\u0438\u0441\u0442\u0435\u043C\u043E\u043C \u0437\u0430 \u0443\u043F\u0440\u0430\u0432\u0459\u0430\u045A\u0435 \u0438\u0437\u0432\u043E\u0440\u043D\u043E\u0433 \u043A\u043E\u0434\u0430
 UpdateCenter.PluginCategory.security=\u0411\u0435\u0437\u0431\u0435\u0434\u043D\u043E\u0441\u0442
-UpdateCenter.PluginCategory.slaves=\u041F\u043E\u043A\u0440\u0435\u0442\u0430\u045A\u0435 \u0438 \u0443\u043F\u0440\u0430\u0432\u0459\u0430\u045A\u0435 \u0430\u0433\u0435\u043D\u0430\u0442\u0430
+UpdateCenter.PluginCategory.agent=\u041F\u043E\u043A\u0440\u0435\u0442\u0430\u045A\u0435 \u0438 \u0443\u043F\u0440\u0430\u0432\u0459\u0430\u045A\u0435 \u0430\u0433\u0435\u043D\u0430\u0442\u0430
 UpdateCenter.PluginCategory.test=\u0422\u0435\u0441\u0442\u0438\u0440\u0430\u045A\u0435
 UpdateCenter.PluginCategory.trigger=\u0410\u0443\u0442\u043E\u043C\u0430\u0442\u0441\u043A\u0438 \u0441\u0442\u0430\u0440\u0442 \u0438\u0437\u0433\u0440\u0430\u0434\u045A\u0435
 \u043D\u0430\u043F\u0430\u0441\u0432\u0430=
diff --git a/core/src/main/resources/jenkins/canonical-labels.txt b/core/src/main/resources/jenkins/canonical-labels.txt
new file mode 100644
index 000000000000..80da6345deac
--- /dev/null
+++ b/core/src/main/resources/jenkins/canonical-labels.txt
@@ -0,0 +1,5 @@
+# This file lists plugin labels pairs that should be unified in the future.
+# If these labels were changed in plugins now, they would not show localized strings in old core versions.
+# See https://github.com/jenkinsci/jenkins/pull/6151
+library api-plugin
+slaves agent
\ No newline at end of file
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
index d52a5fc22414..86fd3f21517f 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
@@ -46,7 +46,7 @@ installWizard_installCustom_selectNone=None
 installWizard_installCustom_selectRecommended=Suggested
 installWizard_installCustom_selected=Selected
 installWizard_installCustom_dependenciesPrefix=Dependencies
-installWizard_installCustom_pluginListDesc=Note that the full list of plugins is not shown here. Additional plugins can be installed in the <strong>Plugin Manager</strong> once the initial setup is complete. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">See the Wiki for more information</a>.
+installWizard_installCustom_pluginListDesc=Note that the full list of plugins is not shown here. Additional plugins can be installed in the <strong>Plugin Manager</strong> once the initial setup is complete. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">See the documentation for more information</a>.
 installWizard_goBack=Back
 installWizard_goInstall=Install
 installWizard_installing_title=Getting Started
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_fr.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_fr.properties
index 1c56c9f84148..847c7993cdd8 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_fr.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_fr.properties
@@ -24,9 +24,6 @@ installWizard_installCustom_selectNone=Aucun
 installWizard_installCustom_selectRecommended=Recommand\u00e9s
 installWizard_installCustom_selected=S\u00e9lectionn\u00e9s
 installWizard_installCustom_dependenciesPrefix=D\u00e9pendances
-installWizard_installCustom_pluginListDesc=Notez que la liste compl\u00e8te des plugins n\'est pas affich\u00e9e ici. \
-Des plugins additionnels peuvent \u00eatre install\u00e9s depuis le <strong>Plugin Manager</strong> une fois la \
-configuration initiale termin\u00e9e. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">Voir le Wiki pour plus d\'informations</a>.
 installWizard_goBack=Retour
 installWizard_goInstall=Installer
 installWizard_installing_title=Installation en cours...
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_it.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_it.properties
index bf4b1141d3b7..fea9125c7255 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_it.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_it.properties
@@ -60,13 +60,6 @@ installWizard_installComplete_message=L''installazione di Jenkins 
 installWizard_installComplete_restartLabel=Riavvia
 installWizard_installComplete_title=Attivitā iniziali
 installWizard_installCustom_dependenciesPrefix=Dipendenze
-installWizard_installCustom_pluginListDesc=Si noti che qui non viene \
-  visualizzato l''elenco completo dei componenti aggiuntivi. Č possibile \
-  installare altri componenti aggiuntivi dal <strong>Gestore componenti \
-  aggiuntivi</strong> una volta che l''installazione iniziale č stata \
-  completata. \
-  <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">\
-  Si veda il wiki per ulteriori informazioni</a>.
 installWizard_installCustom_selectAll=Tutti
 installWizard_installCustom_selected=Selezionati
 installWizard_installCustom_selectNone=Nessuno
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_lt.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_lt.properties
index 422b79b59bdc..337dd6304d46 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_lt.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_lt.properties
@@ -22,7 +22,6 @@ installWizard_installCustom_selectNone=Nieko
 installWizard_installCustom_selectRecommended=Rekomenduojami
 installWizard_installCustom_selected=Pa\u017eym\u0117ti
 installWizard_installCustom_dependenciesPrefix=Priklausomyb\u0117s
-installWizard_installCustom_pluginListDesc=Pasteb\u0117tina, kad \u010dia nerodomas pilnas pried\u0173 s\u0105ra\u0161as. Papildomus priedus galite \u012fdiegti <strong>Pried\u0173 tvarkykl\u0117je</strong>, kai bus baigtas pradinis diegimas. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">Daugiau informacijos rasite vikyje</a>.
 installWizard_goBack=Atgal
 installWizard_goInstall=\u012ediegti
 installWizard_installing_title=\u012evadas
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_pl.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_pl.properties
index c949bf15b2ab..dfdfcc71e388 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_pl.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_pl.properties
@@ -42,7 +42,6 @@ installWizard_installCustom_selectAll=Wszystkie
 installWizard_installCustom_selectNone=\u017Badne
 installWizard_installCustom_selectRecommended=Rekomendowane
 installWizard_installCustom_selected=Wybrane
-installWizard_installCustom_pluginListDesc=Zauwa\u017C, \u017Ce poni\u017Cej nie jest wy\u015Bwietlana pe\u0142na lista wtyczek. Dodatkowe wtyczki mog\u0105 by\u0107 pobrane przez <strong>Mened\u017Cera wtyczek</strong>, kiedy konfiguracja Jenkinsa zostanie zasko\u0144czona. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">Sprawd\u017A wi\u0119cej informacji na Wiki</a>.
 installWizard_goBack=Wr\u00F3\u0107
 installWizard_goInstall=Instaluj
 installWizard_error_connection=Nie uda\u0142o si\u0119 po\u0142\u0105czy\u0107 z Jenkinsem
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_sr.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_sr.properties
index 337050f21c90..7a68c49b9d92 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_sr.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_sr.properties
@@ -21,7 +21,6 @@ installWizard_installCustom_selectNone=\u041D\u0438\u0448\u0442\u0430
 installWizard_installCustom_selectRecommended=\u041F\u0440\u0435\u0434\u043B\u043E\u0436\u0435\u043D\u043E
 installWizard_installCustom_selected=\u0418\u0437\u0430\u0431\u0440\u0430\u043D\u043E
 installWizard_installCustom_dependenciesPrefix=\u0417\u0430\u0432\u0438\u0441\u043D\u043E\u0441\u0442\u0438
-installWizard_installCustom_pluginListDesc=\u041A\u043E\u043C\u043F\u043B\u0435\u0442\u0430\u043D \u043D\u0438\u0437 \u043C\u043E\u0434\u0443\u043B\u0430 \u043D\u0438\u0458\u0435 \u043F\u0440\u0438\u043A\u0430\u0437\u0430\u043D\u043E. \u0414\u043E\u0434\u0430\u0442\u043D\u0435 \u043C\u043E\u0434\u0443\u043B\u0435 \u043C\u043E\u0433\u0443 \u0431\u0438\u0442\u0438 \u0438\u043D\u0441\u0442\u0430\u043B\u0438\u0440\u0430\u043D\u0438 \u0441\u0430 <strong>\u0423\u043F\u0440\u0430\u0432\u0459\u0430\u0447\u0435\u043C \u043C\u043E\u0434\u0443\u043B\u0430</strong>. <a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">\u041F\u0440\u0435\u0433\u043B\u0435\u0434\u0430\u0458\u0442\u0435 \u0412\u0438\u043A\u0438 \u0437\u0430 \u0432\u0438\u0448\u0435 \u0434\u0435\u0442\u0430\u0459\u0430</a>.
 installWizard_goBack=\u041D\u0430\u0437\u0430\u0434
 installWizard_goInstall=\u0418\u043D\u0441\u0442\u0430\u043B\u0438\u0440\u0430\u0458
 installWizard_installing_title=\u041F\u043E\u0447\u0435\u0442\u0430\u043A
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard_zh_CN.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard_zh_CN.properties
index 9ba84c06c0ab..115ba1786fc6 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard_zh_CN.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard_zh_CN.properties
@@ -45,7 +45,6 @@ installWizard_installCustom_selectNone=\u65e0
 installWizard_installCustom_selectRecommended=\u5efa\u8bae
 installWizard_installCustom_selected=\u5df2\u9009\u62e9
 installWizard_installCustom_dependenciesPrefix=\u4f9d\u8d56
-installWizard_installCustom_pluginListDesc=\u6ce8\u610f\uff0c\u8fd9\u91cc\u5e76\u672a\u663e\u793a\u5b8c\u6574\u7684\u63d2\u4ef6\u5217\u8868\u3002\u4e00\u65e6\u521d\u59cb\u5b89\u88c5\u5b8c\u6210\u540e\uff0c\u53ef\u901a\u8fc7<strong>\u63d2\u4ef6\u7ba1\u7406\u5668</strong>\u5b89\u88c5\u5176\u4ed6\u63d2\u4ef6\u3002<a href="https://www.jenkins.io/redirect/installation-wizard" rel="noopener noreferrer" target="_blank">\u67e5\u770bwiki\u4e86\u89e3\u66f4\u591a</a>\u3002
 installWizard_goBack=\u540e\u9000
 installWizard_goInstall=\u5b89\u88c5
 installWizard_installing_title=\u65b0\u624b\u5165\u95e8
diff --git a/core/src/test/java/jenkins/util/PluginLabelUtilTest.java b/core/src/test/java/jenkins/util/PluginLabelUtilTest.java
new file mode 100644
index 000000000000..312aa61ac32b
--- /dev/null
+++ b/core/src/test/java/jenkins/util/PluginLabelUtilTest.java
@@ -0,0 +1,19 @@
+package jenkins.util;
+
+import static org.junit.Assert.assertArrayEquals;
+
+import net.sf.json.JSONArray;
+import org.junit.Test;
+
+public class PluginLabelUtilTest {
+
+    @Test
+    public void testCanonicalLabels() {
+        JSONArray labels = new JSONArray();
+        labels.add("slaves");
+        labels.add("api-plugin");
+        labels.add("library");
+        assertArrayEquals(new String[]{"agent", "api-plugin"},
+                PluginLabelUtil.canonicalLabels(labels));
+    }
+}
diff --git a/pom.xml b/pom.xml
index a48447ab85cb..ed12ddc264e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,7 +70,7 @@ THE SOFTWARE.
   </issueManagement>
 
   <properties>
-    <revision>2.329</revision>
+    <revision>2.331</revision>
     <changelist>-SNAPSHOT</changelist>
 
     <!-- *.html files are in UTF-8, and *.properties are in iso-8859-1, so this configuration is actually incorrect,
@@ -102,7 +102,7 @@ THE SOFTWARE.
     <bridge-method-injector.version>1.23</bridge-method-injector.version>
     <junit.jupiter.version>5.8.2</junit.jupiter.version>
     <mockito.version>4.2.0</mockito.version>
-    <spotless.version>2.19.1</spotless.version>
+    <spotless.version>2.19.2</spotless.version>
   </properties>
 
   <dependencyManagement>
diff --git a/test/pom.xml b/test/pom.xml
index ad5cb291d233..bf637e7d9117 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -83,7 +83,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>${project.groupId}</groupId>
       <artifactId>jenkins-test-harness</artifactId>
-      <version>1682.v4a_71b_f124ca_3</version>
+      <version>1690.vfcb_959006c07</version>
       <scope>test</scope>
       <exclusions>
         <exclusion>
@@ -130,7 +130,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>antisamy-markup-formatter</artifactId>
-      <version>2.6</version>
+      <version>2.7</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/test/src/test/java/hudson/model/AbstractProjectTest.java b/test/src/test/java/hudson/model/AbstractProjectTest.java
index 0229069c0701..d26f4d81f692 100644
--- a/test/src/test/java/hudson/model/AbstractProjectTest.java
+++ b/test/src/test/java/hudson/model/AbstractProjectTest.java
@@ -357,17 +357,23 @@ public void queueSuccessBehaviorOverHTTP() throws Exception {
         JenkinsRule.WebClient wc = j.createWebClient()
                 .withThrowExceptionOnFailingStatusCode(false);
 
-        WebResponse rsp = wc.goTo(p.getUrl() + "build", null).getWebResponse();
+        WebResponse rsp = wc.getPage(wc.addCrumb(new WebRequest(new URL(j.getURL(), p.getUrl() +
+                "build?delay=0"),
+                HttpMethod.POST))).getWebResponse();
         assertEquals(HttpURLConnection.HTTP_CREATED, rsp.getStatusCode());
         assertNotNull(rsp.getResponseHeaderValue("Location"));
 
-        WebResponse rsp2 = wc.goTo(p.getUrl() + "build", null).getWebResponse();
+        WebResponse rsp2 = wc.getPage(wc.addCrumb(new WebRequest(new URL(j.getURL(), p.getUrl() +
+                "build?delay=0"),
+                HttpMethod.POST))).getWebResponse();
         assertEquals(HttpURLConnection.HTTP_CREATED, rsp2.getStatusCode());
         assertEquals(rsp.getResponseHeaderValue("Location"), rsp2.getResponseHeaderValue("Location"));
 
         p.makeDisabled(true);
 
-        WebResponse rsp3 = wc.goTo(p.getUrl() + "build", null).getWebResponse();
+        WebResponse rsp3 = wc.getPage(wc.addCrumb(new WebRequest(new URL(j.getURL(), p.getUrl() +
+                "build?delay=0"),
+                HttpMethod.POST))).getWebResponse();
         assertEquals(HttpURLConnection.HTTP_CONFLICT, rsp3.getStatusCode());
     }
 
diff --git a/test/src/test/java/hudson/model/BuildAuthorizationTokenSEC2558Test.java b/test/src/test/java/hudson/model/BuildAuthorizationTokenSEC2558Test.java
new file mode 100644
index 000000000000..89a79cc7a9a5
--- /dev/null
+++ b/test/src/test/java/hudson/model/BuildAuthorizationTokenSEC2558Test.java
@@ -0,0 +1,70 @@
+package hudson.model;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.collection.IsCollectionWithSize.hasSize;
+import static org.junit.Assert.assertThrows;
+
+import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
+import com.gargoylesoftware.htmlunit.HttpMethod;
+import com.gargoylesoftware.htmlunit.WebRequest;
+import java.lang.reflect.Field;
+import java.net.URL;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+
+// The existing @Before is annoying so this class is independent
+// TODO : Using @Nested class could be more clean than using separate class
+// TODO : Merge back into BuildAuthorizationTokenTest
+public class BuildAuthorizationTokenSEC2558Test {
+
+    @Rule
+    public JenkinsRule jr = new JenkinsRule();
+
+    private static final String token = "whatever";
+
+    @Test
+    @Issue("SECURITY-2558")
+    public void triggerJobWithoutSecurityRealm_ShouldSucceed_WithPost() throws Exception {
+        FreeStyleProject project = createFreestyleProjectWithToken();
+        JenkinsRule.WebClient wc = jr.createWebClient();
+        wc.getPage(wc.addCrumb(new WebRequest(new URL(jr.getURL(), project.getUrl() +
+                "build?delay=0"),
+                HttpMethod.POST)));
+        jr.waitUntilNoActivity();
+        assertThat("the project should have been built", project.getBuilds(), hasSize(1));
+    }
+
+    @Test
+    @Issue("SECURITY-2558")
+    public void triggerJobWithoutSecurityRealm_ShouldFail_WithGet() throws Exception {
+        FreeStyleProject project = jr.createFreeStyleProject();
+        JenkinsRule.WebClient wc = jr.createWebClient();
+        FailingHttpStatusCodeException fex = assertThrows(
+                "should not reach here since only POST request can",
+                FailingHttpStatusCodeException.class,
+                () -> wc.getPage(new WebRequest(new URL(jr.getURL(), project.getUrl() + "build?delay=0"), HttpMethod.GET)));
+        assertThat("Should fail with method not allowed", fex.getStatusCode(), is(405));
+    }
+
+    @Test
+    @Issue("SECURITY-2558")
+    public void triggerJobWithoutSecurityRealm_ButWithToken_ShouldSucceed_WithGet() throws Exception {
+        FreeStyleProject project = createFreestyleProjectWithToken();
+        JenkinsRule.WebClient wc = jr.createWebClient();
+        wc.getPage(new WebRequest(new URL(jr.getURL(), project.getUrl() + "build?delay=0&token=" + token),
+                HttpMethod.GET));
+        jr.waitUntilNoActivity();
+        assertThat("the project should have been built", project.getBuilds(), hasSize(1));
+    }
+
+    private FreeStyleProject createFreestyleProjectWithToken() throws Exception {
+        FreeStyleProject fsp = jr.createFreeStyleProject();
+        Field f = AbstractProject.class.getDeclaredField("authToken");
+        f.setAccessible(true);
+        f.set(fsp, new BuildAuthorizationToken(token));
+        return fsp;
+    }
+}
diff --git a/test/src/test/java/jenkins/model/ParameterizedJobMixInTest.java b/test/src/test/java/jenkins/model/ParameterizedJobMixInTest.java
index 5d5db2f0a3ea..0ef25291bdb1 100644
--- a/test/src/test/java/jenkins/model/ParameterizedJobMixInTest.java
+++ b/test/src/test/java/jenkins/model/ParameterizedJobMixInTest.java
@@ -24,10 +24,18 @@
 
 package jenkins.model;
 
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
+
+import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
+import com.gargoylesoftware.htmlunit.HttpMethod;
+import com.gargoylesoftware.htmlunit.WebRequest;
 import hudson.model.FreeStyleProject;
 import hudson.model.ParametersDefinitionProperty;
 import hudson.model.Queue;
 import hudson.model.StringParameterDefinition;
+import java.net.URL;
 import javax.servlet.http.HttpServletResponse;
 import org.junit.Assert;
 import org.junit.Rule;
@@ -61,7 +69,12 @@ public void doBuildWithParameters_shouldFailWhenInvokingDisabledProject() throws
         project.doDisable();
 
         final JenkinsRule.WebClient webClient = j.createWebClient();
-        webClient.assertFails(project.getUrl() + "buildWithParameters", HttpServletResponse.SC_CONFLICT);
+
+        FailingHttpStatusCodeException fex = assertThrows(
+                "should fail when invoking disabled project",
+                FailingHttpStatusCodeException.class,
+                () -> webClient.getPage(webClient.addCrumb(new WebRequest(new URL(j.getURL(), project.getUrl() + "build?delay=0"), HttpMethod.POST))));
+        assertThat("Should fail with conflict", fex.getStatusCode(), is(409));
     }
 
     @Test
@@ -73,7 +86,7 @@ public void doBuildQuietPeriodInSeconds() throws Exception {
         project.setQuietPeriod(projectQuietPeriodInSeconds);
 
         final JenkinsRule.WebClient webClient = j.createWebClient();
-        webClient.goTo(project.getUrl() + "build", "");
+        webClient.getPage(webClient.addCrumb(new WebRequest(new URL(j.getURL(), project.getUrl() + "build"), HttpMethod.POST)));
         long triggerTime = System.currentTimeMillis();
 
         Queue.Item item = Jenkins.get().getQueue().getItem(1);
diff --git a/test/src/test/java/jenkins/model/lazy/LazyBuildMixInTest.java b/test/src/test/java/jenkins/model/lazy/LazyBuildMixInTest.java
index 656df07b9bf7..b95aa83bfdbe 100644
--- a/test/src/test/java/jenkins/model/lazy/LazyBuildMixInTest.java
+++ b/test/src/test/java/jenkins/model/lazy/LazyBuildMixInTest.java
@@ -90,9 +90,10 @@ public class LazyBuildMixInTest {
     @Test public void newRunningBuildRelationFromPrevious() throws Exception {
         FreeStyleProject p = r.createFreeStyleProject();
         p.getBuildersList().add(new SleepBuilder(1000));
-        FreeStyleBuild b1 = p.scheduleBuild2(0).get();
+        FreeStyleBuild b1 = r.buildAndAssertSuccess(p);
         assertNull(b1.getNextBuild());
         FreeStyleBuild b2 = p.scheduleBuild2(0).waitForStart();
         assertSame(b2, b1.getNextBuild());
+        r.assertBuildStatusSuccess(r.waitForCompletion(b2));
     }
 }