Atlassian developer changelog

The Forge CLI now supports listing developer spaces using a new command, forge developer-spaces list.

This command will display a table of your developer spaces including their IDs and names. It also supports JSON output using the --json option, similar to other list commands in the Forge CLI.

This command is included in the latest version of @forge/cli. Run npm install -g @forge/cli@latest to install this version.

We are still rolling out a small number of critical back-end fixes that help maintain the stability of the upgrade path for large apps. Extending by two weeks gives us the confidence that these changes are fully deployed and verified before we re-enable minor version updates.

We are extending the period during which all updates to Forge apps with over 50,000 users are classified as major version updates. The new end date is Apr 27, 2026.

During this time, you can continue to use the forge version bulk-upgrade command to roll out updates to customer sites.

For detailed information on how to use forge version bulk-upgrade, see https://developer.atlassian.com/platform/forge/cli-reference/version-bulk-upgrade/.

This change continues to have no effect on how apps qualify for the Forge revenue share rate. Your latest deployed app version determines revenue share eligibility.

We're updating the behavior of DATETIME values returned by Forge Storage's SQL layer.

Previously, DATETIME values set to midnight (00:00:00) were returned without the time component — for example, 2026-01-15 instead of 2026-01-15 00:00:00. After this change, the time component will always be included.

What's changing

• DATETIME values at midnight will now return the full timestamp, including 00:00:00.

• Previously, the time component was omitted for midnight values, returning only the date.

• This change will be rolled out on October 6, 2026.

This change is not backward-compatible. Apps that parse or compare DATETIME values and rely on the absence of the time component for midnight values may see unexpected results.

What you need to do

1. Review any code that reads DATETIME values from Forge Storage.

2. Ensure your app handles DATETIME values with a time component, including 00:00:00.

3. Test your app before October 6, 2026 to verify compatibility.

For more information, see Forge Storage.

As shared in our https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052, Bitbucket Cloud will fully deprecate / change behaviour for a small set of OAuth2 features on May 4, 2026. To help teams identify and migrate any remaining usage ahead of the enforcement date, we will run a series of controlled brownouts starting Apr 20, 2026, for two weeks, after which the functionality will be fully removed on May 4, 2026.

During each brownout window:

• All OAuth authenticated requests directed at www.bitbucket.org will fail with an HTTP 401 error code

• All OAuth authenticated requests which provide the OAuth access token in the access_token query parameters / POST body will fail with an HTTP 401 error code

• The Client credentials grant flow will not issue refresh tokens in their token response.

• OAuth token response payloads will return “scope"  instead of “scopes" (See notes)

Notes:

• The minting of OAuth2 access tokens should always be made to https://bitbucket.org/site/oauth2/access_token. Bitbucket’s API does not mount these urls under the api subdomain.

• In the week beginning Apr 12, 2026 the scope property will be returned alongside the scopes property, allowing time to onboard prior to the start of the brownout.

As per CHANGE-2567, from Apr 2, 2026, the Get all workflows API has been removed from our public API. This API is no longer supported for public use.

We recommend transitioning Search workflows API for a more efficient and scalable alternative.

As previously announced in CHANGE-2568, the Create workflow API has been removed and is no longer supported. Calls to this endpoint will now result in a 404 Not Found error.

We recommend transitioning Bulk create workflows and Bulk update workflows.

Effective April 4, 2026, Forge usage on up to the first five sandboxes associated
with each production site where your app is installed is now exempt from billing.
Usage resulting from customers testing your app in sandboxes will no longer appear
on your monthly Forge bill.

This change makes it easier for customers to test and validate Forge apps in sandbox
environments without incurring additional charges to you.

What you need to do

No action is required. The billing exemption is applied automatically based on
sandbox association with a production site.

Notes

• This policy applies to both Marketplace apps and private apps.

• Sandboxes are intended solely for testing and validation. We monitor for anomalous
  traffic patterns and may suspend, restrict, or throttle usage if misuse is detected.

• If this policy changes in the future, we will communicate at least three months
  in advance.

For more information, see our community post

Important Reminder: As part of the ongoing Marketplace platform re-architecture, Marketplace V2 APIs are scheduled for deprecation on June 30, 2026.

You can find the full context, including deprecation timelines, replacement V3 endpoints, and partner enablement details in the Quick Reference Guide here.

You can now migrate a Connect Jira Issue Field module to Forge's custom field module. The functionality is now available for Single select and Multi select fields.

See https://developer.atlassian.com/platform/adopting-forge-from-connect/migrate-jira-issue-fields/ for more details.

We've published a new guide - https://developer.atlassian.com//platform/forge/working-around-jql-1000-limit/ - to help Forge app developers handle the custom JQL functions returning more than 1,000 values. The guide covers four practical strategies and code examples, along with trade-off comparisons, and guidance on when to use which approach.

Following our deprecation notice on Sep 29, 2025:

• Customers can no longer install Connect private apps.

• Partners and developers can no longer update existing Jira or Confluence apps using a Connect descriptor on the Atlassian Marketplace.

From now on, private apps can only be installed via Forge installation links. See https://developer.atlassian.com/platform/forge/distribute-your-apps/ for instructions on sharing these links to your customers.

This milestone is in line with our timeline for ending support for the Connect platform.

We’re deprecating the Cloud Security Participant badge as part of our broader work to evolve the Marketplace Trust program.

Effective March 31, 2026:

• The Cloud Security Participant badge will be retired and removed from the Marketplace.

• We will continue to highlight participation in the Bug Bounty program on app listings for both Cloud and Data Center apps, so customers can still easily see your ongoing security investment.

We have now added the ability to use the following as dynamic modules, available under Forge’s Early Early Access Program (EAP):

• Portal header

• Portal request view action

• Portal request detail

To start testing, sign up for the EAP here.

Forge now supports a preUninstall module, allowing apps to run cleanup logic before uninstallation. Use this to remove stored data, secrets, or other resources when your app is uninstalled. For more details visit https://developer.atlassian.com/platform/forge/events-reference/life-cycle/#life-cycle-events

We’ve updated how license information is exposed for Forge apps so that the license object is only present for paid, production Marketplace apps, matching our documented behavior.

If you’ve followed the currently documented patterns to check license status, you should not see any change. Our changes may impact apps that rely on custom or undocumented ways of inferring license state for free apps (for example, assuming a license object is present for free installations).

Please refer to our updates docs for more information https://developer.atlassian.com/platform/marketplace/listing-forge-apps/#checking-the-license-status