Bamboo 12.0 EAP

This documentation is intended for third-party app vendors and people maintaining their own in-house apps who want to ensure that the apps are compatible with Bamboo 12.0. If you’d like to stay in the loop, check out the latest posts and discussions in the Atlassian Developer Community. 

 Summary of the changes

This is an overview of the changes that are going to become part of the upcoming release of Bamboo, so you can start thinking about how they might impact your apps.

Java 21 is the minimum required version

Status: IMPLEMENTED 

Starting from Bamboo 12, the minimum required Java version is 21. Support for Java 17 has been removed.

Apps developed for Bamboo 12 must use a Java 21 JDK, and can use language level 21 features.

Jakarta EE 10 upgrade

Status: IMPLEMENTED 

In Bamboo 12.0, the following core dependencies using Jakarta APIs have been upgraded to support Jakarta EE 10:

• Tomcat 10.1
• Spring Framework 6.2

Additionally, all the other libraries/dependencies that depend on Spring and Jakarta APIs have also been upgraded.

As a result, the Maven packages that provide the Jakarta EE APIs have been updated to the following versions:

• Jakarta Servlet 6.0
• Jakarta RESTful Web Services 3.1
• Jakarta Dependency Injection 2.0
• Jakarta Annotations 2.1
• Jakarta Activation 2.1
• Jakarta Mail 2.1
• Jakarta XML Binding 4.0
• Jakarta Bean Validation 3.0

Java package name changes

Status: IMPLEMENTED 

The upgrade to Jakarta EE 10 is a significant change and will impact most third-party apps as the Java package names have changed from javax to jakarta.

The below table summarizes those package name changes:

Platform 8 upgrade

Status: IMPLEMENTED 

Bamboo 12.0 includes an upgrade to Atlassian Data Center Platform 8.0. With this upgrade, we can respond to security changes with reduced disruption.

As part of this work, we have upgraded several Atlassian and third-party components to benefit from the latest security patches and bug fixes.

The Prepare your Data Center app for Platform 8 page contains an extensive list of the changes in Platform 8 and guides on how to migrate your app to Platform 8.

Migration to Apache Struts 7

Status: IMPLEMENTED 

We’ve upgraded to Struts 7. Make sure you’re aware of the following changes:

• The com.opensymphony.xwork2 package has been migrated to org.apache.struts2.
• The FreeMarker parameters template variable has been replaced with attributes to avoid mixing access to HTTP request parameters.

You can find extensive documentation and migration steps at https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration.

Removal of Trusted AppLinks

Status: IMPLEMENTED 

We’re removing Trusted applinks to reduce the number of vulnerable entry points into the product. We’ve replaced this way of exchanging information between Atlassian products with more secure solutions that follow industry best practices, like the OAuth protocol.

Basic authentication disabled by default

Status: IMPLEMENTED 

Authentication with basic authentication is now disabled by default. This is a first step towards the removal of basic authentication altogether as we develop and mature alternatives to support the remaining few use cases.

This doesn’t impact Java APIs or app compatibility, but may impact your development and test environment. It is possible to re-enable basic authentication, either via the system administration user interface, or at startup time by setting the following Java system property: 

com.atlassian.plugins.authentication.basic.auth.filter.force.allow=true

App signature verification is now enabled by default

Status: IMPLEMENTED 

Apps that are uploaded via UPM are now required to be signed by default. This doesn’t impact Java APIs or app compatibility, but may impact your development and test environment. It is possible to disable the signature verification by setting a Java system property. 

atlassian.upm.signature.check.disabled=true

Distribution via Atlassian Marketplace generates the signatures of the installed apps, but for vendors or customer in-house development teams that want to install an application directly in the product without the Marketplace involvement, custom application signature and verification certificate are required.

For further details, see Configuring UPM app signature check and Generating app signature and verification certificate using OpenSSL.

End of support for LESS

Status: IMPLEMENTED 

To enhance the security, performance, and overall developer experience, we’re deprecating both the LESS web-resource transformer and the LESS Maven plugin. 

For more details, read the announcement.

AUI 10 support

Status: IMPLEMENTED 

Bamboo 12 has migrated to AUI 10 and jQuery 3. As a result, plugins must either bundle their own dependencies or follow the AUI 10 migration guidelines and the jQuery 3 migration guidelines.

In addition to these library upgrades, we removed Backbone 1.6.0 and 1.3.3, along with the globally available Backbone through window.backbone.

To see more details about the AUI 10 deprecation, check the announcement.

