Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update jenkins plugin dependencies #80

Merged
merged 2 commits into from
Oct 29, 2024
Merged

chore(deps): update jenkins plugin dependencies #80

merged 2 commits into from
Oct 29, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 18, 2024 •
edited
Loading

This PR contains the following updates:

Package Update Change
jenkinsci/cloudbees-disk-usage-simple-plugin major 203.v3f46a_7462b_1a_ -> 205.v47f4ee8803d1
jenkinsci/configuration-as-code-plugin major 1850.va_a_8c31d3158b_ -> 1873.vea_5814ca_9c93
jenkinsci/kubernetes-plugin major 4287.v73451380b_576 -> 4295.v7fa_01b_309c95
jenkinsci/oic-auth-plugin minor 4.340.ve70636c6590e -> 4.418.vccc7061f5b_6d
jenkinsci/prometheus-plugin major 784.vea_eca_f6592eb_ -> 787.v52e8f47488fc
jenkinsci/saml-plugin minor 4.487.v9f1c3328f1c0 -> 4.501.v4313a_01e3a_18

Release Notes

jenkinsci/cloudbees-disk-usage-simple-plugin (jenkinsci/cloudbees-disk-usage-simple-plugin)

v205.v47f4ee8803d1

Compare Source

🚀 New features and improvements

jenkinsci/configuration-as-code-plugin (jenkinsci/configuration-as-code-plugin)

v1873.vea_5814ca_9c93

Compare Source

👷 Changes for plugin developers

📝 Documentation updates

📦 Dependency updates

20 changes
jenkinsci/kubernetes-plugin (jenkinsci/kubernetes-plugin)

v4295.v7fa_01b_309c95

Compare Source

🚀 New features and improvements

  • Copy the whole /usr/share/jenkins path recursively to account for extra files (#​1614) @​Vlatombe

🐛 Bug fixes

  • Use configured registry for jenkins-agent when running in agent-injection mode (#​1613) @​iandrewt

📝 Documentation updates

v4292.v11898cf8fa_66

Compare Source

🚀 New features and improvements

📦 Dependency updates

v4290.v93ea_4b_b_26a_61

Compare Source

🚀 New features and improvements

📝 Documentation updates

v4288.v1719f9d0c854

Compare Source

🐛 Bug fixes

jenkinsci/oic-auth-plugin (jenkinsci/oic-auth-plugin)

v4.418.vccc7061f5b_6d

Compare Source

🚀 New features and improvements

🐛 Bug fixes

📝 Documentation updates

v4.411.v990b_9d36e74e

Compare Source

🐛 Bug fixes

v4.409.ve864b_f48b_0f3

Compare Source

🚀 New features and improvements

🐛 Bug fixes

👻 Maintenance

🚦 Tests

✍ Other changes

v4.388.v4f73328eb_d2c

Compare Source

💥 Breaking changes

[!CAUTION]
The plugin now requires that the Issuer is set to enforce security and there is no option to disable this requirement as it is mandated in the Open ID Connect specification.
As such users who do not use automatic configuration via the well-known endpoint must first update to 4.355.v3a_fb_fca_b_96d4 and configure the Issuer before updating to this version.
Failure to do so will result in users unable to login, or Jenkins failing to start.

[!CAUTION]
if using manual configuration and a JWKS Server URL has not been specified then either disable token validation will need to be enabled or the JWKS Server URL will need to be set before upgrading to this version.
Failure to do so will result in users unable to login.

[!WARNING]
The option to send the scopes when requesting the access token has been removed (although is still present in the UI). Users of non conformant OPs that require this functionality should remain on the previous version until the Open ID Connect Originating Party (often referred to as the iDP) fixes their implementation.

📝 Documentation updates

v4.371.vc7c0c06e8a_f5

Compare Source

🐛 Bug fixes

📝 Documentation updates

v4.355.v3a_fb_fca_b_96d4

Compare Source

🔒 Security fixes

  • Fix SECURITY-3441 (1, 2).

[!IMPORTANT]
When using the "Manual entry" configuration mode, the new "Issuer" field must be populated after updating to protect from this issue. When using "Discovery via well-known endpoint", the Issuer will be set automatically.

v4.354.v321ce67a_1de8

Compare Source

🐛 Bug fixes

👻 Maintenance

v4.350.v347c3b_8b_9d95

Compare Source

💥 Breaking changes

[!IMPORTANT]
The configuration format is backwards compatible with previous versions, but the casc format is not.

configuration of the provider side has been moved into a serverConfiguration section and split to 2 different types wellKnown for configuration via a auto discovery and manual for manual configuration.
e.g.
for manual configuration:

securityRealm:
   oic:
    serverConfiguration:
       manual:
         authorizationServerUrl: https://url.example.com/authorize
         jwksServerUrl: https://jwks.example.com/jwks
         tokenAuthMethod: client_secret_post
         tokenServerUrl: https://token.example.com/token
         scopes: scopes

and for auto configuration:


 securityRealm:
   oic:
     serverConfiguration:
       wellKnown:
         wellKnownOpenIDConfigurationUrl: https://idp.example.com:/someRealm/.well-known/openid-configuration

