jenkinsci / jenkinsci/plugin-installation-manager-tool
Ensure valid plugin version used when `--latest=false`
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 463
- Forks
- 228
- Avg merge
- 31m
- Merged PRs (30d)
- 15
Description
What feature do you want to see added?
As of this moment there is bad/incorrect data (details below) in the update center causing the installation of a specific plugin to fail. It claims a dependency on a plugin version that does not exist, but there is a version that satisfies the bounds. It would be nice if the tool was able to handle this case. Alternatively, outputting a message warning that the resolved version isn't valid would be helpful.
I have not looked at the code yet, but I'm assuming this isn't a bug in the tool (and that it wasn't intended to treat versions like full range specifications).
UC data for problematic plugin
The plugin I'm installing is git-forensics:3.2138.vf25ea_d549e33 (latest released version):
$ jq '.plugins."git-forensics"."3.2138.vf25ea_d549e33"' plugin-versions.json
{
"buildDate": "Sep 25, 2025",
"dependencies": [
{
"name": "commons-lang3-api",
"optional": false,
"version": "3.18.0-98.v3a_674c06072d"
},
{
"name": "commons-text-api",
"optional": false,
"version": "1.14.0-194.v804a_dc3a_1b_d8"
},
{
"name": "font-awesome-api",
"optional": false,
"version": "7.0.1-859.v128d3a_efb_6e5"
},
{
"name": "forensics-api",
"optional": false,
"version": "3.1754.v2a_6613b_77002"
},
{
"name": "plugin-util-api",
"optional": false,
"version": "6.1183.vdfd884091c0e"
},
{
"name": "branch-api",
"optional": false,
"version": "2.1244.vf95c81f1641c"
},
{
"name": "git",
"optional": false,
"version": "5.7.0"
}
],
"name": "git-forensics",
"releaseTimestamp": "2025-09-25T19:18:00.00Z",
"requiredCore": "2.516.3",
"sha1": "Io9YiAtFBN3i3GvmhPASGs8BNtQ=",
"sha256": "M6q+NYlVfQMZfYvd1fiQAnHn9pqlrtfegUn2S3zRN/M=",
"url": "https://updates.jenkins.io/download/plugins/git-forensics/3.2138.vf25ea_d549e33/git-forensics.hpi",
"version": "3.2138.vf25ea_d549e33"
}
Note it's calling for plugin-util-api:6.1183.vdfd884091c0e, which does not exist:
$ jq '.plugins."plugin-util-api"|keys' plugin-versions.json
[
<snip>
"6.0.0",
"6.1.0",
"6.1154.ved7e7d3035a_5",
"6.1157.vc75ef7129d86",
"6.1165.v322e76215b_a_4",
"6.1167.v022176c7e0ca_",
"6.1192.v30fe6e2837ff"
]
Thus, jenkins-plugin-cli -p git-forensics:3.2138.vf25ea_d549e33 --latest=false fails because the transitive plugin doesn't exist at that version, but jenkins-plugin-cli -p git-forensics:3.2138.vf25ea_d549e33 --latest=true does work, since there is a valid/newer version. My desired/expected behavior would be that plugin-util-api:6.1192.v30fe6e2837ff is installed since it is the next valid version. (The fact that it happens to be the latest version as well is coincidence.)
Upstream changes
No response
Are you interested in contributing this feature?
Possibly, if it was straightforward.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the --latest=false dependency-resolution path and how plugin-versions.json entries are matched to requested versions. Reproduce the git-forensics installation with plugin-util-api:6.1183.vdfd884091c0e, then verify that an invalid exact dependency selects the next valid satisfying version or produces a clear warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100