Highlights of 11.0.0-beta3

2026 年 9 月 8 日にリリース

AUI 11

対象: 管理者

We’re introducing AUI 11 with the next major versions of our Data Center products, bringing a refreshed visual experience that aligns more closely with Atlassian Cloud. The update includes refreshed badges, banners, and application headers, a modernised icon set, and updated typography using Atlassian fonts and design system themes.

If you use Marketplace apps or custom in-house apps with a frontend, ensure they’re compatible with the new major version before upgrading.

Asynchronous Macro Execution

対象: 管理者

Confluence Data Center now supports asynchronous macro execution — a major performance capability that changes how macros are rendered on a page.

Previously, every macro on a Confluence page was executed sequentially on the same HTTP request thread. The browser couldn't receive the page until every last macro had finished — meaning a single slow macro (e.g. a Jira query or a blog-posts roll-up) could block an entire page load for all users.

With this release, macros can be configured to execute asynchronously and concurrently in a dedicated thread pool. The HTTP request thread is freed immediately, and macro results are assembled as they complete. For pages with multiple slow macros, this can dramatically reduce perceived load time.

Configuration required: Yes (opt-in per macro, admin setup)

Concurrent execution
Multiple macros on the same page can now execute in parallel rather than sequentially, significantly reducing total page render time.

Deduplication
If multiple users request the same page simultaneously, identical macro executions (same macro, same parameters, same content) can be deduplicated — one execution runs and its result is shared, avoiding redundant parallel work.

Configurable timeouts and rate limits
Administrators can set per-macro time limits and concurrency limits via the REST API, with global defaults configurable via JVM system properties. If a macro exceeds its time limit, Confluence can signal it to stop gracefully.

Result caching (opt-in)
Macro results can be cached per-user on each node, so repeat visits to the same page don't re-execute expensive macros. Cache TTL and size are configurable.

Execution cancellation
Administrators can cancel in-flight macro executions in real time — by execution ID, by macro name, or all at once — via REST API. Macro developers can implement graceful cancellation support.

Observability
Active macro executions are visible in real time, both via REST API and (on clustered setups) in the Confluence Clustering UI. A scheduled analytics job publishes execution statistics for monitoring.

Safe fallback
If the async thread pool is saturated (queue full or queue latency exceeded), macros fall back to synchronous execution automatically. No requests are dropped.

How to get started
This feature is disabled by default and requires administrator configuration:

1. Enable the dark feature atlassian.macros.async.execution in Confluence Dark Features

2. Use the REST API (PUT /rest/asyncmacros/latest/execution-controls) to configure which macros run asynchronously

3. Optionally tune thread pool and timeout settings via JVM system properties

Modernizing and Securing Plugin Data Storage

対象: 管理者

Removal of legacy structures for storing plugin data will secure Confluence for long term stability. After making these legacy systems read-only in Confluence 10.0, we have removed them entirely in Confluence 11.0. This includes the Removal of Bandana, and the removal of OpenSymphony PropertySet (osProperty). For security reasons, Confluence 11.0 will also no longer bundle the XStream library.

Direct access to the Bandana database table and OpenSymphony PropertySet will no longer be possible in Confluence 11.0. Please ensure all Apps that currently use Bandana are migrated to alternative storage (for example, Active Objects or SAL Plugin Settings) before upgrading to Confluence 11.

The BANDANA table is deprecated and will be removed automatically in a future release. You can drop it now by setting -Dconfluence.enable-drop-bandana-table=true before the upgrade. Back up the table before doing so if you want to retain the data.

Enhanced Security with New Content Security Policy

対象: 管理者

In Confluence 11, the content security policy (CSP) for the "script-src" directive has been introduced. The following adjustments apply:

1. eval の直接的および間接的な使用がすべてブロックされます。
2. すべてのインライン スクリプトがブロックされます。
3. 他のドメインから読み込まれるスクリプトは、CSP script-src ヘッダーを介して許可する必要があります。
4. インライン コードを含むスクリプト タグには、nonce 属性を含める必要があります。
5. 操作タイプが execute のキーボード ショートカットはサポートされなくなりました。

How is script-src CSP enabled

Confluence 11 enables this by default alongside existing policies. Only system administrators can disable this feature via the configuring of system properties:

http.header.security.content.security.policy.strictness.enabled

(e.g. -Dhttp.header.security.content.security.policy.strictness.enabled=false)

The CSP report-only mode is disabled when the property CSP is enabled (set to true).

