We just released Jenkins 1.638 and 1.625.2 which contain important security fixes, including a fix for the zero-day vulnerability published on Friday. Please see the security advisory for more information. Want to be kept up to date on Jenkins security releases, including advance notice on scheduled security updates? Subscribe to the jenkinsci-advisories mailing list!...

Updated 2015-11-11 15:00 UTC: We have released Jenkins 1.638 and 1.625.2 which contain a fix for this vulnerability. See the security advisory for more information about these releases. Updated 2015-11-06 03:55 UTC: Included a updated mitigation script which doesn’t have a Jenkins boot race condition Earlier today we received numerous reports about a previously undisclosed "https://en.wikipedia.org/wiki/Zero-day_%28computing%29[zero day]" critical remote code execution vulnerability and exploit in Jenkins...

For the past several years we’ve been attending FOSDEM, a massive free and open source event in Brussels, Belgium. In preparation for this upcoming FOSDEM (2016) event, we will be hosting an open planning meeting via Google Hangouts during this week’s "https://wiki.jenkins.io/display/JENKINS/Office+Hours[Office Hours]." Agenda: Gauge who can participate and at what capacity. Pre-FOSDEM Contributor Summit After-hours meetup/happy hour Plans for a Jenkins stand (assuming we’re accepted): What demo materials Schwag Revised Jenkins...

I hope many of you have had a chance to see the Jenkins 2.0 thread. I’m going to use the office hours next Wednesday to go through this proposal. This is still primarily for developers in the project, as it’s "just" a proposal with lots of details unspecified. It’s more meant to help people understand where I’m coming from and what goals I have in mind...

Just as in past years, we are running a survey this year, to get some objective insights into what our users would like to see in the Jenkins project. Obviously, the developers in the project deal with individual bug reports and feature requests all the time, but sometimes those day-to-day issues distract you from a bigger picture. This year, we kept some of the questions...

We’re currently setting up a program to support community members' travel to Jenkins community events. Our goal is to enable more members of the community to meet each other and exchange ideas in person. We’re still hashing out the details, but it’ll be available to every Jenkins community member. Apply, telling us what Jenkins-related event you’d like to attend and how awesome you are, and...

After several months of inactivity, office hours, the bi-weekly meeting of Jenkins users and developers to learn more about Jenkins, are back. I’ll host the first session next Wednesday at 11 am PDT. This session will be about Stapler, focusing on what Jenkins plugin authors need to know about it, e.g. request routing, form submission handling, or how Jelly/Groovy views work. While this is going to...

In continuing my infra upgrade work, this weekend I’ll be migrating JIRA to another server. This will make upgrade more manageable and testable. The service will be disrupted for a few hours. Check out our @jenkinsci on Twitter for up-to-the-minute status. Once the migration is done, the next step is to upgrade them....

+ For the past few weeks, I’ve burnt a lot of midnight oil to get Confluence containerized. The goal is to make Confluence upgrade more manageable and testable. In the process, I’ve not only containerized Confluence, but also containerized some other services, including mock LDAP server, to be able to test the copy of the production Confluence dataset against newer versions of Confluence before upgrading...

It’s that time of the year again: 2015 Jenkins User Conference Registration is OPEN for all cities. This year, we are making some changes to JUC — JUC will be a two-day event in three out of the four cities across the globe. You will get opportunities to network with other users and developers in the community, learn more about how other people are...