Jenkins 2.576 as next LTS baseline?

[Mark Waite]

The next LTS baseline should be selected tomorrow, August 19, 2026.

I propose Jenkins 2.576 with backport of the size reduction that was included in Jenkins 2.577.  That backport will allow us to provide a single upgrade guide entry covering both pull requests that remove bundled plugins.

I don't think we should choose 2.577 because multiple regressions have been reported and a possible revert of the independent scrolling sidepanel pull request is being discussed.

Mark Waite

[Tim Jacomb]

+1.

(Note: I'll be away for the next couple of weeks, don't wait for me to confirm it as selected)

--
You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/jenkinsci-dev/CAO49JtGekQpD-iQV4orpcTYkCA6TvtZJ18Ohn9-fnBX8GSs3MQ%40mail.gmail.com.

[Jenkins Developers]

+1

[Kris Stern]

+1 from me as well

Best,

Kris

Get Outlook for iOS

---

From: Jenkins Developers <jenkin...@googlegroups.com>
Sent: Wednesday, 19 August 2026 16:54:45
To: Jenkins Developers <jenkin...@googlegroups.com>
Subject: Re: [jenkinsci-dev] Jenkins 2.576 as next LTS baseline?

 

To view this discussion visit https://groups.google.com/d/msgid/jenkinsci-dev/f0b02a13-1ef3-4434-afff-f4f6da4ca584n%40googlegroups.com.

[Daniel Beck]

Given the UI changes have been reverted, and the number of security fixes (i.e., probably annoying to backport, potentially confusing to some users) in 2.580, we could make 2.580 the baseline, as long as we revert the commons-lang2 removal.Thoughts?

Daniel

CONFIDENTIALITY NOTICE: This email and any attachments contain confidential and proprietary information of CloudBees intended only for the named recipient(s). Unauthorized use or distribution is prohibited. If you received this in error, please notify the sender and delete this email.

[Mark Waite]

On Wed, Sep 2, 2026 at 2:42 PM 'Daniel Beck' wrote:

On Tue, Aug 18, 2026 at 4:55 PM Mark Waite <mark.ea...@gmail.com> wrote:

The next LTS baseline should be selected tomorrow, August 19, 2026.

I propose Jenkins 2.576 with backport of the size reduction that was included in Jenkins 2.577.  That backport will allow us to provide a single upgrade guide entry covering both pull requests that remove bundled plugins.

I don't think we should choose 2.577 because multiple regressions have been reported and a possible revert of the independent scrolling sidepanel pull request is being discussed.

Given the UI changes have been reverted, and the number of security fixes (i.e., probably annoying to backport, potentially confusing to some users) in 2.580, we could make 2.580 the baseline, as long as we revert the commons-lang2 removal.Thoughts?

+1.  That makes sense to me.  That gives us:

• Security fixes from 2.580
• War file size reductions from 2.577
• Spring Security upgrade and Spring Framework upgrade from 2.579
• Jetty upgrade from 2.577
• Guava upgrade from 2.579

Mark Waite

[Jesse Glick]

On Wed, Sep 2, 2026 at 4:42 PM 'Daniel Beck' via Jenkins Developers <jenkin...@googlegroups.com> wrote:

as long as we revert the commons-lang2 removal

Is waiting an extra three months realistically going to improve the compatibility situation for this? All commonly used plugins have been updated already, and the rest are probably abandoned.

[Mark Waite]

On Wed, Sep 2, 2026 at 3:40 PM 'Jesse Glick' wrote:

On Wed, Sep 2, 2026 at 4:42 PM 'Daniel Beck' wrote:

as long as we revert the commons-lang2 removal

Is waiting an extra three months realistically going to improve the compatibility situation for this? All commonly used plugins have been updated already, and the rest are probably abandoned.