[!CAUTION]
it has been reported #​412 that very old configuration may not be migrated correctly.
it is therefore recommended to explicitly save the configuration in ${JENKINS_URL}/manage/configureSecurity/ before upgrading if the configuration has not been changed recently and you are not using Config-as-Code to manage the settings

✍ Other changes

v4.346.v10401f543622

Compare Source

🐛 Bug fixes

jenkinsci/prometheus-plugin (jenkinsci/prometheus-plugin)

v787.v52e8f47488fc

Compare Source

✍ Other changes

📦 Dependency updates

jenkinsci/saml-plugin (jenkinsci/saml-plugin)

v4.501.v4313a_01e3a_18

Compare Source

🐛 Bug fixes

📦 Dependency updates

  • chore(deps-dev): bump org.testcontainers:testcontainers from 1.20.2 to 1.20.3 (#​450) @​dependabot
  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3482.vc10d4f6da_28a_ to 3559.vb_5b_81183b_d23 (#​451) @​dependabot
  • chore(deps): bump org.jenkins-ci.plugins:plugin from 5.1 to 5.2 (#​448) @​dependabot
  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3435.v238d66a_043fb_ to 3482.vc10d4f6da_28a_ (#​447) @​dependabot

v4.496.v56a_6423dca_35

Compare Source

🚀 New features and improvements

  • Upgrade to pac4j 6.x, require Java 17 or newer, and migrate to EE 9 (#​446) @​basil

📝 Documentation updates

📦 Dependency updates

  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3413.v0d896b_76a_30d to 3435.v238d66a_043fb_ (#​443) @​dependabot
  • chore(deps-dev): bump org.testcontainers:testcontainers from 1.20.1 to 1.20.2 (#​442) @​dependabot
  • Upgrade plugin parent POM to latest (#​445) @​basil
  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3387.v0f2773fa_3200 to 3413.v0d896b_76a_30d (#​441) @​dependabot
  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3358.vea_fa_1f41504d to 3387.v0f2773fa_3200 (#​439) @​dependabot
  • chore(deps): bump org.jenkins-ci.plugins:plugin from 4.87 to 4.88 (#​440) @​dependabot
  • chore(deps): bump io.jenkins.tools.bom:bom-2.462.x from 3334.v18e2a_2f48356 to 3358.vea_fa_1f41504d (#​438) @​dependabot

Configuration

📅 Schedule: Branch creation - "after 7am and before 9am every weekday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the plugin-deps label Sep 18, 2024
@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch from db72714 to c4b45dd Compare September 18, 2024 21:17
@renovate renovate bot changed the title chore(deps): update plugin-deps to v4288 chore(deps): update jenkins plugin dependencies Sep 18, 2024
@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch 4 times, most recently from a267698 to 924717e Compare September 23, 2024 12:57
@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch 4 times, most recently from 3c57d76 to 85d4b8d Compare October 9, 2024 14:22
@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch 6 times, most recently from 5e87662 to c932d7f Compare October 17, 2024 11:14
@bburky
Copy link
Member

bburky commented Oct 18, 2024

The oic-auth plugin is affected by two high severity vulnerabilities: CVE-2024-47806 and CVE-2024-47807
https://www.jenkins.io/security/advisory/2024-10-02/

Update to 4.355.v3a_fb_fca_b_96d4 or later to resolve (Renovate is suggesting 4.411.v990b_9d36e74e which is good)

@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch 2 times, most recently from 47a5170 to 7a240cb Compare October 27, 2024 16:08
@renovate
chore(deps): update jenkins plugin dependencies
d687349 
| datasource  | package                                      | from                  | to                    |
| ----------- | -------------------------------------------- | --------------------- | --------------------- |
| github-tags | jenkinsci/cloudbees-disk-usage-simple-plugin | 203.v3f46a_7462b_1a_  | 205.v47f4ee8803d1     |
| github-tags | jenkinsci/configuration-as-code-plugin       | 1850.va_a_8c31d3158b_ | 1873.vea_5814ca_9c93  |
| github-tags | jenkinsci/kubernetes-plugin                  | 4287.v73451380b_576   | 4295.v7fa_01b_309c95  |
| github-tags | jenkinsci/oic-auth-plugin                    | 4.340.ve70636c6590e   | 4.418.vccc7061f5b_6d  |
| github-tags | jenkinsci/prometheus-plugin                  | 784.vea_eca_f6592eb_  | 787.v52e8f47488fc     |
| github-tags | jenkinsci/saml-plugin                        | 4.487.v9f1c3328f1c0   | 4.501.v4313a_01e3a_18 |
@renovate renovate bot force-pushed the renovate/jenkins-plugin-dependencies branch from 7a240cb to d687349 Compare October 28, 2024 19:37
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Oct 29, 2024

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@kbfogle kbfogle merged commit 2bf69a8 into main Oct 29, 2024
13 checks passed
@kbfogle kbfogle deleted the renovate/jenkins-plugin-dependencies branch October 29, 2024 21:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kbfogle kbfogle kbfogle approved these changes

Assignees
No one assigned
Labels
plugin-deps
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@bburky @kbfogle