JKNS-1169: Bump Jenkins LTS to 2.568.2 and all plugins version to latest by kunalmemane · Pull Request #2396 · openshift/jenkins

kunalmemane · 2026-08-10T19:01:16Z

Bump Jenkins version to 2.568.2 to resolve CVE-2026-53435, CVE-2026-53437, CVE-2026-70428, CVE-2026-1605, CVE-2026-2332
and Plugins to resolve CVE-2024-29371, CVE-2025-14813, CVE-2026-0636, CVE-2026-3505, CVE-2026-5588, CVE-2026-40542, CVE-2026-41409, CVE-2026-41635, CVE-2026-42778, CVE-2026-42779, CVE-2026-47065, CVE-2026-50193, CVE-2026-54399, CVE-2026-54428, CVE-2026-54512, CVE-2026-57280, CVE-2026-57281, CVE-2026-68494

Summary by CodeRabbit

Updates
- Updated the OpenShift Jenkins distribution to version 2.568.2.
- Refreshed bundled plugins and dependencies, including Pipeline, Kubernetes, GitHub, security, SSH, JSON, and Blue Ocean components.
- Added support for additional JSON processing and workflow components.
- Improved compatibility and access to current plugin capabilities through updated versions.

Signed-off-by: Kunal Memane <kmemane@redhat.com>

openshift-ci-robot · 2026-08-10T19:01:21Z

@kunalmemane: This pull request references JKNS-1169 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Bump Jenkins version to 2.568.2 to resolve CVE-2025-14813, CVE-2026-0636, CVE-2026-1605, CVE-2026-2332, CVE-2026-3505, CVE-2026-5588, CVE-2026-41409, CVE-2026-41635, CVE-2026-42778, CVE-2026-42779, CVE-2026-50193, CVE-2026-53435, CVE-2026-53437, CVE-2026-57280, CVE-2026-57281, CVE-2026-70428

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-10T19:01:34Z

Walkthrough

The OpenShift Jenkins configuration now uses Jenkins 2.568.2 and updated base and bundle plugin catalogs. The catalogs include newer plugin versions and additional Jackson, Woodstox, and workflow dependencies.

Changes

OpenShift Jenkins update

Layer / File(s)	Summary
Jenkins version baseline `2/contrib/openshift/jenkins-version.txt`	The configured Jenkins version changed from `2.541.3` to `2.568.2`.
Plugin catalog updates `2/contrib/openshift/base-plugins.txt`, `2/contrib/openshift/bundle-plugins.txt`	The base and bundle catalogs now use updated plugin versions. The catalogs add Jackson, Woodstox, and workflow dependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only plugin catalogs and the Jenkins version; it adds no Ginkgo test declarations or test-title changes.
Test Structure And Quality	✅ Passed	The pull request changes only three OpenShift plugin/version text manifests; no Ginkgo test code, It blocks, cluster operations, or waits are modified.
Microshift Test Compatibility	✅ Passed	The pull request changes only Jenkins/plugin manifest files and adds no Ginkgo e2e tests, so the MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only three OpenShift plugin/version manifest files; no Ginkgo e2e tests or test paths were added, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only two plugin catalog files and one Jenkins version file; no deployment manifests, operator code, controllers, or scheduling constraints were added or modified.
Ote Binary Stdout Contract	✅ Passed	The patch changes only two plugin catalog files and one Jenkins version file; it adds no OTE binary or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch changes only OpenShift plugin manifests and the Jenkins version; it adds no Ginkgo e2e tests or networking code to assess.
No-Weak-Crypto	✅ Passed	The commit changes only plugin/version metadata; exact scans of all 187 added lines found no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, crypto implementation, or secret-comparison code.
Container-Privileges	✅ Passed	The PR changes only plugin catalogs and a Jenkins version; no privilege declarations were added, and OpenShift templates set privileged to false.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only plugin-version catalogs and a Jenkins version file; the diff adds no logging statements or sensitive values such as credentials, tokens, PII, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: Jenkins LTS 2.568.2 and updated plugin versions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

kunalmemane · 2026-08-11T05:55:46Z

/retest

openshift-ci · 2026-08-11T09:05:00Z

@kunalmemane: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`6a58235`	link	false	`/test security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k37y · 2026-08-11T15:45:10Z

/lgtm

k37y · 2026-08-12T08:03:10Z

/lgtm

prdhamdh · 2026-08-12T08:35:49Z

/lgtm
/approve
/label backport-risk-assessed
/label px-approved
/label docs-approved
/label qe-approved

openshift-ci · 2026-08-12T08:36:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: k37y, kunalmemane, prdhamdh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [k37y,prdhamdh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

prdhamdh · 2026-08-12T08:47:28Z

/verified by CI test results

openshift-ci-robot · 2026-08-12T08:47:41Z

@prdhamdh: This PR has been marked as verified by CI test results.

