Best Practices with LTS Updates

[Mark Bidewell]

I am managing the Jenkins Server for my company.  Recently, we moved from 1.609.3 to 1.625.3.  I noticed however that the Required Core Dependencies for Pipe line skipped 1.625.x and went from 1.609.1 to 1.642.1.

What are the best practices for selecting LTS versions to update?  Would an upgrade from say 1.609.3 to 1.642.2 be safe?

Thanks.

[Christopher Orr]

You're already on LTS, so there aren't many more "best practices", other
than update regularly :)

But there should generally be no problem with upgrading between releases
that are relatively close like those two are.

Regards,
Chris

[Brian Ray]

+1 to what Chris said.

Two more cents worth of advice: When I upgrade one of our Jenkins masters (on LTS) I first look at the changelogs to have some idea of the delta-- potential gotchas, new features to evangelize, etc. Aside from critical security releases I typically wait a day or two after the LTS release is available in the unlikely event that the LTS release is not S(table). That's never been the case, but my bias is very conservative for this particular Jenkins master.

[Ashish Yadav]

I too am running jenkins v1.609.3. 

However, I am concerned about upgrading to v1.642.2 due to the following which was ‘introduced’ in v1.625.3.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09

How can I tell if this will impact me? How can I tell if this will be an issue if I upgrade to v1.625.3? 

I am using the following plugins:

1. Maven Integration Plugin v2.7.1
2. Javadoc Plugin v1.1
3. HTML Publisher Plugin v1.3

Is there a way to upgrade to a specific version? If I do ‘yum upgrade jenkins’, I can only upgrade to v1.625.3

--
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/b62523a0-5e08-477d-baac-9999498a3722%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Indra Gunawan (ingunawa)]

Then don’t do yum, install the Jenkins as war on Tomcat, Jetty or the embedded Jetty that comes with Jenkins.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/D3104FD1.1DFE1%25ashish.yadav%40firemon.com.

[Ashish Yadav]

Would this work?

 "yum localinstall http://pkg.jenkins-ci.org/redhat-stable/jenkins-1.625.2-1.1.noarch.rpm"

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/D31038A6.4BD60%25ingunawa%40cisco.com.

[Daniel Beck]

On 17.03.2016, at 18:21, Ashish Yadav <ashish...@firemon.com> wrote:

> I too am running jenkins v1.609.3.
>
> However, I am concerned about upgrading to v1.642.2 due to the following which was ‘introduced’ in v1.625.3.
> https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
>
> How can I tell if this will impact me? How can I tell if this will be an issue if I upgrade to v1.625.3?
>
> I am using the following plugins:
> • Maven Integration Plugin v2.7.1
> • Javadoc Plugin v1.1
> • HTML Publisher Plugin v1.3

This concern doesn't really make sense to me. You're running a version that is known vulnerable to a specific issue that may or may not be relevant to you (as documented on the wiki).

If you upgrade, some of these reports may no longer display correctly in a web browser, but the worst case is, you decide it's preferable to restore the functionality at the cost of being vulnerable again.

So other than having to fiddle with the option documented on the wiki for a bit, I'm not seeing how this blocks upgrading.

[Daniel Beck]

On 17.03.2016, at 17:01, Brian Ray <be_...@sbcglobal.net> wrote:

> Two more cents worth of advice: When I upgrade one of our Jenkins masters (on LTS) I first look at the changelogs to have some idea of the delta-- potential gotchas, new features to evangelize, etc.

1.642.1 was the first release for which we had an actual LTS changelog with the delta from the previous .3, rather than what was fixed compared to the baseline (in this case, nothing). This should make determining what changed between major LTS releases much easier.