The CD Foundation currently has 6 open source projects: CDEvents, Jenkins, Jenkins X, Ortelius, Screwdriver, and Spinnaker.

Our projects solve some of the biggest issues in the Continuous Delivery and Continuous Integration space. We always want to expand our project communities with additional contributors, end users, and passionate technologists. Please check out each project to see what you can do to get involved!

Here are the mid-year highlights for each project Features and Releases.

CDEvents

Features and releases

The project also started modelling the concepts used in links as schemas, so that SDKs and users can share and validate them:

• Links can now reference a domain-level identifier (domainId), a CDEvent context ID, or both. This change also introduced a governed registry of providers.
• Spinnaker is being added to the provider registry.
• A registry of resource types for the type segment of domainId.

Other changes merged in the spec for v0.6:

• A new queued predicate for taskRun, contributed by a new contributor.
• A consistency fix for the taskRun.finished event.

New proposals under discussion include changes to the deployment events, subjects and events for scheduled executions, change windows, data migrations and reconciliation, an optional canonical hash for event integrity, and event types for feature flags and SCM branch pushes. The project communnity is aiming for a v0.6 release after these proposals are reviewed.

Releases:

• Spec v0.5.1 (April 2026)
• Rust SDK v0.4.0 and v0.4.1, with support for spec v0.5.1
• Go SDK v0.5.1, with support for spec v0.5.1 and bug fixes

Security Updates

• The Rust, Go and Java SDKs added a Plumber security scan to CI and hardened their GitHub Actions workflows.
• The project communnity is discussing event-level provenance and tamper evidence, in light of the verifiability extension recently merged in CloudEvents.

JayeX

Gateway API support

The JayeX applications has gotten support for Gateway API as an alternative to Ingress. As a default gateway implementation Envoy Gateway has been choosen and baseline configuration has been added. More details can be found in the issue.

Upgrade rally

Our go applications and libraries (we have many) has been upgraded to go 1.24 and also a lot of dependencies have been upgraded.

Project name change

Work has been ongoing to switch the project name to JayeX. So far the web site and the plugins are done.

Jenkins

Google Summer of Code 2026

Jenkins has completed five Google Summer of Code 2026 projects. Read more about three of the projects in their concluding blog posts:

• Retooling Jenkins.io Web Success Stories by Vatsal Verma
• Jenkins Email Notifications using Outlook SMTP with OAuth by Mohammed Faheem
• Plugin Modernizer Stats Visualization by Pratik Mane

Special thanks to our organization lead mentor, Kris Stern, and the other Google Summer of Code mentors.

Features and releases

Notable weekly releases in Q2 and Q3 2026 included:

• Jenkins 2.580 (September 2) – Security fixes as published in the security advisory
• Jenkins 2.579 (August 11) – Apache Commons Lang 2.6 removed from Jenkins core
• Jenkins 2.577 (August 11) – Jenkins binary is over 40 MB smaller than it was a year ago
• Jenkins 2.574 (July 21) – Jenkins binary is over 20 MB smaller than it was a year ago
• Jenkins 2.568 (June 10) – Security fixes as published in the security advisory
• Jenkins 2.562 (April 28) – Jenkins MSI installer is now signed with a certificate provided by the Linux Foundation

LTS releases in Q2 and Q3 2026:

• Jenkins 2.568.3 (September 2) – Security fixes as published in the security advisory
• Jenkins 2.568.2 (August 5) – Security fixes as published in the security advisory
• Jenkins 2.555.3 (June 10) – Security fixes as published in the security advisory
• Jenkins 2.555.2 (May 13) – Jenkins MSI installer is now signed with a certificate provided by the Linux Foundation

Jenkins continued its pattern of releasing a new version every week and a new long term support version every 4 weeks. New features in long term support releases are summarized in the “What’s new in Jenkins LTS” playlist.

Security Updates

The Jenkins security team continues to track security issues, report vulnerabilities, and resolve security issues.

Security advisories were published in Q2 and Q3 2026 included:

• 29 April 2026 Plugins Security Advisory
• 27 May 2026 Plugins Security Advisory
• 10 June 2026 Core Security Advisory
• 24 June 2026 Plugins Security Advisory
• 5 August 2026 Core and Plugins Security Advisory
• 2 September 2026 Core and Plugins Security Advisory

Ortelius

Roadmap

• Continue to refine the Ortelius AI for updating package manager files using the Claude LLM and Ortelius MCP.
• Next is to add in GitLab support for getting the release and deployment data from GitLab workflow logs.
• Add more “how to” videos.
• Onboarding -delivering value in under 10 minutes.

Features and release

• Last big release in Q1 – V12 release for the new UI and backend using pure ArangoDB. REST, GraphQL and Kafka are now supported. This also includes easy onboarding using a GitHub Ortelius App to bring in release artifacts and deployment data. The onboarding continues to be worked on.

Adoption updates

We continue to work toward a corporate end-user. Work has been done to simplify the onboarding with auto scanning. The Ortelius Outreach has created a “Pathfinder” badge to encourage onboarding open-source projects. OS projects only have repos, but not endpoints. Ortelius onboarding will show vulns in the releases, not the entire repo, based on SBOMs.

Security updates

Ortelius is now monitoring itself. We continue to use revonate on all (~40) repos keeping dependencies up to date. We are now focused on those CVEs that are being released and those are fixed within 2-3 days.

Screwdriver

Features and release

• Component versions as of Q3 2026:

  • API v8.0.192
  • UI v1.0.1420
  • Store v7.0.4
  • Queue-Service v5.0.11
  • Launcher v6.0.237
  • Build Cluster Worker v6.1.2

  Notable Updates:

  • Support for partial versions when using templates.
  • Expanded branch name character set
  • Ability to disable a pipeline
  • Lots of updates and improvements to the UI/UX

Contribution update

We are pleased to have raihata join as our newest contributor to the project. Project continues to maintain a steady pace of development.

Spinnaker

• 2026.3.0 is released with MAJOR improvements and enhancements. Highlights:
  • AWS SDK1 is removed
  • New UI’s for account management
  • SAML moved to spring config
  • Deprecation announcemnts on multiple tools/configs/resources
  • MCP Server
• Halyard was removed from the codebase and kustomize is now the documented and supported installation method
• Post release, cleanup of the old spinnaker images is about to be applied to purge data. This should reduce project costs, and keep newer supported images. GHCR being now the default, GAR will no longer be supported and images will be removed there after a period of time.

Features and release

Currently supported releases and release notes are available here

Contribution trends

The number of pull requests has drastically increased in the last two months. This is driven a lot by AI improvements to the project and major recent changes.

We are seeing some new contributions and it’s worth reviewing the stats.

Security updates

There are critical and high vulnerabilities, the most recent of which was published early July. It’s highly recommended to be on the most recent minor version of a supported release (the most 3 recent releases).

Infrastructure updates

Automatic image cleanup. This will be purging old release images – this will be cleaning up almost 10 years of old images as a result.

For more information on the CD Foundation projects and how to contribute, check out the project page.