Core Jenkins Dependencies Listed in pom.xml: Complete Technical Guide

The pom.xml in the jenkinsci/jenkins repository declares core dependencies including jenkins-core, remoting, Apache Commons utilities (Lang3, Collections4, IO), Google Guava, the Stapler web framework, and Pipeline APIs (workflow-api, workflow-step-api), with all versions centrally managed via the Jenkins BOM.

Jenkins is an open-source automation server built with Maven, and its foundational libraries are defined in the top-level pom.xml located at the repository root. These core Jenkins dependencies provide the runtime essentials, from the web UI framework to the agent communication protocol that enables distributed builds across the architecture.

Where Core Dependencies Are Declared

Dependency management in Jenkins follows a hierarchical Maven structure, with version control centralized to ensure consistency across modules.

Top-Level Project Object Model

The primary pom.xml file at the repository root defines the <dependencies> section that lists libraries required for the Jenkins core runtime. This file imports the Bill of Materials (BOM) to manage versions centrally.

According to the Jenkins source code, the BOM is imported in the <dependencyManagement> section:

• BOM import: pom.xml – Dependency Management

The Bill of Materials (BOM)

The bom/pom.xml file acts as the single source of truth for dependency versions. Rather than declaring versions in individual modules, the top-level POM imports this BOM, which specifies compatible versions for all core libraries and plugins.

Key Categories of Core Dependencies

The dependencies declared in the top-level pom.xml and managed by the BOM fall into several functional categories essential for Jenkins operation.

Jenkins Core Modules

These modules constitute the server itself:

• org.jenkins-ci.main:jenkins-core — Contains the bulk of Jenkins' server implementation, including the job model, security layer, and UI rendering.
• org.jenkins-ci.remoting:remoting — Handles the agent-to-master communication protocol for distributed builds.
• org.jenkins-ci.main:jenkins-war — Packages Jenkins as an executable WAR file for deployment.

Apache Commons Utilities

Jenkins relies heavily on Apache Commons for cross-cutting utilities:

• org.apache.commons:commons-lang3 — Provides StringUtils, ObjectUtils, and other fundamental utilities.
• org.apache.commons:commons-collections4 — Supplies extended collection data structures and algorithms.
• org.apache.commons:commons-io — Handles file I/O operations, stream copying, and utility methods.
• org.apache.commons:commons-text — Offers text manipulation utilities including HTML and CSV escaping.

Web Framework and UI

The Jenkins user interface depends on specific frameworks:

• org.kohsuke:stapler — The web framework that binds URL routing to Java methods and renders Jelly views.
• org.codehaus.groovy:groovy-all — Provides Groovy scripting support for pipeline definitions and extensions.
• org.jvnet.localizer:localizer — Enables internationalization (i18n) of UI strings across the application.

Pipeline and Security

Pipeline functionality and script security are provided by:

• org.jenkins-ci.main:workflow-api — Core API for Pipeline orchestration and execution.
• org.jenkins-ci.main:workflow-step-api — Defines the extension point for creating pipeline steps.
• org.jenkins-ci.main:script-security — Sandboxes Groovy scripts to prevent malicious code execution.
• com.google.guava:guava — Supplies caching, immutable collections, and concurrency utilities used by the security layer.

Plugin Infrastructure

Core dependencies also include libraries for plugin functionality:

• org.jenkins-ci.plugins:matrix-project — Enables matrix-based job configurations.
• org.jenkins-ci.plugins:mailer — Provides email notification capabilities.
• org.jenkins-ci.plugins:metrics — Supplies instrumentation for runtime monitoring.
• org.jenkins-ci.plugins:git and org.eclipse.jgit:org.eclipse.jgit — Support Git source code management operations.

Testing and Development

The test scope dependencies ensure code quality:

• org.jenkins-ci.main:jenkins-test-harness — Utilities for unit and integration testing of Jenkins core.
• org.junit.jupiter:junit-jupiter-api — JUnit 5 testing framework.
• org.mockito:mockito-core — Mocking library for isolated test cases.
• org.hamcrest:hamcrest-all — Matcher library for assertions.

Inspecting Dependency Declarations

You can view the complete list of dependencies in the top-level POM. The concrete declarations appear under the <dependencies> tag:

• Core dependencies: pom.xml – Dependencies

Additional module-specific dependencies are defined in:

• core/pom.xml — Dependencies specific to the Jenkins core module.
• war/pom.xml — Dependencies for WAR packaging and the executable artifact.

Practical Usage Examples

The following Java examples demonstrate how these dependencies are utilized within the Jenkins codebase.

Accessing security permissions using jenkins-core:

import hudson.security.Permission;
import hudson.model.User;

public class PermissionChecker {
    public boolean hasReadPermission(User user) {
        // Uses jenkins-core security libraries
        return user.hasPermission(Permission.READ);
    }
}

Utilizing Google Guava for validation:

import com.google.common.base.Preconditions;

public class JobValidator {
    public void validateJobName(String name) {
        // Uses Guava from the core classpath
        Preconditions.checkArgument(
            name != null && !name.isEmpty(),
            "Job name must not be empty"
        );
    }
}

Summary

• Core Modules: The jenkins-core and remoting dependencies provide the server runtime and agent communication.
• Utility Libraries: Apache Commons (Lang3, Collections4, IO, Text) and Google Guava supply essential programming utilities.
• Web Stack: The Stapler framework and Groovy runtime support the Jenkins web UI and pipeline scripting.
• Version Management: All versions are controlled centrally via the BOM (bom/pom.xml) imported in the top-level pom.xml.
• Testing: The jenkins-test-harness, JUnit 5, and Mockito enable comprehensive test coverage.

Frequently Asked Questions

What is the Jenkins BOM and why does it manage dependency versions?

The Bill of Materials (BOM) is a special POM (bom/pom.xml) that defines versions for all core dependencies and plugins. It ensures that every Jenkins module uses compatible library versions, preventing classpath conflicts and simplifying maintenance. The top-level pom.xml imports this BOM in its <dependencyManagement> section, allowing sub-modules to declare dependencies without specifying versions.

How do I check the exact version of a specific Jenkins dependency?

Inspect the bom/pom.xml file in the repository root. This file contains the <dependencyManagement> section where versions are explicitly declared. For example, to find the Guava version, search for com.google.guava:guava within bom/pom.xml. Alternatively, check the effective POM by running mvn help:effective-pom from the project root.

Are Jenkins plugin dependencies declared in the same pom.xml as core dependencies?

No, individual plugin dependencies are declared in their respective plugin directories under plugins/. However, the top-level pom.xml and BOM define the core framework dependencies that plugins inherit, such as workflow-api and script-security. Plugin-specific dependencies are managed in the plugin's own pom.xml file, which inherits from the Jenkins parent POM.

What is the difference between jenkins-core and jenkins-war dependencies?

jenkins-core is the module containing the actual Jenkins application code, including the model for jobs, builds, and the security realm. jenkins-war is the packaging module that assembles jenkins-core and its dependencies into a deployable WAR file suitable for application servers like Tomcat or Jetty. When running Jenkins standalone, you execute the WAR artifact, which embeds the core module.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}