A pinned plugin is a bundled Jenkins 1.x plugin you updated by hand, which Jenkins marks so later upgrades do not overwrite it. An implied dependency is a plugin relying on a feature that moved out of core without declaring it. Both cause surprises when you upgrade an old controller.
Pinned plugins
Pinning applies only to plugins bundled with Jenkins 1.x, such as Matrix Authorization. The feature was removed in Jenkins 2.0. Here is how it behaved:
| Event | Result |
|---|---|
| You manually update a bundled plugin | Jenkins creates an empty PLUGIN_NAME.jpi.pinned file |
| Later Jenkins upgrade | The pin stops the bundled version from overwriting yours |
| You remove the pin | Unpin in the plugin manager or delete the file |
| No pin file | Jenkins restores the bundled version on startup |
On a very old controller, a stale pin can leave a plugin on an old version while everything around it moves forward. Look for .pinned files in the plugins folder during any upgrade review.
Implied dependencies
When features moved from core into plugins, plugins built against older core versions may depend on the detached plugin without saying so. In the plugin manager you can see these by hovering over the uninstall button. The real fix belongs to the plugin developer, who should release a version requiring a newer minimum core version.
This matters when removing plugins. A plugin that looks unused may be required, in effect, by another. Check the hover text before you uninstall.
Related quirks
- Uninstall options. The Installed tab only offers uninstall for plugins that no other plugin depends on.
- Update Center. It offers only the latest release, so an older version means a manual install of the file.
- Leftover data. Removing a plugin leaves its configuration. Use Manage Old Data.
A pre upgrade checklist
- List plugins and versions.
- Look for
.pinnedfiles and decide whether each pin is still needed. - Hover over uninstall buttons for plugins you plan to remove, and note implied dependencies.
- Read the upgrade guide for each LTS line you cross.
- Test on a copy, then repeat on production.
Why it is a security issue
Old pinned versions miss fixes, and implied dependencies can make you keep a plugin you did not know you needed. Both slow the patching of legacy CI.
Try it yourself
The demo shows an inventory that surfaces older components and the fixes that exist for them.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard scans dependencies and builds SBOMs, so older components stand out in a dated inventory. Try the free scan.
Quick check
Does pinning still exist in current Jenkins?
The feature was removed in Jenkins 2.0, but pin files can remain from older installs, so check for them.
How do I see an implied dependency?
Hover over the uninstall button in the plugin manager.
Sources
Last reviewed: 19 October 2026.
