[JIRA] (JENKINS-57528) Jenkins in Docker does not install detached plugins when there is no UC data

[awiddersh...@hotmail.com (JIRA)]

Title: Message Title

Andrew Widdersheim commented on JENKINS-57528   Re: Jenkins in Docker does not install detached plugins when there is no UC data This feels a little bit untenable if I'm understanding everything correctly, at least for those using the Docker images. Like I'll be playing whack-a-mole either by adding these implied dependencies to my list of installed plugins so they get updated (because of security issues) or by disabling them because they aren't actually used but are pulling in ancient versions with tons of security warnings. It also heavily relies on plugin maintainers to be constantly updating the version of Jenkins their plugin relies on to not be continually pulling in implied deps of old Jenkins core versions. For example, the simple https://plugins.jenkins.io/purge-build-queue-plugin# is referencing a really old Jenkins core version so it's pulling in a ton of implied deps, most of which are really old and some with security vulnerabilities. Whats the best way to handle this other than having that plugin updated to reference a new Jenkins version so less implied deps are pulled in? Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199434.1558102650000.2751.1568374620235%40Atlassian.JIRA.