Highlights of 11.0.0-beta3

Released September 8, 2026

AUI 11

For: ADMINS

We’re introducing AUI 11 with the next major versions of our Data Center products, bringing a refreshed visual experience that aligns more closely with Atlassian Cloud. The update includes refreshed badges, banners, and application headers, a modernised icon set, and updated typography using Atlassian fonts and design system themes.

If you use Marketplace apps or custom in-house apps with a frontend, ensure they’re compatible with the new major version before upgrading.

Asynchronous Macro Execution

For: ADMINS

Confluence Data Center now supports asynchronous macro execution — a major performance capability that changes how macros are rendered on a page.

Previously, every macro on a Confluence page was executed sequentially on the same HTTP request thread. The browser couldn't receive the page until every last macro had finished — meaning a single slow macro (e.g. a Jira query or a blog-posts roll-up) could block an entire page load for all users.

With this release, macros can be configured to execute asynchronously and concurrently in a dedicated thread pool. The HTTP request thread is freed immediately, and macro results are assembled as they complete. For pages with multiple slow macros, this can dramatically reduce perceived load time.

Configuration required: Yes (opt-in per macro, admin setup)

Concurrent execution
Multiple macros on the same page can now execute in parallel rather than sequentially, significantly reducing total page render time.

Deduplication
If multiple users request the same page simultaneously, identical macro executions (same macro, same parameters, same content) can be deduplicated — one execution runs and its result is shared, avoiding redundant parallel work.

Configurable timeouts and rate limits
Administrators can set per-macro time limits and concurrency limits via the REST API, with global defaults configurable via JVM system properties. If a macro exceeds its time limit, Confluence can signal it to stop gracefully.

Result caching (opt-in)
Macro results can be cached per-user on each node, so repeat visits to the same page don't re-execute expensive macros. Cache TTL and size are configurable.

Execution cancellation
Administrators can cancel in-flight macro executions in real time — by execution ID, by macro name, or all at once — via REST API. Macro developers can implement graceful cancellation support.

Observability
Active macro executions are visible in real time, both via REST API and (on clustered setups) in the Confluence Clustering UI. A scheduled analytics job publishes execution statistics for monitoring.

Safe fallback
If the async thread pool is saturated (queue full or queue latency exceeded), macros fall back to synchronous execution automatically. No requests are dropped.

How to get started
This feature is disabled by default and requires administrator configuration:

1. Enable the dark feature atlassian.macros.async.execution in Confluence Dark Features

2. Use the REST API (PUT /rest/asyncmacros/latest/execution-controls) to configure which macros run asynchronously

3. Optionally tune thread pool and timeout settings via JVM system properties

Modernizing and Securing Plugin Data Storage

For: ADMINS

Removal of legacy structures for storing plugin data will secure Confluence for long term stability. After making these legacy systems read-only in Confluence 10.0, we have removed them entirely in Confluence 11.0. This includes the Removal of Bandana, and the removal of OpenSymphony PropertySet (osProperty). For security reasons, Confluence 11.0 will also no longer bundle the XStream library.

Direct access to the Bandana database table and OpenSymphony PropertySet will no longer be possible in Confluence 11.0. Please ensure all Apps that currently use Bandana are migrated to alternative storage (for example, Active Objects or SAL Plugin Settings) before upgrading to Confluence 11.

The BANDANA table is deprecated and will be removed automatically in a future release. You can drop it now by setting -Dconfluence.enable-drop-bandana-table=true before the upgrade. Back up the table before doing so if you want to retain the data.

Enhanced Security with New Content Security Policy

For: ADMINS

In Confluence 11, the content security policy (CSP) for the "script-src" directive has been introduced. The following adjustments apply:

1. All direct and indirect uses of eval are blocked.
2. All inline scripts are blocked.
3. Scripts loaded from other domains must be allowed via the CSP script-src header.
4. Script tags with inline code must include a nonce attribute.
5. Keyboard shortcuts with operation type execute are no longer supported.

How is script-src CSP enabled

Confluence 11 enables this by default alongside existing policies. Only system administrators can disable this feature via the configuring of system properties:

http.header.security.content.security.policy.strictness.enabled

(e.g. -Dhttp.header.security.content.security.policy.strictness.enabled=false)

The CSP report-only mode is disabled when the property CSP is enabled (set to true).