That's a good point to consider.  Delaying the commons-lang2 removal from the LTS probably won't change the compatibility situation significantly (see the tracking sheet for details).  Current compatibility issues for commons-lang2:

• Gerritt Trigger plugin - last release 3 weeks ago
• Rocket chat notifier plugin - last release 3 weeks ago, 1 open security vulnerability
• Pipeline: AWS steps plugin - last release 2 years ago
• Parameterized remote trigger plugin - last release 1 year ago, 2 open security vulnerabilities, pull request merged but not released
• Ranorex test execution plugin - last release 7 years ago
• VSTest Runner plugin - last release 8 years ago

The two recently released plugins will probably be fixed soon.  The Pipeline: AWS steps plugin has a pending pull request to fix it and another pending pull request to switch from AWS SDK for Java v1 to AWS SDK for Java v2.  It does not have an active maintainer.

Mark Waite

[Daniel Beck]

On Wed, Sep 2, 2026 at 11:41 PM 'Jesse Glick' via Jenkins Developers <jenkin...@googlegroups.com> wrote:

Is waiting an extra three months realistically going to improve the compatibility situation for this? All commonly used plugins have been updated already, and the rest are probably abandoned.

What's your threshold for "commonly used"? Over a dozen plugins that were released within the last year and are installed on >1% of controllers remain incompatible. Almost all PRs were filed within the last few weeks, during summer vacation time.

Besides that, the spreadsheet has problems I'd like to see fixed before even more users depend on it to determine whether they're affected. Some examples:

- The spreadsheet claims that gerrit-trigger is compatible. It's not, acknowledged somewhere in the second half of the "Note" column.

- m2release and maven-artifact-choicelistprovider (both claimed compatible and released within the last month) bundle libraries that use commons-lang 2. Does that have an impact? I guess we'll see.

- The spreadsheet omits the fairly popular (but deprecated) multiple-scms plugin. That was the first plugin we got a complaint about after the weekly release and I couldn't even point the upset user to the giant warning in the changelog.

- The spreadsheet omits blackduck-detect, which bundles a library that uses commons-lang 2. Last released a week ago.

None of these individually are deal breakers. So we could deliver the commons-lang enhancement in LTS three months earlier than we otherwise would. Personally, I'd still like to be able give users and maintainers a fair chance to not be surprised by all of this.

[Jesse Glick]

On Thu, Sep 3, 2026 at 4:21 AM 'Daniel Beck' via Jenkins Developers <jenkin...@googlegroups.com> wrote:

…within the last few weeks, during summer vacation time.

OK, maybe some maintainers were genuinely not around at the time but will use the extra three months to merge PRs. We will find out in January.

[Jesse Glick]

To be clear, 2.580 with Commons Lang 2 removal reverted (which is a fairly small patch) seems fine to me. I did not mean to block anything.

[Albert Puig Mercadé]

+1 for 2.580 with the Commons Lang 2 removal reverted

Reading the thread I don't see an outstanding objection left. What would be the next step to get the baseline confirmed?

Thanks!
Albert

CONFIDENTIALITY NOTICE: This email and any attachments contain confidential and proprietary information of CloudBees intended only for the named recipient(s). Unauthorized use or distribution is prohibited. If you received this in error, please notify the sender and delete this email.

[Mark Waite]

On Fri, Sep 4, 2026 at 12:46 PM 'Albert Puig Mercadé' wrote:

+1 for 2.580 with the Commons Lang 2 removal reverted

Reading the thread I don't see an outstanding objection left. What would be the next step to get the baseline confirmed?

Since Tim noted he is out for a few weeks and we don't need his approval, I think we already have consensus that 2.580 will be the next LTS baseline with a revert of the Apache Commons Lang 2 removal.

When Tim is available again, he can confirm it, but I think we are safe to proceed with 2.580 as the next LTS baseline.

I've switched my test environment to Jenkins 2.580.

Mark Waite

[Tim Jacomb]

2.580 with commons lang reverted for LTS line only has been selected as the next baseline 

--

You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/jenkinsci-dev/CAO49JtG5VxDDFbkS7kKY4sFkei2QO0FAEkoxPPEpJn%2B3%3DQCJ8w%40mail.gmail.com.