Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including high severity ones: Docker Commons Plugin Git Plugin GitHub Branch Source Plugin Parameterized Trigger Plugin Periodic Backup Plugin Pipeline: Build Step Plugin Pipeline: Groovy Plugin Poll SCM Plugin Role-based Authorization Strategy Plugin Script Security Plugin Sidebar Link Plugin Subversion Plugin Additionally, the SSH Plugin received a security update a few days ago. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories...

In response to the zero-day vulnerability we fixed in November, I wrote the following: Moving forward, the Jenkins security team is revisiting the design of the Jenkins CLI over the coming weeks to prevent this class of vulnerability in the future. If you are interested in participating in that discussion, please join in on the jenkinsci-dev@ mailing list. In early February, several project contributors met after FOSDEM...

These are not security fixes you can apply blindly. We strongly recommend you read this post, as well as the security advisory to understand what the vulnerabilities are, whether and how they affect you, and what to expect when upgrading plugins. Multiple Jenkins plugins received updates today that fix several security vulnerabilities or other security-related issues: Email Extension (Email-ext) Environment Injector (EnvInject) Extensible Choice Parameter Groovy Job DSL Lockable Resources Matrix Authorization Role...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities: Active Directory Distributed Fork Email Extension (Email-ext) Mailer SSH Build Agents For an overview of what was fixed, see the security advisory. Additionally, we also published a security notice for the following plugin and recommend that users disable and uninstall it: Pipeline: Classpath Step This plugin is not part of the Pipeline suite of plugins, despite its name. It’s installed on just...

This is a guest post by Liam Newman, Technical Evangelist at CloudBees. Declare Your Pipelines! Declarative Pipeline 1.0 is here! This is the fourth post in a series showing some of the cool features of Declarative Pipeline. In the previous post, we integrated several notification services into a Declarative Pipeline. We kept our Pipeline clean and easy to understand by using a shared library to make a custom step called sendNotifications that we called at...

This is a guest post by Liam Newman, Technical Evangelist at CloudBees. Declare Your Pipelines! Declarative Pipeline 1.0 is here! This is the third post in a series showing some of the cool features of Declarative Pipeline. In the previous post, we converted a Scripted Pipeline to a Declarative Pipeline, adding descriptive stages and post sections. In one of those post blocks, we included a placeholder for sending notifications. In this blog post, we’ll...

This is a guest post by Liam Newman, Technical Evangelist at CloudBees. Declare Your Pipelines! Declarative Pipeline 1.0 is here! This is the second post in a series showing some of the cool features of Declarative Pipeline. In the previous blog post, we created a simple Declarative Pipeline. In this blog post, we’ll go back and look at the Scripted Pipeline for the Publishing HTML Reports in Pipeline blog post. We’ll convert that Pipeline to...

This is a guest post by Emily Chang, Technical Author at Datadog. A modified version of this article was originally posted on the Datadog blog. If you’re using Jenkins to continuously integrate changes into your projects, it’s helpful to be able to quickly identify build failures and assess their impact on other components of your stack. Datadog’s plugin helps users monitor and alert on the performance of...

In January we announced the release of SCM API 2.0. After the original release was published we identified four new high-impact issues. We decided to remove the new versions of the plugins from the update center until those issues could be resolved. The issues have now been resolved and the plugins are now available from the update center. Summary for busy Jenkins Administrators Upgrading should make multi-branch projects much better....

This is a guest post by Liam Newman, Technical Evangelist at CloudBees. Introduction With all the new developments in Jenkins Pipeline (and Declarative Pipeline on the horizon), it’s easy to forget what we did to create "pipelines" before Pipeline. There are number of plugins, some that have been around since the very beginning, that enable users to create "pipelines" in Jenkins. For example, basic job chaining worked well in many cases, and the Parameterized Trigger...