Jira Service Management 11.0.x upgrade notes

Below are some important notes on upgrading to Jira Service Management 11.0.x. For details on the new features and improvements in this release, see:

• Jira Service Management 11.0.x release notes

Check your email channel configuration

If you use the Microsoft Graph API protocol to receive customer emails and convert them into requests in Jira, make sure the email channel is configured correctly.

In Jira Service Management 11.0, incorrectly configured email channels won’t successfully pull emails. Previously, the system defaulted to pulling emails from the account that authorized the mailbox.

Explore how to configure an email channel

Spring and Jakarta upgrade

To maintain high security standards and keep dependencies supported and up to date, we’re upgrading Spring to the 6.x line, Jakarta to EE Platform 10, Apache Tomcat to 10.1 as well as other libraries that depend on Spring and Jakarta.

The Apache Tomcat upgrade also introduces changes under the Jakarta Servlet specification. If you rely on custom server settings or connectors, review the following before upgrading:

• Check custom server.xml configurations, especially any references to "javax.servlet" APIs. Tomcat 10.1 has migrated to the "jakarta.servlet" namespace.
• Verify that any connectors (HTTP, AJP, etc.) are still supported and properly configured in Tomcat 10.1.
• Confirm that any security or TLS/SSL settings are compatible with Tomcat 10.1’s default cryptographic protocols.

For detailed information on the changes introduced in Tomcat 10.1, consult the official Apache Tomcat documentation.

Upgrade to jQuery 3

We’ve upgraded jQuery from version 2 (with jquery-migrate@1.4.1) to version 3 (with jquery-migrate@3.4.0) to align on jQuery versions across all Data Center products. This means a significant jQuery version uplift for products containing older versions of jQuery that will make developing cross-product apps easier.

For more details, refer to the jQuery Core 1.9 upgrade guide and jQuery Core 3.0 upgrade guide

Removal of deprecated components in AUI 10

We’re removing some outdated AUI 10 components with design and accessibility issues (Dropdown 1 and Toolbar 1) and updating internal dependencies to better support jQuery 3 and proactively address security issues.

End of support for LESS

To enhance the security and performance, we’re removing the ability to transform LESS to CSS at runtime, requiring LESS to be transpiled into CSS at compile time.

Global serialization filter

We’re implementing a global serialization filter that relies on a central blocklist for Java deserialization, Velocity, Struts, and XStream. This filter is designed to block specific classes and patterns that are recognized as vulnerable to Remote Code Execution (RCE) through publicly known gadget chains.

Add scopes to REST endpoints to use OAuth 2.0 2LO

We’ve introduced @ScopesAllowed to improve security and control over REST endpoints.

Add the @ScopesAllowed annotation to your endpoints to make them accessible using an OAuth 2.0 Client Credentials token (2LO).

For example, this annotation requires that the access token has the WRITE scope before providing access to this endpoint.

@POST
@ScopesAllowed(requiredScope = "WRITE")
public void createEntity(...) {}

Explore Jira OAuth 2.0 scopes for incoming links

OAuth 2.0 security improvements

We're implementing several important changes to our OAuth 2.0 authentication process to enhance security and efficiency.

• Enforced global maximum time on access tokens: Access tokens will now have a maximum validity period of 1 hour. This change is designed to improve security by ensuring tokens are refreshed more frequently. You can change the value by setting the atlassian.oauth2.provider.access.token.expiration.seconds system property.
• Maximum lifetime of client ID and secret: The lifetime of client IDs and secrets is now 90 days by default. However, you can adjust this setting to a maximum of 730 days. This change aims to encourage regular rotation of credentials. You can change the value by setting the atlassian.oauth2.provider.client.credentials.expiration.seconds system property.
• Rotation of client credentials: We recommend regularly rotating your client credentials, including both the client ID and secret, to improve security. Setting up a rotation policy helps reduce the risk if credentials are ever compromised.
• Revocation of rotated client credentials: Once client credentials (client ID and secret) are rotated, the previous credentials can be revoked. This ensures that only the most recent credentials remain active, reducing the risk of unauthorized access.
• Revocation of user's refresh tokens: We now provide the ability to revoke all refresh tokens associated with a specific user. Additionally, administrators have the authority to revoke all refresh tokens for users within the system. This capability allows for greater control over session management and security.
• Maximum number of refresh tokens: The maximum number of refresh tokens allowed per client ID and user is limited to 25. This limitation helps manage resource usage and ensures that token proliferation is kept in check. You can change the value by setting the atlassian.oauth2.provider.refresh.token.limit.per.client.user system property.

Basic authentication disabled by default

We’re disabling authentication with basic authentication by default. This is a first step towards the removal of basic authentication altogether as we develop and mature alternatives to support the remaining few use cases.

Updated Tomcat protocols

We’ve updated the protocols provided by Jira extending the Tomcat protocols with support for password encryption:

Changes to supported platforms

For the full list of supported platforms, see Supported platforms.

For previous announcements, see End of support announcements.

We’ve removed support for:

• JDK 17
• PostgreSQL 15
• PostgreSQL 14
• PostgreSQL 13
• PostgreSQL 12
• MySQL 8.0
• Oracle 18c
• MSSQL Server 2017

Added support

We’ve added support for:

• JDK 21
• PostgreSQL 17
• MySQL 8.4 LTS

This version of Jira will only run on Java 21.

App developers

Check out Preparing for Jira 11.0 for any important changes regarding apps.

Upgrade procedure

To help you upgrade to the latest and greatest:

• See Upgrading Jira applications for complete upgrade procedures, including all available upgrade methods and pre-upgrade steps.

• For a more tailored upgrade, go to Jira administration, then Applications, and then Plan your upgrade. We’ll recommend a version to upgrade to, run pre-upgrade checks, and provide you with a custom upgrade guide with step-by-step instructions.