CloudBees CI on traditional platforms 2.568.3.37913

Rolling release: 2026-09-16

Based on Jenkins LTS 2.568.3

Security advisories

CloudBees Security Advisory 2026-09-16

Upgrade Notes

item.getInstance() compatibility preserved for sandboxed scripts

This fix addresses an upstream change in the Script Security plugin (script-security) that would have broken item.getInstance() and item.instance access in sandboxed scripts. item.getInstance() and item.instance continue to work as expected in templates and Pipelines.

Jenkins 2.568.x upgrade notes

New Features

None.

Feature Enhancements

None.

Resolved Issues

None.

Known Issues

CloudBees Platform Insights plugin will be removed from CloudBees Assurance Program

Starting with the late September 2026 release, the CloudBees Platform Insights plugin (cloudbees-platform-insights) will be removed from CloudBees Assurance Program. The CI insights capabilities are now merged into Continuous integration, and this integration type is no longer available in CloudBees Unify. If you have not already migrated from CI insights to Continuous integration (as announced in the May 2026 release notes), you must do so before upgrading. For migration instructions, refer to Migrate from CI insights to Continuous integration.

git-lfs removed from the default Linux agent image

Starting with the October 2026 CloudBees CI release, the default CloudBees CI Linux agent image will no longer include git-lfs. This change addresses frequent false-positive vulnerability scan findings caused by git-lfs in the default image.

Who is affected:

  • Linux agent users whose pipelines depend on git-lfs (for example, to pull or push Git LFS-tracked assets).

  • Windows agent images are not affected.

How to prepare:

  • No action is required if your pipelines do not use git-lfs.

  • Identify whether any of your pipelines depend on git-lfs.

  • If you need git-lfs, you will need to opt into an alternative image when this change is released. Instructions will be provided in the release documentation.

Java 25 becomes the default runtime for CloudBees CI Docker images

Starting with the October 2026 release, all CloudBees CI Docker images without a suffix will use Java 25 as the default runtime (equivalent to using the -jdk25 suffix). A Java 21 fallback image will remain available if you are not yet ready to migrate (equivalent to using the -jdk21 suffix). No action is required before the October 2026 release, but you should review your Java version requirements ahead of the upgrade. An administrative monitor has been added to notify you of this upcoming change.

Script Security plugin sandbox change causes Pipeline scripts to fail on null string concatenation

Starting with CloudBees CI 2.568.3.37913, the Script Security plugin (script-security) sandbox intercepts operations performed on a null receiver as part of the SECURITY-3931 fix. This causes sandboxed Pipeline scripts that concatenate a string onto a null value to fail with the following error:

org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method org.codehaus.groovy.runtime.NullObject plus java.lang.String
▼

For example:

def foo = null
foo += "bar"
▼
Prior to CloudBees CI 2.568.3.37913, the same script ran without error and returned nullbar (Groovy silently coerced the null value to the string "null" before concatenating).

Two workarounds are available:

  • Approve the resulting prompt in Manage Jenkins  In-process Script Approval.

  • Update the affected Pipeline script to initialize the variable to an empty string instead of null before appending to it:

    def foo = ""
foo += "bar"
    ▼

The same change affects other explicit method calls on a null value, which are less likely to be encountered. These include:

Operation Rejected signature

foo.asBoolean()

method org.codehaus.groovy.runtime.NullObject asBoolean

foo.asType(String)

method org.codehaus.groovy.runtime.NullObject asType java.lang.Class

foo.is(null)

method org.codehaus.groovy.runtime.NullObject is java.lang.Object

foo.iterator()

method org.codehaus.groovy.runtime.NullObject iterator

This issue is resolved in Script Security plugin 1429.v0810f1b_530f5.

Duplicate plugins in the Operations center Plugin Manager UI

When you search for a specific plugin under the Available tab in the Operations center Plugin Manager, the search results show duplicate entries for the plugin.