We just released security updates to Jenkins, versions 2.121 and 2.107.3, that fix multiple security vulnerabilities. Additionally, we announce previously published security issues and corresponding fixes in these plugins: Black Duck Hub Groovy Postbuild Gitlab Hook (fix unreleased) For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the...

Anchore provides docker image analysis for user defined acceptance policies to allow automated image validation and acceptance. As developers we would like to know if a change we are proposing introduces a Common Vulnerability and Exposure (CVE). As operators we would like to know what running applications are affected if a new CVE is discovered. Now in Jenkins X pipelines, if we find an Anchore engine service running we...

On behalf of the Jenkins GSoC team and mentors, I would like to welcome Shenyu Zheng, Udara De Silva, Pham Vu Tuan and Abhishek Gautam. They will be working on Google Summer of Code projects in the Jenkins organization, and they have already done some contributions. This year we have the following projects: Code Coverage API Plugin - create a new API Plugin to unify existing Code Coverage plugins and provide new features. Student: Shenyu...

This sort of slid under the radar in the middle of some bigger changes for the JEP-202 reference implementation, so I wanted to call it out now. Arguably this could deserve a retroactive JEP, though I would rather fold it into a JEP for JENKINS-49651 (see below). As of Jenkins 2.118, or plugin parent POM 3.7, you can mark any Java member (class, method, constructor, field, or I suppose also...

Jenkins Essentials has been renamed to Jenkins Evergreen since this was written. A couple weeks ago, I wrote about the Jenkins Essentials effort, on which we’ve been making steady progress. Personally, the most exciting challenge of this project is defining the machinery to drive automatic updates of Jenkins Essentials, which viewed from a high level, are classic continuous delivery challenges. In this post, I wanted to dive into a bit of the...

A few years ago our CTO wrote about building a Continuous Integration server for Ruby On Rails using Jenkins and docker. The solution has been our CI pipeline for the past years until we recently decided to make an upgrade. Why? Jenkins version was way out of date and it was getting difficult to upgrade Wolox has grown significantly over the past years and we’ve been experiencing scaling issues Very few people...

Hello, I am Jenn, the new Product Manager for Blue Ocean and Jenkins Pipeline at CloudBees. I am based out of the Seattle area and am excited to be working on Jenkins. :D We released version 1.5.0 of the Blue Ocean plugin late last week. If you’re using Blue Ocean, you’ll want to grab this update since it includes many improvements and bug fixes! New Features Blue Ocean now includes...

Jenkins X is an opinionated platform for providing CI / CD on top of Kubernetes. We’ve chosen a set of core applications that we install and wire together so things work out-of-the-box, providing a turn key experience. This blog aims to build on previous introductions to Jenkins X and provide a deeper insight to what you get when you install Jenkins X. So what happens? After downloading the jx...