Back to blog

Jenkins 2023 Recap

Mark Waite
Mark Waite
Bruno Verachten
Bruno Verachten
Wadeck Follonier
Wadeck Follonier
Kevin Martens
Kevin Martens
Alyssa Tong
Alyssa Tong
January 25, 2024

Jenkins 2023 recap

Security Update

Contributed by: Wadeck Follonier

The Jenkins Security team has multiple missions, with the most visible to users being the publication of advisories.

In 2023, the team published 17 advisories: 4 included Jenkins core, and 13 were solely about plugins. In total, 211 vulnerabilities were announced.

In terms of reporting trends, we have seen an increase in people reporting CVEs originating from dependencies. Our position on this issue is that when analyzing CVEs, if they are impacting we correct them and publish an advisory; otherwise, we publish a blog post only for the most popular ones, such as Spring4Shell or Log4Shell. With dozens of CVEs published every month, we prefer not to publish information for each one unless it is relevant.

To reduce the occurrence of those issues and provide reporters with a point of reference, we have updated the security policy in Docker.

We would also like to extend our gratitude to the GitHub Security Lab for reporting 27 vulnerabilities through their CodeQL rules and for their collaborative efforts in both the analysis and the enhancement of our tools.

The team does not rely solely on “external” security researchers to find vulnerabilities; a considerable amount of time during the year is spent on proactively auditing the code. This year was marked by some specific research areas: OAuth flow and disabled SSL validation, in addition to the usual CSRF, XSS, or XXE vulnerabilities.

Additionally, we have expanded the scope of our security reviews for Pull Requests, particularly in Jenkins core. Approximately 70 PRs were labeled as “security-approved”. This proactive measure allowed the team to prevent the introduction of some vulnerabilities, which is significantly less costly than addressing them after they have been incorporated into the production code.

As part of our mission, raising community awareness about security is also a key factor in reducing the introduction of vulnerabilities at an early stage. In this regard, we welcomed Andrea to our security team for a summer internship from June to August. By the end of it, he had successfully reported 28 vulnerabilities. For more information about his internship, you can read his blog post.

Education and tooling are closely related for us. We are investing time to propose new security automation and to improve our existing tooling. This year, we introduced the existing CodeQL ruleset for hosting requests. This provided future maintainers with detailed explanations of the findings. Along with this effort, we also enhanced our security scan by supporting warning suppression through code annotation.

Continuing with tooling improvements, we added a beta feature to the bot present in SECURITY tickets, allowing maintainers to block or unblock releases of their plugins. The intent of this feature is to reduce the likelihood of an involuntary release when one is staged in private for a future advisory.

We also introduced the possibility of having an exclusive CD mode. This option allows maintainers to force all releases of their plugins to be done through the official CI, reducing the risk related to their laptops being compromised.

Nowadays, AI is everywhere. For security, it’s often a bit more complicated due to the aspect of confidentiality. To circumvent this while still delving into the topic, we have been using OpenAI API since October to triage the new JENKINS tickets. It’s the public tracker for Jenkins, but sometimes, vulnerability reports are wrongly submitted there. AI has helped us detect whether something is security-related and thus expands our scope without needing to monitor everything. This approach has proven to be quite successful after three months.

Along with other small projects, we continue to work on more long-term/background projects, such as the introduction of the Content-Security-Policy header. Throughout the year, we made significant progress in covering the core usage of inline JavaScript.

Governance Update

Contributed by: Mark Waite

Jenkins is a project of the Continuous Delivery Foundation. We’re grateful for the many different ways that the Continuous Delivery Foundation supports the Jenkins project. They provide financial support for Jenkins infrastructure, promotional support for Jenkins initiatives, infrastructure support for the Jenkins issue tracker, and consultation on many other topics. The Jenkins project was well represented at cdCon 2023 and at cdCon Japan.

Infrastructure Update

Contributed by: Damien Duportal

Infrastructure costs decreased by 21% in 2023 while usage increased. Jenkins use is increasing worldwide and Jenkins infrastructure continues to meet the growing needs.

Jenkins infrastructure broadened its operating environments in 2023 by expanding its use of ARM64 processors to reduce costs. Additional software improvements were implemented in the Jenkins Pipeline to reduce costs while maintaining reliability.

Costs were further reduced by the Artifactory bandwidth reduction project. We’ve gone from 50 TB per month to 15 TB per month of artifact repository bandwidth use, thanks to help from JFrog and implementations of artifact caching proxies by the infrastructure team.