There is also a system property http.header.security.content.security.scriptsrc.additional.urls that let admins to allow external scripts if they are needed.

Enhanced protection against SSRF

対象: 管理者

We’re introducing two security enhancements for Confluence, Jira Software, and Jira Service Management Data Center to strengthen protection against Server-Side Request Forgery (SSRF) attacks. These changes help block unauthorized outbound requests to sensitive destinations, ensuring your instance remains secure.

Key changes include:

• New default outbound denylist: We’ve added a built-in denylist that automatically blocks requests to dangerous destinations, such as cloud metadata services (AWS, Google Cloud, Azure), private networks, and insecure protocols (for example, file:// and shell://).

• Extended allowlist enforcement: Several platform components that previously bypassed the allowlist, including OAuth2, Gadgets, Webhooks, and the Universal Plugin Manager (UPM), now strictly follow your allowlist configuration.

• DNS resolution checking: The denylist now resolves domain names to their IP addresses to prevent bypass attempts via DNS rebinding.

These protections are enabled by default. They provide immediate security against SSRF attacks without requiring extra configuration. While you can disable the denylist using the -Dssrf.denylist.enabled=false JVM system property, we don’t recommend this for production environments.

While a denylist blocks known-dangerous destinations, we recommend configuring a comprehensive allowlist. An allowlist is the most effective defense against SSRF because it limits outbound requests only to the specific, trusted destinations your instance needs to function.

Custom HTML Editing Now Disabled by Default

対象: 管理者

To improve security, editing custom HTML is now disabled by default. If you need to enable custom HTML, set the confluence.custom.html.config.enabled system property to true. Only system administrators can enable this feature. How to configure system properties

Journal Index Queue Improvements

対象: 管理者

The content index queue is now processed fairly across content types instead of strictly in queue order. Entries are grouped by content type (pages and blogs, attachments, comments, user profiles, custom content, other). As a result, A bulk operation on one content type — a mass attachment upload, a space import — can no longer delay indexing of everything queued behind it. Queue depth per content type is shown on the Content indexing admin page.

This change applies to the content index journal (main_index) only; other journals keep the linear path.

To turn off the fair Index queue, disable the confluence.fair.journal.index.queue dark feature.

Concurrent Processing 

Due to the grouping of entries we can now process the entries in batches concurrently, increasing performance. A number of worker threads are made from the CPUs available to the JVM (capped at 50) and the index queue gives each worker at least 100 entries each to process.

To fall back to serial processing, disable the confluence.fair.journal.index.queue.parallel.processing dark feature — no restart is needed.

Standardize JNDI path validation

対象: 管理者

We’re standardizing how our products validate and use Java Naming and Directory Interface (JNDI) paths. Inconsistent checks across different products can sometimes allow crafted inputs to trigger unintended code execution. By unifying these validation processes, we're reducing the risk that a misconfiguration or an overlooked pathway could become a security entry point.

This change helps protect your data and ensures service reliability by aligning all products on a single, safe approach to JNDI lookups.

Platform Upgrades for Stability and Resilience 

対象: 管理者

We have been busy at work upgrading the Confluence 11 platform to set Confluence up for success in the long term. In most cases these changes are transparent. However, if you use Marketplace apps or custom in-house apps, ensure they are compatible with the new major version before upgrading. Some of the more notable changes can be seen below.

jQuery 4 への更新

すべての Data Center 製品を横断した jQuery バージョンに合わせるため、jQuery 4 にアップグレードしています。つまり、jQuery の古いバージョンを含む製品においては jQuery バージョンの大幅な引き上げが行われます。

Java 25 is now the minimum supported version

Starting from Confluence 11, Java 25 is the minimum supported version for both compile and runtime environments. At the same time, all components run on JDK 25.

React 19 へのアップグレード

We're upgrading to React 19 across all Data Center products to keep our frontend dependencies secure and compliant. This change ensures we can continue upgrading other critical frontend libraries in the future.

Modernize your outgoing network connections (HttpClient 5)

We're modernizing how our products make outgoing network connections by removing an older networking component that's no longer actively maintained: Apache HttpClient 4. This change reduces long-term security and reliability risks and ensures our technology remains supported and aligned with current standards.

Jakarta 11 and Spring 7 upgrade

We’re updating our Jakarta and Spring dependencies to continue meeting your demands for secure and compliant products. This change ensures we stay aligned with security policies and receive the latest updates. 

Upgrade to Jackson 3

We’ve upgraded the Jackson library to ensure your instance and apps are secure, compliant, and compatible with the latest industry standards.

For most customers, this change won't affect how you use your apps. However, if you use or develop extensions, take note of the following:

• We've notified Marketplace partners of this change. They're responsible for updating their apps to ensure continued compatibility.

• If you've developed custom, in-house apps or integrations, your development team must update the Jackson 2 libraries to version 3 in your codebase.

Logging Modernization to log4j2.xml

対象: 管理者

From Confluence 11.0, Log4j 1 configuration and API have been removed for security and modernization. As a result of this, the log4j.properties format will no longer be used and is replaced by log4j2.xml. Below are the affected files:

Up to 10.2.x

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j.properties

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j-diagnostic.properties

From Confluence 11.0

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j2.xml

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j2-diagnostic.xml

Any log4j.properties left in place after an upgrade is ignored, not merged. Confluence logs a warning at startup if it finds these log4j property files. If you customised logging, re-apply those changes to log4j2.xml when upgrading, then delete log4j.properties to silence the warning. Setting log levels at runtime through Logging and Profiling in the admin UI is unchanged.

Look and Feel Layouts and Customization Editing Now Disabled by Default

対象: 管理者

To improve security, configuring Look and Feel customization is now disabled by default. Admins can only view existing layout configurations. To enable look and feel customization, set the confluence.custom.look.and.feel.enabled system property to true. Only system administrators can enable this feature.

システム プロパティの設定方法

Restore From Local Drive Now Disabled by Default

対象: 管理者

To improve application security, restoring of data from local drives is now disabled by default. To enable restoring of data from local drive , set confluence.restore.from.local.drive.enabled system property to true. Only system administrators can enable this feature via the configuring of system properties.

Removal of support for transformed apps

対象: 管理者

We’re removing support for the transformed app format to improve the performance and reliability of Data Center products. Starting with this release, the Universal Plugin Manager (UPM) will no longer install or enable apps using this older format, and we’ve removed the infrastructure that converted these formats at startup. This change helps your instance start faster and reduces the risk of stability issues.

Before you upgrade, ensure your Marketplace apps are compatible with <product name+version>. If you use custom in-house apps, you must migrate them to the transformerless format. The following guides might help you in this process:

• How to automate the migration process

• More about identifying and converting plugins

V3 Attachment Storage Removal

対象: 管理者

Confluence 8.1 introduced the v4 attachment layout and a background migration that moved attachment data from ver003 to v4. Confluence 11.0 removes version 3 (ver003) attachment storage entirely: the storage implementation, the automatic V3 → V4 migration, and the related APIs.

Note that the V3 → V4 migration no longer runs in Confluence 11.0 and must have been completed prior to upgrading.

アップグレード ノート

• Confluence 11.0 will be supported only from the latest Confluence 10.2 release. You must first upgrade to the latest Confluence 10.2 release before upgrading to Confluence 11.0.

• Apps that currently use Bandana or OpenSymphony PropertySet (osProperty) must migrate to alternative storage (for example, Active Objects or SAL Plugin Settings) before upgrading to 11.0. For more information please see Preparing for Confluence 10.0.

• Transformed apps currently installed will be disabled when you upgrade to 11.0. Please upgrade the app to the "transformerless" format before upgrade, or contact your app vendor. More about identifying and converting plugins

• v3 Attachment storage is removed in Confluence 11.0, please ensure attachment migration to v4 is complete before upgrading to 11.0

サポート対象プラットフォームの変更

• Confluence Minimum Java version changed from Java 21 to Java 25

• Opensearch upgraded from 3.5 to 3.9, with support for OpenSearch 2 dropped

• Dropped support for the following Databases:

  • PostgreSQL 16

  • Aurora PostgreSQL 16

  • MS SQL Server 2019

  • Oracle 19c

インフラストラクチャの変更

Confluence 11.0.0 contains other changes that will affect apps. These include but are not limited to:

• Jsoup 1.22.2 Upgrade

• Frontend AMD and WRM Resources Removal

• JQuery plugins removal

• Removing Bundled Joda time

• Atlassian Keyboard Shortcuts Upgrade

For further details please see Preparing for Confluence 11.0