Skip to content

Jenkins MCP Server v2.10.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 19:57
v2.10.2
7e2f9b3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Released 2026-08-14.

Highlights

  • Queue reads and cancellation no longer authorize an ambiguous leaf-only task
    name as though it were a complete Jenkins job path.

New Features

  • None.

Improvements

  • None.

Bug Fixes

  • Queue authorization fell back to task.name when Jenkins omitted both
    task.fullName and a usable task URL. Because name contains only the leaf,
    a nested job such as Production/nightly could be mistaken for the allowed
    top-level job nightly. Ambiguous items now fail closed.

Breaking Changes

  • None.

Known Issues

  • None.

Security

  • Queue listing, item reads, and cancellation now require a folder-qualified
    identity from task.fullName or the repeated /job/<segment> URL path.
    task.name alone is never sufficient for an allowlist decision.
  • Jenkins task URLs remain path-only identity metadata and are never fetched.
    Their advertised public origin may legitimately differ from the internal
    Service URL configured by this server.

Upgrade Notes

  • No action required.
Assets 6
Loading