Jenkins
Jenkins is an open-source automation server maintained as a community project under the Continuous Delivery Foundation (Linux Foundation), which it joined in 2019 and graduated in August 2020; CloudBees, the leading commercial backer, sells a hosted/enterprise distribution (CloudBees CI) built on it. Current release: Jenkins 2.568.1 LTS (July 8, 2026), requiring Java 21 or Java 25 — Java 17 support was dropped as of 2.555.1. Core is MIT-licensed and free; the plugin index at plugins.jenkins.io lists over 2,000 community plugins, each independently versioned and licensed. Jenkins published six security advisories Feb-Jun 2026 (roughly biweekly), and the June 24 advisory alone patched 18 plugins in one batch — the maintenance load falls on whoever runs the controller. Current version/status: 2.568.1 LTS (July 8, 2026). License: MIT (core); individual plugins independently OSI-licensed. Pricing: Core Jenkins is free and open-source; the commercial distribution CloudBees CI runs roughly $75-100/user/month for SaaS tiers, with self-hosted/enterprise support custom-quoted. Maintained by Community project under the Continuous Delivery Foundation (Linux Foundation, graduated 2020); CloudBees is the primary corporate backer and commercial distributor.
Pick Jenkins when you need arbitrary pipeline logic, on-prem or air-gapped builds, or integration with legacy infra SaaS runners won't touch — its 2,000+ plugin index covers hardware and enterprise tooling nothing else bothers with. Skip it for a greenfield repo already on GitHub: GitHub Actions gives you zero-infra runners and a five-minute setup, and most teams don't need Jenkins's power badly enough to staff a controller for it. Jenkins's own security team publishes advisories roughly every two weeks in 2026 — one June batch patched 18 plugins at once — which is the honest cost of "infinite extensibility": someone has to keep patching it forever. Known weakness: Jenkins's own security team ships advisories roughly biweekly in 2026 (one June 2026 release patched 18 plugins simultaneously) because the 2,000+-plugin ecosystem that makes it extensible is also its attack surface, and patching is left entirely to whoever operates the controller.
See how it ranks →