Skip to content

suspend commons-lang#880

Merged
daniel-beck merged 1 commit intojenkins-infra:masterfrom
mawinter69:suspend-commons-lang
Aug 1, 2025
Merged

suspend commons-lang#880
daniel-beck merged 1 commit intojenkins-infra:masterfrom
mawinter69:suspend-commons-lang

Conversation

@mawinter69
Copy link
Contributor

@mawinter69 mawinter69 commented Aug 1, 2025

commons-lang is EOL since 2011 and vulnerable (CVE-2025-48924). The library plugin is not used by any other plugin. Due to ongoing activities to remove commons-lang from core and all plugins it will also not be needed via an implied dependency.

commons-lang is EOL since 2011 and vulnerable(CVE-2025-48924). The
library plugin is not used by anyother plugin. Due to ongoing
activities to remove commons-lang from core and all plugins it will
also not be needed via an implied dependency.
@daniel-beck daniel-beck merged commit 5a48813 into jenkins-infra:master Aug 1, 2025
2 checks passed
@daniel-beck
Copy link
Contributor

FYI @nhojpatrick

@daniel-beck daniel-beck added the metadata This PR changes metadata (suspensions, labels, etc.) label Aug 1, 2025
@alecharp
Copy link
Contributor

In order to remove the direct commons-lang dependency from Jenkins core module, we need to:

I started the removal in jenkinsci/jenkins#26105 but it won't be that easy without breaking a few plugins. cc @jtnord

@daniel-beck
Copy link
Contributor

make it a detached plugin in Core

That will not actually accomplish much then, because almost everyone will have it installed for all time.

@jtnord
Copy link
Contributor

jtnord commented Jan 15, 2026

That will not actually accomplish much then, because almost everyone will have it installed for all time.

It allows incremental delivery of the removal from core. (a detached plugin does not need to be bundled IIRC, and it could then be up to the user to manually install it if they have an issue with a plugin that has not migrated).

If you are worried about it existing for all time, then once all known plugins have been migrated the plugin could self destruct (ie uninstall itself, show an admin monitor etc etc)

@mawinter69
Copy link
Contributor Author

Correct if I'm wrong but when you detach functionality from core into a plugin you specify the core version when that happened. And if any plugin is installed that depends on a core version older than that version the detached plugin gets installed. So basically at the beginning everyone gets the plugin installed because every plugin is older.
If you just remove it without declaring it a detached plugin, then this will lead to a bad experience for users because only at runtime you suddenly get ClassNotFound errors, if you're lucky you get them early at startup but worst case only after days. Reality is that many users don't read the release notes before upgrading and only check them if something goes wrong.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

metadata This PR changes metadata (suspensions, labels, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants