JCasC Plugin Version Pinning versus Update Center Compatibility in Jenkins 2.361.1 LTS

Jenkins LTS 2.361.1 enforces a Java 11+ baseline, which shifts the toolchain origin for Docker agent builds and alters plugin compatibility boundaries. The JCasC plugin expresses controller settings as YAML, but its symbol coverage is incomplete, leaving certain plugin configurations exposed to manual adjustment. Meanwhile, the plugins.txt mechanism pulls extensions from the Update Center by default, creating a tension between reproducible version pinning and timely security fixes. Core upgrades can invalidate JCasC symbols, and floating Docker image tags such as `latest` replace compiler and runtime versions between builds without explicit pipeline changes.

What is the optimal strategy for pinning plugin versions in plugins.txt while preserving Update Center-driven security updates? How does JCasC symbol drift interact with Java 11+ core upgrades? Which plugin settings remain unexported by JCasC and must be documented separately?