This value is interpreted separately from the tables' column widths (if present) and should be an integer. This functionality supersedes the current layout attribute and is backward compatible. More information on the ADF definition of the table node can be found here.

If you are sure the input is legitimate and cannot lead to an unexpected API call, you can encode it manually or use assumeTrustedRoute.

As a reminder, if you indicate support for a realm, it means your app stores the relevant data that is in-scope for your app’s data residency solution (see Atlassian’s documentation on in-scope data for our products here). For more information, please refer to the Connect data residency documentation.

In addition to Canada, Atlassian is exploring making additional data residency regions available in the future. These can be identified on the Atlassian Cloud Roadmap and we will provide similar updates/notice prior to these regions being available.

With this release, you can start to migrate apps to ACSB 4 and Spring Boot 3.

This release includes these updates:

• Migration to Spring Boot 3.1.0.

• Migration to Java 17.

The previous 2.7.x version of Spring Boot is reaching End Of Life (EOL) by November 18th 2023 (Spring Boot).

Accepting sensitive JWTs as a query string parameter presents a problem as the query string is often saved in web browser history, passed through Referers to other web sites, stored in web logs such as intermediate proxy servers.

If your app provides its Connect JWT to the Atlassian APIs as a query string parameter, you must update it to pass the JWT via an Authorization: JWT header.

As always, we will notify you of any apps that are found to be missing security requirements via the Atlassian Marketplace Security Jira Project. As a reminder, all apps are subject to the Security Bug Fix Policy for Marketplace apps and must respond to reports of missing security requests in a timely manner.

If you’d like to check your apps yourself, or scan any new apps before listing them on the Marketplace, you can use open sourced versions of these new scanners using the documentation at CSRT and Connect Vulnerability Scanner repositories.

Atlassian regularly releases new cloud app security requirements and scanners to increase the baseline of security across all cloud apps and protect our shared customers from security risks.

Don’t get caught missing a requirement! Prepare for Atlassian’s latest Connect app security scanners with new open sourced scanners for Signed-install AuthN, AuthZ, Input validation(XSS), and Insecure storage of secrets.

Should we find a missing requirement, we will notify you via the Atlassian Marketplace Security Jira Project. As a reminder, all apps are subject to the Security Bug Fix Policy for Marketplace apps and must respond to reports of missing security requests in a timely manner.

Marketplace Partners with access to the Partner Portal can find the new scanners and more information here in the Partner Portal.

What exactly is changing?

We have a small collection of endpoints in the Content Restrictions section of the API that are being deprecated entirely in favor of equivalent endpoints that are already available and identical in behavior; these endpoints simply consume a groupId path parameter, rather than a groupName path parameter like the now-deprecated endpoints. The endpoints being deprecated are as follows:

• Get content restriction status for group

• Add group to content restriction

• Remove group from content restriction

In addition, a collection of write-based endpoints consuming groupName in some capacity are being updated to support groupId as well (if not already), and a deprecation notice is being applied to their respective groupName fields, where applicable. Behavior for all these endpoints will remain the same, but within the 9-month deprecation window, migration to utilizing groupId rather than groupName will be required. The endpoints being updated to deprecate groupName usage are as follows:

• Update content restrictions - input groups now accept a groupId, and groupName is marked as deprecated

• Add content restrictions - input groups now accept a groupId, and groupName is marked as deprecated

• Add new permission to space - input groups currently accept both a groupName or groupId value in the identifier field; in 9 months this field will only service groupId values.

• Add new custom content permission to space - input groups currently accept both a groupName or groupId value in the identifier field; in 9 months this field will only service groupId values.

• Create space - input groups associated with permissions now accept a groupId, and groupName is marked as deprecated.

Lastly, a collection of read endpoints currently only returning a groupName have been updated as of this announcement to also return groupId in the response payload. No action is required here, but using the additional returned information may be useful for some of the other described migrations. The endpoints being uploaded to include a groupId in the group object of their response body are as follows:

• Get content restrictions

• Get content restrictions by operation

• Get content restrictions for operation

• Update content restrictions

• Add content restrictions

• Delete content restrictions

• Get spaces

• Get space

• Get content for space

• Get content by type for space

• Create space

• Create space

• Get group memberships for user

What action is required of me?

The following table presents a mapping for the 3 deprecated endpoints to their logical equivalent that utilizes groupId rather than groupName:

For update content restrictions and add content restrictions, content permissions being added/updated that are associated with groups must begin passing a groupId value in the id field. For programmatic groupId retrieval (getting the groupId for a given groupName) , we recommend you use the Search groups by partial query endpoint, and parse the response body for the necessary groupId value(s) to then pass in the groupId based endpoints/parameters.

GET /wiki/rest/api/group/picker

• Search groups by partial query consumes a query string parameter and searches by substring. This is a more powerful search functionality but can also be used to reflect a simple Get group by name functionality if you simply pass the full name of the group you’re looking for my name.

• This endpoint guarantees safe behavior, as if the group you’re looking for has been renamed, it’ll be missing from the search results. Using this endpoint as the gateway to retrieving an immutable groupId to use in other endpoints will protect you from “missing” groups in the post-group renaming world.

For add new permission to space and add new custom content permission to space, the same strategy as above is recommended in order to retrieve a groupId to pass in place of a groupName. The only difference here is that the aforementioned endpoints will accept the groupId value in the existing identifier field. Remember, identifier will stop accepting groupName values as of May 1st 2024.

For create space, the same strategy for groupId retrieval described above is recommended. If you’re creating non-default space permissions upon space creation associated with groups, begin passing a groupId value in the id field.

Lastly, for the many endpoints being updated to include a groupId in their response body id field, no action is required on your end - we will continue returning groupName as well. The heart of these changes is to protect the end user from dangerous behavior - aka making write-based calls contingent on the name of a group, a mutable field. As such, there is no harm in getting the current name of a group back at any given point in time in a post-group renaming world.