Details

In response to this:

/verified by CI test results

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

mcp-server 0.178 requires workflow-cps >= 4263.vd2edf31c1db_0 and git >= 5.10.1, both newer than what the base Jenkins image provides. Fast-track these to unblock the MCP server plugin. These can be dropped once openshift/jenkins#2396 rolls out with the updated base plugin versions.

Upgrade mcp-server from 0.178 to 0.194 (latest). This requires fast-tracking several base image plugins: - jackson-annotations2-api, woodstox-core-api: new deps of jackson3-api, not present in base image at all - jackson3-api: base has 3.1.0, needs 3.2.1 - script-security: base has 1399, needs 1402 - workflow-step-api: base has 710, needs 724 - workflow-cps: base has 4263, needs 4360 These fast-tracks can be dropped once openshift/jenkins#2396 rolls out with updated base plugin versions. Validated on staging: jenkins-s2i-79 built successfully, Jenkins pod jenkins-56b869477d-klbvr booted with no dependency errors, MCP Server initialized with 19 tools.

Add the Jenkins MCP Server Plugin at version 0.194. This requires fast-tracking several base image plugins whose versions in the current OpenShift Jenkins image are too old: git, jackson-annotations2-api, jackson3-api, script-security, woodstox-core-api, workflow-cps, workflow-step-api These fast-tracks can be dropped once openshift/jenkins#2396 rolls out with the Jenkins LTS 2.568.2 bump. Validated on staging cluster: jenkins-s2i-79 built, Jenkins pod booted with no dependency errors, MCP Server initialized with 19 tools.

Add the Jenkins MCP Server Plugin at version 0.194. Fast-track several base image plugins whose versions in the current OpenShift Jenkins image are too old to satisfy its dependencies: git, jackson-annotations2-api, jackson3-api, script-security, woodstox-core-api, workflow-cps, workflow-step-api These can be dropped once openshift/jenkins#2396 (Jenkins LTS 2.568.2 bump) rolls out to our clusters.

JKNS-1169: Bump Jenkins LTS to 2.568.2 and all plugins version to latest

6a58235

Signed-off-by: Kunal Memane <kmemane@redhat.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 10, 2026

openshift-ci Bot requested review from avinal and jkhelil August 10, 2026 19:01

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 11, 2026

openshift-ci Bot assigned k37y Aug 12, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 12, 2026

openshift-ci Bot assigned prdhamdh Aug 12, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 12, 2026

openshift-merge-bot Bot merged commit b72784a into openshift:master Aug 12, 2026
8 of 9 checks passed

This was referenced Aug 12, 2026

jenkins/plugins: add mcp-server 0.194 and fast-track deps coreos/fedora-coreos-pipeline#1378

Merged

jenkins/plugins: update to latest versions coreos/fedora-coreos-pipeline#1368

Merged

Navigation Menu

Uh oh!

JKNS-1169: Bump Jenkins LTS to 2.568.2 and all plugins version to latest - #2396

JKNS-1169: Bump Jenkins LTS to 2.568.2 and all plugins version to latest#2396
openshift-merge-bot[bot] merged 1 commit into
openshift:masterfrom
kunalmemane:Jenkins-2.568.2-master

kunalmemane commented Aug 10, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented Aug 10, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

kunalmemane commented Aug 11, 2026

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

k37y commented Aug 11, 2026

Uh oh!

k37y commented Aug 12, 2026

Uh oh!

prdhamdh commented Aug 12, 2026

Uh oh!

openshift-ci Bot commented Aug 12, 2026

Uh oh!

prdhamdh commented Aug 12, 2026

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kunalmemane commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Aug 10, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

kunalmemane commented Aug 11, 2026

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

k37y commented Aug 11, 2026

Uh oh!

k37y commented Aug 12, 2026

Uh oh!

prdhamdh commented Aug 12, 2026

Uh oh!

openshift-ci Bot commented Aug 12, 2026

Uh oh!

prdhamdh commented Aug 12, 2026

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kunalmemane commented Aug 10, 2026 •

edited

Loading

openshift-ci-robot commented Aug 10, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading