Context Jenkins is a CI/CD solution and as such, it is critical that the open source plugins that constitute an integral part of it don’t expose the systems they are used on to any security risks and vulnerabilities. It is in that context that we worked as an audit/code review team to track and report such flaws and problematic practices. We worked in collaboration with Jenkins Security...

Keeping up with our goal to clean up some of the technical debt inside Jenkins Core and reduce the maintenance overheads, we are happy to report we were able to remove a long-deprecated Apache Commons Digester library. Jenkins Core does not depend anymore on Apache Commons Digester v.2.1, a version that has been released in 2010. Some plugins will require update to operate properly after the...

This year, the Jenkins Contributor Awards will be run by the Continuous Delivery Foundation (CDF) along with many other CDF Community Awards. The nominations are currently open and are being accepted using GitHub issues to make the process more transparent. Any contributor is eligible this time around! The deadline to nominate someone is May 14, 2021, and voting will open in May. Nominate contributors or vote...

In April of last year, we launched a new Jenkins community website called JenkinsIsTheWay. The Jenkins Is The Way site has collected the experiences of Jenkins users around the world as they develop software and create solutions. They are charting new paths, discovering new opportunities, and overcoming challenges. That’s what makes Jenkins Is The Way tick. Engineers in the Netherlands might have already met challenges faced by developers...

With the mentor summit and the project retrospectives finished in October, now we can call Google Summer of Code 2020 officially over in the Jenkins community. On behalf of the Jenkins org team, we would like to thank all participants: students, mentors, applicants, and dozens of other contributors who participated in the project this year. Google Summer of Code would not be successful without the active participation...

The Jenkins project has used Jira to track issues for many years. Jenkins core, Jenkins modules, Jenkins infrastructure, and many Jenkins plugins manage their issue reports with our Jira server. Jira helps the Jenkins project manage issues and tasks related to over 250 000 Jenkins installations. It tracks bugs, enhancement requests, tasks, and security issues. It is used regularly by users around the world. We’re grateful for the long-standing contribution...

Cleaning up technical debt is a perennial topic among Jenkins core developers, and one of the most visible issues is the use of obsolete and/or forked third-party libraries. In a world where Dependabot is offering updates to libraries released just hours before, it is unpleasant to be working with dependencies that are many years old. Since large organizations in particular are unhappy to install software using obsolete or...

Recently we have selected Jenkins 2.263 as a new baseline for the LTS release line, with ETA in December 2020. It allows delivering significant and in some cases breaking changes which have been previously on hold. Beginning with the Jenkins 2.264 release on October 27, 2020, we’ve entered a period where the Jenkins weekly releases will include more significant changes than usual. That period of more significant...

A little over a month ago, GitHub announced the general availability of its code scanning solution. It’s based on CodeQL, which makes it pretty easy to write queries for it and run them using the CodeQL GitHub action, CodeQL command line tools, or on lgtm.com. Many of the security vulnerabilities discovered in Jenkins plugins are fairly similar to each other, and unfortunately they’re usually specific to...

Hello, world! GSoC 2020 Phase 3 has ended now and it was a great period for the Jenkins Windows Services - YAML Configuration Support project. In this blog post, I will announce the updates during the GSoC 2020 - Phase 2 and Phase 3. If you are not already aware of this project, I would recommend reading this blog post which was published after GSoC 2020...