Conversation
commons-lang is EOL since 2011 and vulnerable(CVE-2025-48924). The library plugin is not used by anyother plugin. Due to ongoing activities to remove commons-lang from core and all plugins it will also not be needed via an implied dependency.
|
FYI @nhojpatrick |
|
In order to remove the direct
I started the removal in jenkinsci/jenkins#26105 but it won't be that easy without breaking a few plugins. cc @jtnord |
That will not actually accomplish much then, because almost everyone will have it installed for all time. |
It allows incremental delivery of the removal from core. (a detached plugin does not need to be bundled IIRC, and it could then be up to the user to manually install it if they have an issue with a plugin that has not migrated). If you are worried about it existing for all time, then once all known plugins have been migrated the plugin could self destruct (ie uninstall itself, show an admin monitor etc etc) |
|
Correct if I'm wrong but when you detach functionality from core into a plugin you specify the core version when that happened. And if any plugin is installed that depends on a core version older than that version the detached plugin gets installed. So basically at the beginning everyone gets the plugin installed because every plugin is older. |
commons-lang is EOL since 2011 and vulnerable (CVE-2025-48924). The library plugin is not used by any other plugin. Due to ongoing activities to remove commons-lang from core and all plugins it will also not be needed via an implied dependency.