We’re grateful for donations from our organizational sponsors like CloudBees, the Continuous Delivery Foundation, and the Linux Foundation and for our infrastructure sponsors including GitHub, JFrog, Atlassian, Microsoft, DigitalOcean, Netlify, PagerDuty, Discourse, Datadog, and Cloudflare. We deeply appreciate the mirror providers around the world like Oregon State University Open Source Lab, Tsinghua University, XMission, Yamagata University, Servana, Belnet, and RWTH Aachen University.

User Experience Update

Contributed by: Mark Waite

The badly outdated and unmaintained Prototype.js JavaScript library has been removed from Jenkins core and from over 50 Jenkins plugins. Special thanks to Basil Crow and Tim Jacomb for their work to identify and replace Prototype.js references in Jenkins JavaScript.

User interface look and feel improvements continued throughout 2023. Improvements were delivered in forms, menus, and pages. Menus are easier to navigate and easier to understand.

Multiple improvements were released for the Jenkins management pages, including the new “Appearance” page that makes it easier to use Jenkins themes. Forms, pages, and menus have all been enhanced in 2023.

Navigation of cloud management pages is simpler and clearer thanks to layout and navigation enhancements.

Hundreds of user interface improvement pull requests have been merged this year. Thanks to all those contributors!

Platform Modernization Update

Contributed by: Bruno Verachten

The year 2023 has been a significant period for the Jenkins project, marked by notable advancements and achievements. The community as a whole has played a crucial role in shaping the project’s trajectory.

Software Versions

  • Jenkins Core: The project witnessed multiple Jenkins Core releases, featuring advancements in stability, security, and added features. Notable releases include Jenkins LTS 2.426.2 and weekly releases, reflecting our commitment to both stability and innovation.

  • Java Versions: The transition to Java 17 and subsequently Java 21 marked a significant step forward. The community diligently tested the top 250 plugins with Java 21, showcasing the project’s adaptability to evolving technologies.

  • Java Support Plan: The proposal and discussion around the 2+2+2 Java Support Plan demonstrated a strategic vision for the project’s future. This aligns with industry standards, ensuring long-term sustainability.

  • Dependency Updates: Components throughout the Jenkins project were updated in 2023, including operating systems, libraries, and tools. We also made essential transitions, such as moving to Debian Bookworm, the latest Alpine version, and implementing an end-of-life warning. This helps users know when they need to upgrade their OS or Java version. Additionally, we officially declared the end of life for Jenkins support of Red Hat Enterprise Linux 7 and derivatives like Centos 7 and Amazon Linux 2.

Docker Images and Containers

  • The transition to using OS-based images and installing JDK from binaries in some instances, rather than relying solely on Temurin images, highlighted our adaptability to evolving best practices.

  • Now, all Docker images are available with a version of Eclipse Temurin JDK21.

  • We expanded our platform support to include amd64, aarch64, s390x, windows/amd64, and even armv7 for some images.

  • Regular dependency updates were a focus in 2023:

  • Docker agent received 205 pull requests.

  • Inbound agent saw 132 pull requests.

  • Docker ssh-agent had 139 pull requests.

  • Docker had 219 pull requests.

Expanded Compatibility Testing

The Jenkins project added over 90 plugins to the compatibility testing suite that is part of our plugin bill of materials. The most popular Jenkins plugins are regularly tested in a Jenkins configuration with hundreds of other plugins.

These updates and transitions underscore our commitment to providing a robust and adaptable platform for our users.

Documentation Update

Contributed by: Kevin Martens

Throughout 2023, the Jenkins site and documentation saw several changes from returning and new contributors. Over the course of 12 months, the site had a total of 843 pull requests merged, 67 blog posts from 21 different authors, and 98 plugin wiki migrations completed. These pull requests and blog posts covered everything from minor adjustments and refinements to major announcements regarding Jenkins and everything in between.

Some of the notable changes that happened were:

  • The addition of the Platform Information section, which contains Java information and Jenkins support policies.

  • The Plugin Health Score is now visible on, providing users insight into the health of plugins in the Jenkins ecosystem.

  • The Books page was updated with new additions & formatting.

  • The Contributor Spotlight page was launched to highlight the heaviest contributors to Jenkins. The goal is to appreciate and showcase the talent and hard work that goes into keeping Jenkins working behind the scenes.

    • This was done in collaboration with the Outreach & Advocacy SIG.

Several enhancements to for mobile users were implemented so that regardless of platform, everyone can access and read every screen. Additionally, there is a new layout for the blog, where each post is displayed as a card.

