Best community,
Does anyone know what’s going on with the pipeline-aws-plugin? It hasn’t seen commits in 1,5 year. What’s going on there?
Is no one willing to maintain this or has it been overlooked?
This is my opinion based on what I see and not based on empirical data.
I think it is rare for a company to actually sponsor maintaining open source software in which they rely. The same could be said about Jenkins plugins. Usually someone will maintain a plugin in their spare time because it benefits their professional life (e.g. achieving some corporate goal or making things more stable for them and their use case). When an employee moves on to another company it’s rare for them to rely on the same plugin set and so their continued maintenance has a personal cost that no longer provides the same value.
So long-time maintainers will switch around what plugins they maintain or contribute to based on their professional needs. This is normal for those who care and feed on the software they rely for their day job and it is above and beyond what they’re paid to do. However, it is not all altruistic because it is expensive to maintain an internal fork. So it is the cheaper option for those who are pushing the limits of what Jenkins can do. There’s also a larger slice of users who don’t do this and they just move on. e.g. moving on to using the plugin dealing with its pitfalls, avoiding the plugin for an alternative that still has pitfalls but fits their needs well enough, or by using something other than Jenkins (with the same caveats that they deal with pitfalls rather than contribute; "that’s what support contracts are for, " is the typical mindset for that kind of capability owner).
Jenkins has plugin adoption documentation so if this plugin is something in which you want to rely and a plugin’s activity is stale, then I recommend checking that out.
Jenkins community also has automation initiatives where dependencies stay up to date but generally plugins with the most installs get included first (based on active users of the plugin who report stats).
Side note: I have maintained very simple plugins (that I use today) which are simple and secure because they are simple despite having no recent release. Low maintenance plugins are not always a red flag to avoid. You need to review it on a per plugin basis through the lense of what you need from it. “Hasn’t released in a while” isn’t a reliable security metric on its own which is something security companies try to evangelize to justify a company continuing to pay them a nontrivial sum. Every plugin you use should go through some internal review for your needs.
I love the comments from @samrocketman and agree with them wholeheartedly. Adopt the plugin if you are critically dependent on its functionality in your work.
The Pipeline: AWS Steps plugin plugin has some additional details.
The AWS SDK for Java v1 has been obsolete and unsupported since Dec 31, 2025. There is an open pull request that proposes to switch to AWS Java SDK for Java v2. Because of the many, many functions provided by that plugin and the many, many ways that those functions might be used, that pull request needs significant testing. Since you’re a plugin user, you’re one of the best candidates to test the incremental builds.
Test that incremental build and report any issues in the pull request.
Thank you for your elaborate reply, and I see what you see. I’m just surprised as it seems that the plugin’s offered features and as such usage is widespread. Mark’s reply does give some insight into what’s blocking updates at the moment.
As for the ‘hasn’t released in a while’ isn’t a reliable security metric argument. I’d have to disagree for the most part. Unless you’re looking at an extremely small or simple codebase, software needs regular updates/maintenance. Bugs and security issues are found and fixed on a regular basis in core components and trickle down the chain. If these aren’t picked up downstream you are facing security issues sooner or later.