We're deprecating injecting stylesheets for Connect apps via inline styles in favor of loading from the Connect CDN. This affects the Theming API and dynamic content macros that supported the legacy Confluence editor.

At the end of the deprecation period (18th November 2024), we’ll stop injecting any inline styles and only load from the CDN.

If your app doesn’t use the above Connect features, or doesn’t use a Content Security Policy (CSP) for style-src, no action is required. Otherwise, please read the details here or see https://developer.atlassian.com/platform/marketplace/security-requirements/#connect-apps on how to modify your CSP to support these changes.

We are deprecating the Bulk remove content states from content and the Get update on long running task for setting of content state v1 REST APIs in Confluence Cloud.

On Nov 13, 2024, the POST /wiki/rest/api/content-states/delete endpoint and the GET /wiki/rest/api/content-states/task/{taskId} will be removed.

A new RFC is ready for review at https://community.developer.atlassian.com/t/rfc-50-let-users-easily-interact-with-and-configure-macros-in-the-editor/79871.

Following this deprecation announcement from November 6, 2023, we're removing the PUT /wiki/rest/api/content-states endpoint from the Confluence Cloud v1 REST API. It’ll no longer be available from the time of this announcement and we won’t be providing a replacement functionality.

The groups atlassian-addons and atlassian-addons-admin will no longer be returned by the Get Groups API since they are strictly for internal use.

We are extending the deprecation period for all endpoints noted in CHANGE-864 and CHANGE-1116 to Dec 2, 2024.

Atlassian Security Scanner is already checking your Marketplace apps for any critical- or high-severity vulnerabilities in third-party dependency trees and .jar files. The tool is helping us ensure that all apps on the Marketplace are safe for our customers to download and install on their instances.

While .jar files are scanned every day due to the nature of modern cyber threats, third-party dependencies are checked when you submit your app for approval for the first time and during the regular annual review.

If Security Scanner doesn’t detect any vulnerability in your app, it’s safe to be on the Marketplace.

In case a security issue has been found, a Jira ticket about it will be created in the Atlassian Marketplace Security (AMS) project, and you’ll receive an automated email notification about the ticket. As soon as you fix the issue, upload the new version of your app to the Marketplace. Your ticket will be closed automatically the next day after Security Scanner checks the app again and finds no vulnerabilities.

If you need help or have questions, don’t hesitate to chat with an entitled representative of the Data Center Review team in the ticket’s comments. Or you can always contact Atlassian Support directly.

We’re introducing new endpoints to the Confluence Cloud REST API v2 for applying and modifying classification levels in spaces, pages and blog posts. How does data classification work?

We’ve added a set of new query parameters to the v2 Get space by id API endpoint that allows for optional fetching of metadata properties related to the given space. These include:

• include-labels

• include-operations

• include-properties

• include-permissions

By default, these metadata properties will not be included in the response unless specified.

A new RFC is ready for review at https://community.developer.atlassian.com/t/rfc-47-evolving-the-developer-canary-program-associated-developer-assistant-apps/79453.

A new RFC is ready for review at https://community.developer.atlassian.com/t/rfc-45-upcoming-changes-to-jira-navigation/79375/70.

We have now fixed the incorrect scope check requests with a trailing forward slash.

Assume there is a scenario where a request is made to an endpoint https://api.atlassian.com/some/path/. Scope checking may find a valid scope for path /some/path/** and pass the scope check. Once the request reaches the backend service, if the service does not have a path with a trailing slash, it may remove it and invoke the parent endpoint https://api.atlassian.com/some/path which may not have the same scope requirements.

With this fix, scope checking will ignore the trailing slash when matching scopes to the path.

This means that a request to https://api.atlassian.com/some/path/ and https://api.atlassian.com/some/path will be treated the same with respect to scope checking.

The progressive rollout of data security policy events has been completed. Data security policy events are generated when installed apps' access to certain data within Confluence, Jira, Jira Service Management, or Jira Software has been blocked by an administrative policy with an App access rule. You can now subscribe to these events.

Being a new capability however, we are scaling up our processing of these data security policy events over the next few months. In the meantime we have set a upper limit of 50,000 objects. This means that if a customer activates or updates a data security policy that affects more than 50,000 objects, you will receive the first 50k objects in the events and the rest would be omitted.

We intend to raise these limits and will advise once we have reached our final threshold— and have determined our final hard limits.

The Forge confluence:spaceSettings module now supports view.createHistory() for Custom UI via @forge/bridge. App developers can now utilize a path segment at the end of the global page URL to maintain page history within their application.

Some permission checks performed by the endpoint /wiki/rest/api/content/{id}/permission/check for operations other than read now return a different informational error message when a permission check fails, as follows:

• Some checks that returned “User does not have permission to the space” now return “User does not have permission to the content”.

• Some checks that returned “Anonymous user does not have permission to the space” now return “Anonymous user does not have permission to the space”.

Previously, this API did not return “User does not have permission to the space” consistently when the cause of a failed check was a lack of space permissions, so this change is not breaking. It simply reduces the frequency with which this message is returned as an error in the response body for operations other than read.