There was also the addition of UpdateCLI to the repository. This has helped ensure that whenever new versions of Jenkins are released, the documentation is updated accordingly. Thanks to Bruno Verachten for his work on getting this configured and added.

The Google Summer of Code participants also provided various contributions to both Jenkins core and, sharing their experiences and insights with the community.

In the coming year, we are also planning on implementing a versioned documentation site, where users will select which Jenkins LTS version they are using and see the corresponding documentation. This is the result of a Google Summer of Code project originally looking at alternative build tools for Thanks to Kris Stern and Vandit Singh for all their work on this.

Outreach and advocacy Update

Contributed by: Alyssa Tong

In 2023, through the collaboration and contributions of new and existing community members from around the globe, the Jenkins project successfully completed the following projects for the betterment of Jenkins:

DevOps Dozen Most Innovative DevOps Open Source Project award.

The Jenkins project is also excited to share what’s to come in 2024:

Jenkins Momentum

In August, we worked together with the Linux Foundation and the CloudBees communications teams to report out on achievements of the Jenkins project. We highlighted growth in Jenkins jobs, along with the vibrant contributor community and impressive community sponsors. Jenkins still enjoys an estimated 44% market share and is a critical part of the IT infrastructure enabling organizations to automate their CI/CD processes.

Specifically, as reported in the news release and from the community stats:

  • Monthly Jenkins Pipeline jobs defined grew 79% during the period June 2021 – June 2023, from 27,105,176 jobs per month to 48,625,398 jobs per month. Jenkins Pipeline jobs are used to build out CI/CD software delivery automation flows, or software pipelines. Growth in this job type is a leading indicator of CI/CD adoption and, specifically, the pervasiveness of Jenkins-based CI/CD.

  • Total monthly jobs rose 45% from June 2021, when 50,785,205 jobs per month were defined, to June 2023 when 73,746,418 jobs per month were defined. Growth in the total monthly workload (all Jenkins jobs) further demonstrates the expansion of Jenkins usage within organizations.

The news release also called out the 600 active contributors the Jenkins project has, along with sponsors such as GitHub, Atlassian, AWS, CloudBees, Datadog, DigitalOcean, Discourse, Fastly, GitHub, IBM, JFrog, Netlify, PagerDuty, and Sentry.


The Jenkins project consists of more than 2000 plugins and components which are maintained and developed by thousands of contributors from around the globe. Thanks to them, a lot of improvements happen in the project every day. We are grateful to everybody who participates in the project, regardless of contribution size. Every bit makes a difference: new features, bug fixes, documentation, blog posts, well reported issues, Stackoverflow responses, etc.


Here’s looking forward to many more exciting accomplishments to come in 2024!

About the authors



Damien is the Jenkins Infrastructure officer and a software engineer at CloudBees working as a Site Reliability Engineer for the Jenkins Infrastructure project. Not only he is a decade-old Hudson/Jenkins user but also an open-source citizen who participates in Updatecli, Asciidoctor, Traefik and many others.

Mark Waite

Mark Waite

Mark is a member of the Jenkins governing board, a long-time Jenkins user and contributor, a core maintainer, and maintainer of the git plugin, the git client plugin, the platform labeler plugin, the embeddable build status plugin, and several others. He is one of the authors of the "Improve a plugin" tutorial.

Bruno Verachten

Bruno Verachten

Bruno is a father of two, husband of one, geek in denial, beekeeper, permie and a Developer Relations for the Jenkins project. He’s been tinkering with continuous integration and continuous deployment since 2013, with various products/tools/platforms (Gitlab CI, Circle CI, Travis CI, Shippable, Github Actions, …​), mostly for mobile and embedded development.
He’s passionate about embedded platforms, the ARM&RISC-V ecosystems, and Edge Computing. His main goal is to add FOSS projects and platforms to the ARM&RISC-V architectures, so that they become as boring as X86_64.
He is also the creator of miniJen, the smallest multi-cpu architectures Jenkins instance known to mankind.

Wadeck Follonier

Wadeck Follonier

Wadeck is the Jenkins security officer, leading the security team in improving Jenkins security. He likes to provide solutions that are both useful and easy to use.

Kevin Martens

Kevin Martens

Kevin Martens is part of the CloudBees Documentation team, helping with Jenkins documentation creation and maintenance.

Alyssa Tong

Alyssa Tong

Member of the Jenkins Advocacy and Outreach SIG. Alyssa drives and manages Jenkins participation in community events and conferences like FOSDEM, SCaLE, cdCON, and KubeCon. She is also responsible for Marketing & Community Programs at CloudBees, Inc.