Removal of deprecated components in AUI 10

Status: IMPLEMENTED 

During the AUI 10 migration, we removed outdated components that were deprecated due to design or accessibility issues:

• Dropdown 1 - replaced by Dropdown 2
• Toolbar 1 - replaced by Toolbar 2
• Dialog 1 - replaced by Dialog 2

These changes may result in slight differences in the UI, such as layout changes. These changes should not result in functionality changes.

In-product diagnostics

Status: IMPLEMENTED 

Bamboo 12.0 introduces integration with In-product Diagnostics (IPD), which monitors key system metrics in real time within Bamboo. Enabled by default, IPD tracks database latency, build and deployment activity, file system performance, server and JVM health, and system resource usage.

New metrics are written to logs/atlassian-bamboo-ipd-monitoring.log and logs/atlassian-bamboo-jmx.log.

New API for adding data to support information and support zip files

Status: IMPLEMENTED 

The page at Administration → Troubleshooting and support tools → System Information shows diagnostic information about the system that is helpful for support purposes. This information is also included in support zip files.

The API that adds custom information to this page has moved. The new API should require only trivial changes.

Old Maven dependency:

<dependency>
    <groupId>com.atlassian.support</groupId>
    <artifactId>stp-spi</artifactId>
</dependency>

New Maven dependency:

<dependency>
    <groupId>com.atlassian.troubleshooting</groupId>
    <artifactId>spi</artifactId>
    <version>3.1.0</version>
</dependency>

Dedicated log file for cluster communications

Status: IMPLEMENTED 

Cluster communication logs are now in a dedicated file. Starting from Bamboo 12, node communication metrics are written to atlassian-bamboo-communication-stats.log instead of the main log, making troubleshooting and performance monitoring easier.

Enhanced access logs

Status: IMPLEMENTED 

The new structured format of access logs provides richer information for better analysis and troubleshooting.

Old log format:

[INFO]:   [ip] [user] [method] [url] [starting memory free (kb)]
[DEBUG]:  [ip] [user] [method] [url] [starting memory free (kb)] +- [difference in free mem (kb)] [query time (ms)]

New log format:

[INFO]:   [ip] [user] [method] [url] requestSize=[request size (B)]
[DEBUG]:  [ip] [user] [method] [url] requestSize=[request size (B)] startMemory=[starting memory free (kB)] memoryDiff=+-[difference in free mem (kB)] responseTime=[query time (ms)]

Global serialization filter

Status: IMPLEMENTED 

We’re implementing a global serialization filter that relies on a central blocklist for Java deserialization, Velocity, Struts, and XStream. This filter is designed to block specific classes and patterns that are recognized as vulnerable to Remote Code Execution (RCE) through publicly known gadget chains.

New features coming with Bamboo 12

Status: IMPLEMENTED 

Here’s the list of brand new features you may expect with the final Bamboo 12 release:

• Service accounts: Service accounts are a new type of non-human principal that enables secure, automated integrations where no user context exists. They are not associated with an user, do not consume a license and can only access Bamboo using Oauth 2.0 2LO authentication.

• OAuth2 AppLinks: We're introducing OAuth 2.0 support for application links (AppLinks) across Atlassian Data Center products. We use OAuth 2.0 as the industry-standard authentication control for modern, secure, and reliable connections between Atlassian products and external applications.

• Limit on the number of concurrent Ephemeral Agents: When the build starts and the Ephemeral Agent is chosen to execute it, but the agent spawn request is above the limit configured on the Ephemeral Agents' settings page, it will be queued and fired when a free slot appears.

• Non-rerunnable plans: You can now mark your plans as non-rerunnable, so only fresh builds are allowed.

• You now have complete pipeline visibility with the grey builds now included on the Bitbucket DC builds page

• Improved background jobs distribution: In cluster environments, Bamboo 12 distributes background jobs across all nodes instead of just the primary node.

• GitHub Apps support: GitHub Apps integration provides secure, granular API access for enterprise-level automation without personal access token limitations. You can now configure your GitHub repositories using legacy personal access tokens or via recommended GitHub App integration.

• API token support for Bitbucket Cloud: Bitbucket Cloud repositories now support API tokens authentication alongside app passwords.

• Performance improvements for time-to-build for Bitbucket Cloud and GitHub webhook-based integrations.

Updates to supported platforms

See what changes are in store for the supported platforms in Bamboo. For more information about what the latest stable release of Bamboo supports, see Supported platforms.

End-of-support announcements

In this release, we’re removing support for:

PostgreSQL 15

SQL Server 2017

New supported platforms

In this release, we’re adding support for:

PostgreSQL 18

Oracle 23ai

MySQL 8.4

 Known issues

There aren’t any known issues to report yet, but we’re keeping an eye out.