Bamboo 11.0 EAP

This documentation is intended for third-party app vendors and people maintaining their own in-house apps who want to ensure that the apps are compatible with Bamboo 11.0. If you’d like to stay in the loop, check out the latest posts and discussions in the Atlassian Developer Community. 

 Summary of the changes

This is an overview of the changes that are going to become part of the upcoming release of Bamboo, so you can start thinking about how they might impact your apps.

ベロシティ テンプレートと許可リストのセキュリティ強化

Status: IMPLEMENTED 

すべての Data Center 製品について、検証可能な安全性を備えたインストール ディレクトリの用意を進めています。 これらの変更により、攻撃者がファイルシステムへのアクセスを悪用することが難しくなるだけでなく、カスタマーが製品のインストール状態を確認できるようになります。

From Bamboo 11.0, all Velocity files stored on the filesystem (for example, shared, local home, or any other) will need to be explicitly allowlisted and must be of a specific file type. Files stored inside .jar files and bundled within plugins will not be affected.

In addition, all method invocations within a Velocity template must be explicitly allowlisted.For more information, visit Configuring the Velocity method allowlist and Configuring the Velocity file and file type allowlist.

Migration to Apache Struts 6

Status: IMPLEMENTED 

We’ve upgraded to Struts 6. Make sure you’re aware of the following changes:

• Annotate getters with @StrutsParameter(depth=X) (dependency on struts-core lib)

• Annotate setters with @StrutsParameter (dependency on struts-core lib)

• The action method previously named doSomething must now be fully informed. Previously, the do prefix could be suppressed.

• The method previously named getBamboo() has been renamed to getBambooContainer() to avoid warnings from Struts when .bamboo. is used in our templates.

• OGNL Allowlist - Example from Confluence available at Struts Module

Your deployment projects and environments are cached now

Status: IMPLEMENTED 

Bamboo 11 introduces application-level caching for deployment projects and environments to elevate your daily experience. This can be especially beneficial if you utilize them heavily or have many of them. Bamboo speeds up display times and optimizes resource usage by serving cached objects for user interface and background processing. We recommend that you keep this enabled, though you can disable it via the system property bamboo.deployment.cache.enabled.

Automatic offline agents management

Status: IMPLEMENTED

As an administrator, you can now configure policies for the automatic removal of offline agents. This feature helps free up agent names and keeps your instance data tidy and clean. Enabling this will enhance your agents' processing performance.

Bamboo uses the AWS SDK V2 now

Status: IMPLEMENTED

Bamboo AWS-related functionality, such as elastic agents and S3 artifact handlers, are now using AWS SDK V2, which replaced V1. This change was introduced to elevate your security and improve the performance and it should be invisible from the user perspective.

CodeDeploy Task was removed

Status: IMPLEMENTED

After being deprecated for some time, the AWS CodeDeploy Task was finally removed from Bamboo due to compatibility and security concerns.

Legacy repositories API is removed

Status: IMPLEMENTED 

Bamboo 11.0 has removed the legacy repositories API. This change finalizes the transition to the modern API introduced in Bamboo 5.14, which included a rebuilt repository subsystem, new plugin points, and web repository viewers. This update eliminates technical debt and ensures a more streamlined and efficient system. Check out the Bamboo API Changes for 5.14 for more details.

Quiet period removal

Status: IMPLEMENTED 

The quiet period functionality has been removed due to performance issues. Consider using the Stop oldest builds strategy for concurrent builds as an alternative. Explore more: Configuring concurrent builds

アプリ署名による安全なアプリ インストール

Status: IMPLEMENTED 

アプリのセキュリティを向上させるために、アプリのインストールを署名済みアプリのみに制限する新機能を導入します。これは次の場面で役立ちます。

• アプリが Atlassian Marketplace からのものか、あるいは信頼できるパートナーが手動でアップロードしたものであることを確認する

• 悪意のある攻撃者が有害なアプリをアップロードするのを防ぐ

アプリ署名は新規アプリのインストールのみに影響し、すでにインストール済みのアプリはそのままです。

This feature will be gradually rolled out across Data Center products by mid-2025. For details, check out this community post.

このリリースでは、アプリ署名は既定で無効になっています。猶予期間は、Universal Plugin Manager (UPM) の次の機能リリースまで継続し、その後はアプリ署名が既定で有効になります。

この猶予期間を利用して、ご利用のプロセスの適合性をご確認いただくことをおすすめします。必要な手順は、アプリを Marketplace からインストールするか、カスタム アプリを構築するかによって異なります。

アプリ署名を有効にして、Marketplace からインストールする

猶予期間中は、任意のタイミングでアプリ署名を有効化できます。手順は次のとおりです。

1. Enable app signing. For details, see Configuring UPM app signature check.

2. Download and install Certificate Authority (CA) from Atlassian. For details, see Updating Atlassian Certificate Bundles.

3. 以上で完了です。Marketplace から安全にアプリをインストールしていただけます。

カスタム アプリのインストール

カスタム アプリのビルドを使用する場合は、次の手順でご自身のアプリに署名してそれらを保護できます。

1. Enable app signing. For details, see Configuring UPM app signature check.

2. Get the app signature and verification certificate as described in Generating app signature and verification certificate using OpenSSL.

3. Put your new certificate in your Trust store as described in Updating Atlassian Certificate Bundles.

4. 署名したアプリをインストールします。

If you’re experiencing issues, check out app signing troubleshooting. 

サポート対象プラットフォームの更新

See what changes are in store for the supported platforms in Bamboo. For more information about what the latest stable release of Bamboo supports, see Supported platforms.

サポート終了のお知らせ

In this release, we’re removing support for:

PostgreSQL 14

In this release, we’re deprecating support for:

PostgreSQL 15

SQL Server 2017

MySQL 8.0

新たにサポート対象となったプラットフォーム 

Bamboo 11.0 doesn’t introduce support for any new software platforms.

 既知の問題

We've identified an issue where HTML in authentication links to Atlassian Product applications is not escaped correctly.