We just released security updates to Jenkins, versions 2.121 and 2.107.3, that fix multiple security vulnerabilities. Additionally, we announce previously published security issues and corresponding fixes in these plugins: Black Duck Hub Groovy Postbuild Gitlab Hook (fix unreleased) For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities. Android Lint CCM Credentials Binding JUnit Pipeline: Supporting APIs For an overview of these security fixes, see the security advisory. Subscribe to the jenkinsci-advisories mailing list to receive important future notifications related to Jenkins security....

Last week, buddybuild — a hosted continuous integration service focused on mobile apps — announced that it had been acquired by Apple, and consequently its complete Android offering, along with its free tier for iOS users, will be discontinued at the beginning of March. This was a fairly undesirable way to start 2018 for buddybuild’s Android users and, with less than two months to find...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities. Active Choices (uno-choice) Build-Publisher Dependency Graph Viewer global-build-stats Additionally, the Multijob Plugin also received a security update several weeks ago. For an overview of these security fixes, see the security advisory. Active Choices Plugin distribution had been suspended since April due to its mandatory dependency on the suspended Scriptler Plugin. That dependency has been made optional, so Active Choices can be...

We just released security updates to Jenkins, versions 2.84 and 2.73.2, that fix several security vulnerabilities. Additionally, we published a new release of Swarm Plugin whose client contains a security fix, and Maven Plugin 3.0 was recently released to resolve a security issue. Users of Swarm Plugin and Maven Plugin should update these to their respective newest versions. For an overview of what was fixed, see the...

This is a guest post by Andrew Bayer, who is one of the authors of the Declarative Pipeline plugin, and is a software engineer on the Pipeline team at CloudBees, Inc. A year ago at Jenkins World 2016, we unveiled Declarative Pipeline, a structured way to define your Pipeline. It’s been a great year for Declarative and Pipeline in general, with the release of Declarative Pipeline 1.0 in February, multiple releases since...

This is a guest post by Pui Chee Chen, Product Manager at Microsoft working on Azure DevOps open source integrations. Recently, we improved the Azure Credential plugin by adding a custom binding for Azure Credentials which allows you to use an Azure service principal (the analog to a service or system account) via the Credentials Binding plugin. This means it’s now trivial to run Azure CLI commands from a Jenkins Pipeline. We...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including multiple high severity ones. We strongly recommend updating the following plugins as soon as possible: Blue Ocean Pipeline: Groovy Plugin Script Security Plugin Less severe security updates have been released for these plugins: Config File Provider Plugin Datadog Plugin Deploy to container Plugin DRY Plugin Pipeline: Input Step Plugin Static Analysis Utilities Plugin Additionally, the OWASP Dependency-Check Plugin recently also received a security update. For...

This is a guest post by Mark Waite, who maintains the git plugin, the git client plugin, and is a technical evangelist for CloudBees, Inc. While developing the "Intro to Plugin Development" workshop for Jenkins World 2017, I was impressed by the many Jenkins plugin development videos, tutorials, and guides. Here are some of my favorite plugin development topics and links. Plugin tutorial videos Jenkins Online Meetup Plugin Development Part 1 -...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including high severity ones: Docker Commons Plugin Git Plugin GitHub Branch Source Plugin Parameterized Trigger Plugin Periodic Backup Plugin Pipeline: Build Step Plugin Pipeline: Groovy Plugin Poll SCM Plugin Role-based Authorization Strategy Plugin Script Security Plugin Sidebar Link Plugin Subversion Plugin Additionally, the SSH Plugin received a security update a few days ago. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories...