Jenkins - Year in Review and Future Roadmap

### Overview Presented at CDCon, this talk provides a comprehensive review of recent developments across the Jenkins ecosystem and outlines upcoming roadmap milestones. The speaker addresses major user interface modernizations, security enhancements, dependency upgrades, contributor workflow management, and the organizational backing that sustains the open-source project.

### Key Topics - **User Experience & Interface Modernization**: Updates across multiple UI surfaces including pipeline visualization, administration, jobs/builds, and the main dashboard. - **Security Initiatives**: The introduction of an EU-funded bug bounty program and user-configurable Content Security Policy (CSP) protections. - **Contributor Influx & Review Automation**: Managing increased pull request volumes from Google Summer of Code (GSoC) contributors using automated quality gates and AI code reviews. - **Ecosystem & Dependency Modernization**: Upgrades to Java LTS versions, Spring Framework, and Jakarta EE. - **Sponsorship & Community Support**: The role of corporate sponsors and the Continuous Delivery Foundation (CDF) in supporting Jenkins infrastructure and governance.

### Technical Details - **Pipeline Graph View & Blue Ocean Deprecation**: The Pipeline Graph View is established as an actively maintained, high-performance visualization tool and serves as the official replacement for Blue Ocean, which is deprecated starting July 2026. - **UI Redesigns**: The Manage Jenkins UI has been available as an opt-in preview via the user experiments page since January 2026, targeted to become the default around September. Similar clutter-reduction redesigns are available in preview for jobs and builds. The top-level dashboard redesign will evolve through 2026, with default rollout anticipated for 2027. - **Security & Bug Bounty**: Funded by the European Commission, a bug bounty program administered via YesWeHack pays up to €5,000 for qualifying vulnerability submissions; issues from this program were incorporated into the first three Jenkins security advisories of 2026. Additionally, optional Content Security Policy (CSP) enforcement is available to mitigate cross-site scripting (XSS) across top plugins, with default enablement expected around 2027. - **Contributor Quality Controls**: GSoC participation (with five slots: two AI, two tool modernization, one website) contributed to core PR backlogs growing from an average of 90 to 150. To reduce maintainer fatigue, submissions omitting the PR template are automatically closed, GitHub Copilot performs initial review to catch flagrant mistakes, and new contributors are capped at two concurrent open PRs until work is merged. - **Runtime & Framework Upgrades**: Jenkins maintains support for the current LTS and one prior release. Java 17 has been dropped, leaving Java 21 and 25 supported (with Java 21 yielding up to 10% runtime memory savings over 17). Jenkins upgraded from Spring 5 to Spring 6 in 2024 and targets Spring 7 in 2026, while moving to Jakarta EE 10 after transitioning to Jakarta EE 9 two years prior.

### Takeaways Jenkins is systematically modernizing both its front-end interfaces and core runtime stack while preserving backwards compatibility for legacy plugins. Users are encouraged to switch from Blue Ocean to Pipeline Graph View, test preview UI features on their experiment pages, evaluate CSP enablement, and upgrade to supported Java LTS versions. Sustainable operation remains dependent on corporate backing (such as CloudBees, AWS, Microsoft, JFrog, and Atlassian) and participation in the Continuous Delivery Foundation.