Eagle-eyed readers of today’s security advisory may already have noticed that we consider the cross-site scripting (XSS) vulnerabilities to be 'High' severity. This is a change from previous security advisories, in which similar vulnerabilities got a 'Medium' score. We follow the guidelines of CVSS version 3.0 for the severity we assign to these issues. Their examples for XSS vulnerabilities, as well as XSS vulnerabilities in other software,...

This blog post is about our coding phase 1 progress on GSoC project: GitHub Checks API Plugin. The GitHub Checks API is a highly customized way to integrate CI tools to make reports for pull-requests (PRs). It allows users to see CI reports on GitHub pages directly. Figure 1. GitHub Check Run Screenshot from GitHub Docs What’s more exciting is that it can leave annotations on specific lines...

Git Plugin Performance Improvement is a Google Summer of Code 2020 project. It aims to improve the performance of the git plugin, which provides fundamental git functionalities. Internally, the plugin provides these functionalities using two implementations: command line git and JGit (pure java implementation). CLI git is the default implementation for the plugin, a user can switch to JGit if needed The project is divided into two parallel...

Hello all, I am Buddhika Chathuranga from Sri Lanka and I am a final year undergraduate at the Faculty of IT, University of Moratuwa. I am participating in GSoC 2020 with Jenkins. I am working on the Windows Service Wrapper Project. So the Coding Phase 01 of GSoC 2020 is now over and this blog post describes what I have done so far. Windows Service Wrapper is...

Welcome back ! This blog post is briefing my coding phase 1 in Jenkins Machine Learning Plugin for this GSoC 2020. After a fresh introduction of community bonding, On June 1st, coding of GSoC had started officially with phase 1. At this point, every GSoC student should be expected to have a rigid plan with their entire project. With the guidance of mentors I was able...

Externalizing fingerprint storage for Jenkins is a Google Summer of Code 2020 project. We are working on building a pluggable storage engine for fingerprints (see JEP-226). File fingerprinting is a way to track which version of a file is being used by a job/build, making dependency tracking easy. The fingerprint engine of Jenkins can track usages of artifacts, credentials, files, etc. within the system. Currently,...

In this article, I would like to share some highlights from the User Interface track of the Jenkins UI/UX Hackfest we held on May 25..29. This blog post has been slightly delayed by the infrastructure issues we had in the project, but, as for improving the Jenkins UI, it is better late than never. Key highlights from the event: We delivered a preview of Jenkins read-only configuration. During the hackfest...

In 2016, the Jenkins community decided to start removing offensive terminology within the project. The "slave" term was deprecated in Jenkins 2.0 and replaced by the "agent" term. Other terminology was slated for review after the cleanup of the "slave" term which was considered as most problematic one. In 2017, the project began tracking areas for correction. Work has been done on renaming the SSH build agent plugin...