There is also a system property http.header.security.content.security.scriptsrc.additional.urls that let admins to allow external scripts if they are needed.

Enhanced protection against SSRF

For: ADMINS

We’re introducing two security enhancements for Confluence, Jira Software, and Jira Service Management Data Center to strengthen protection against Server-Side Request Forgery (SSRF) attacks. These changes help block unauthorized outbound requests to sensitive destinations, ensuring your instance remains secure.

Key changes include:

• New default outbound denylist: We’ve added a built-in denylist that automatically blocks requests to dangerous destinations, such as cloud metadata services (AWS, Google Cloud, Azure), private networks, and insecure protocols (for example, file:// and shell://).

• Extended allowlist enforcement: Several platform components that previously bypassed the allowlist, including OAuth2, Gadgets, Webhooks, and the Universal Plugin Manager (UPM), now strictly follow your allowlist configuration.

• DNS resolution checking: The denylist now resolves domain names to their IP addresses to prevent bypass attempts via DNS rebinding.

These protections are enabled by default. They provide immediate security against SSRF attacks without requiring extra configuration. While you can disable the denylist using the -Dssrf.denylist.enabled=false JVM system property, we don’t recommend this for production environments.

While a denylist blocks known-dangerous destinations, we recommend configuring a comprehensive allowlist. An allowlist is the most effective defense against SSRF because it limits outbound requests only to the specific, trusted destinations your instance needs to function.

Custom HTML Editing Now Disabled by Default

For: ADMINS

To improve security, editing custom HTML is now disabled by default. If you need to enable custom HTML, set the confluence.custom.html.config.enabled system property to true. Only system administrators can enable this feature. How to configure system properties

Journal Index Queue Improvements

For: ADMINS

The content index queue is now processed fairly across content types instead of strictly in queue order. Entries are grouped by content type (pages and blogs, attachments, comments, user profiles, custom content, other). As a result, A bulk operation on one content type — a mass attachment upload, a space import — can no longer delay indexing of everything queued behind it. Queue depth per content type is shown on the Content indexing admin page.

This change applies to the content index journal (main_index) only; other journals keep the linear path.

To turn off the fair Index queue, disable the confluence.fair.journal.index.queue dark feature.

Concurrent Processing 

Due to the grouping of entries we can now process the entries in batches concurrently, increasing performance. A number of worker threads are made from the CPUs available to the JVM (capped at 50) and the index queue gives each worker at least 100 entries each to process.

To fall back to serial processing, disable the confluence.fair.journal.index.queue.parallel.processing dark feature — no restart is needed.

Standardize JNDI path validation

For: ADMINS

We’re standardizing how our products validate and use Java Naming and Directory Interface (JNDI) paths. Inconsistent checks across different products can sometimes allow crafted inputs to trigger unintended code execution. By unifying these validation processes, we're reducing the risk that a misconfiguration or an overlooked pathway could become a security entry point.

This change helps protect your data and ensures service reliability by aligning all products on a single, safe approach to JNDI lookups.

Platform Upgrades for Stability and Resilience 

For: ADMINS

We have been busy at work upgrading the Confluence 11 platform to set Confluence up for success in the long term. In most cases these changes are transparent. However, if you use Marketplace apps or custom in-house apps, ensure they are compatible with the new major version before upgrading. Some of the more notable changes can be seen below.

Update to jQuery 4

We’re upgrading to jQuery 4 to align on jQuery versions across all Data Center products. This means a significant jQuery version uplift for products containing older versions of jQuery.

Java 25 is now the minimum supported version

Starting from Confluence 11, Java 25 is the minimum supported version for both compile and runtime environments. At the same time, all components run on JDK 25.

Upgrade to React 19

We're upgrading to React 19 across all Data Center products to keep our frontend dependencies secure and compliant. This change ensures we can continue upgrading other critical frontend libraries in the future.

Modernize your outgoing network connections (HttpClient 5)

We're modernizing how our products make outgoing network connections by removing an older networking component that's no longer actively maintained: Apache HttpClient 4. This change reduces long-term security and reliability risks and ensures our technology remains supported and aligned with current standards.

Jakarta 11 and Spring 7 upgrade

We’re updating our Jakarta and Spring dependencies to continue meeting your demands for secure and compliant products. This change ensures we stay aligned with security policies and receive the latest updates. 

Upgrade to Jackson 3

We’ve upgraded the Jackson library to ensure your instance and apps are secure, compliant, and compatible with the latest industry standards.

For most customers, this change won't affect how you use your apps. However, if you use or develop extensions, take note of the following:

• We've notified Marketplace partners of this change. They're responsible for updating their apps to ensure continued compatibility.

• If you've developed custom, in-house apps or integrations, your development team must update the Jackson 2 libraries to version 3 in your codebase.

Logging Modernization to log4j2.xml

For: ADMINS

From Confluence 11.0, Log4j 1 configuration and API have been removed for security and modernization. As a result of this, the log4j.properties format will no longer be used and is replaced by log4j2.xml. Below are the affected files:

Up to 10.2.x

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j.properties

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j-diagnostic.properties

From Confluence 11.0

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j2.xml

• <CONFLUENCE-INSTALL>/confluence/WEB-INF/classes/log4j2-diagnostic.xml

Any log4j.properties left in place after an upgrade is ignored, not merged. Confluence logs a warning at startup if it finds these log4j property files. If you customised logging, re-apply those changes to log4j2.xml when upgrading, then delete log4j.properties to silence the warning. Setting log levels at runtime through Logging and Profiling in the admin UI is unchanged.

Look and Feel Layouts and Customization Editing Now Disabled by Default

For: ADMINS

To improve security, configuring Look and Feel customization is now disabled by default. Admins can only view existing layout configurations. To enable look and feel customization, set the confluence.custom.look.and.feel.enabled system property to true. Only system administrators can enable this feature.

How to configure system properties

Restore From Local Drive Now Disabled by Default

For: ADMINS

To improve application security, restoring of data from local drives is now disabled by default. To enable restoring of data from local drive , set confluence.restore.from.local.drive.enabled system property to true. Only system administrators can enable this feature via the configuring of system properties.

Removal of support for transformed apps

For: ADMINS

We’re removing support for the transformed app format to improve the performance and reliability of Data Center products. Starting with this release, the Universal Plugin Manager (UPM) will no longer install or enable apps using this older format, and we’ve removed the infrastructure that converted these formats at startup. This change helps your instance start faster and reduces the risk of stability issues.

Before you upgrade, ensure your Marketplace apps are compatible with <product name+version>. If you use custom in-house apps, you must migrate them to the transformerless format. The following guides might help you in this process:

• How to automate the migration process

• More about identifying and converting plugins

V3 Attachment Storage Removal

For: ADMINS

Confluence 8.1 introduced the v4 attachment layout and a background migration that moved attachment data from ver003 to v4. Confluence 11.0 removes version 3 (ver003) attachment storage entirely: the storage implementation, the automatic V3 → V4 migration, and the related APIs.

Note that the V3 → V4 migration no longer runs in Confluence 11.0 and must have been completed prior to upgrading.

Upgrade notes

• Confluence 11.0 will be supported only from the latest Confluence 10.2 release. You must first upgrade to the latest Confluence 10.2 release before upgrading to Confluence 11.0.

• Apps that currently use Bandana or OpenSymphony PropertySet (osProperty) must migrate to alternative storage (for example, Active Objects or SAL Plugin Settings) before upgrading to 11.0. For more information please see Preparing for Confluence 10.0.

• Transformed apps currently installed will be disabled when you upgrade to 11.0. Please upgrade the app to the "transformerless" format before upgrade, or contact your app vendor. More about identifying and converting plugins

• v3 Attachment storage is removed in Confluence 11.0, please ensure attachment migration to v4 is complete before upgrading to 11.0

Supported platforms changes

• Confluence Minimum Java version changed from Java 21 to Java 25

• Opensearch upgraded from 3.5 to 3.9, with support for OpenSearch 2 dropped

• Dropped support for the following Databases:

  • PostgreSQL 16

  • Aurora PostgreSQL 16

  • MS SQL Server 2019

  • Oracle 19c

Infrastructure changes

Confluence 11.0.0 contains other changes that will affect apps. These include but are not limited to:

• Jsoup 1.22.2 Upgrade

• Frontend AMD and WRM Resources Removal

• JQuery plugins removal

• Removing Bundled Joda time

• Atlassian Keyboard Shortcuts Upgrade

For further details please see Preparing for Confluence 11.0