This post is about the previous (rc3) version. For the changes in the newest one (rc5) look here
We are pleased to announce the availability of the Bamboo Data Center 10.0 Early Access Program (EAP) release.
This EAP release allows partners and customers who have written in-house apps to update their apps before the public release of Bamboo 10.0.
Due no earlier than Aug 14, 2024, Bamboo 10.0 is our next platform release and will contain breaking changes.
Important things to note about this EAP release:
- Do not use this EAP release in production environments. For all production use and testing of Bamboo, use the latest official release 9 instead.
- The general availability release is still underway and may contain some minor API changes. However, this EAP release is intended to contain a complete picture of Bamboo 10.0ās API.
Using the EAP
EAP is available for download as a zip archive for Windows x64 and tar.gz archive for Linux. For installation instructions, refer to documentation.
Overview of changes in the EAP
Supported platform changes
With this release, both Bamboo DC Nodes and Agents require Java 17. Support for running on Java 11 has been removed.
Bamboo 10.0 also removes support for the following platforms:
- Repositories:
- Perforce
- Database:
- Postgres 12
- Oracle 18c
Dark theme
Bamboo 10.0 features both dark and light themes to offer a modern visual experience.
To experiment with new themes, select your profile avatar on the upper right of the screen, and under Themes choose the needed option. Note that although the Original theme is currently accessible, there are intentions to phase it out in upcoming releases.
Additionally, the look and feel will not apply color choices to both themes. If your instance uses a custom header color, it will default to the light theme.
If your app incorporates visual elements, developers should check our guidelines for preparing your Data Center app for the dark theme, while designers should explore how to utilize tokens.
Platform 7 upgrade
Bamboo 10.0 includes an upgrade to Atlassian Platform 7. This upgrade puts us in a better position to respond to security changes with reduced disruption and breaking changes for your apps.
As part of this work, we have:
- upgraded numerous Atlassian and third-party components to benefit from the latest security patches and bug fixes
- removed āgray APIsā (unsupported third-party and cross-product libraries with their dependencies).
- reduced public JAVA API in Atlassian Plugins, WRM, Web Fragments, and LESS
Read more about how to prepare for the Platform 7 upgrade here.
REST v2
Platform 7 and Bamboo 10.0 have rearchitected the Java APIs used to implement REST resources, which weāre calling REST v2.
Note that this isnāt a change to Bamboo REST API, which remains largely unchanged. These changes will only impact app developers. The underlying libraries, Jackson and Jersey, have been upgraded to the latest versions. REST v2 also makes use of JAX-RS 2.
The REST v2 upgrade guide contains advice and examples on how to upgrade your app to use REST v2.
Endpoint default security annotations
Weāve enabled better control access to endpoints with new annotations. From Bamboo 10.0, only licensed users can access resources without specified access criteria annotations. Make sure you review:
@AdminOnly
@AnonymousSiteAccess
@LicensedOnly
@SystemAdminOnly
@UnlicensedSiteAccess
@UnrestrictedAccess
Reviewing these will ensure that the intended users can access your application endpoints. You may need to make changes to endpoints such as Struts Actions, Filters, Servlets, and REST resources.
Visit Prepare your Data Center app to comply with secure endpoint defaults for full details.
For development or testing purposes, this new behavior can be disabled by setting
bamboo.security.endpoint.annotation.default.to.licensed.access
property to false. This flag may be unavailable in the later releases and is not recommended for production environments.
WebSudo support
Bamboo 10.0 adds support for WebSudo to further protect admin pages against malicious access. This feature creates an extra layer of protection by prompting admins to re-enter their passwords to access administrative functions. Apps can opt into web sudo by adding the @WebSudoRequired
annotation to REST APIs that require admin access. Similarly, servlets that require admin access should call WebSudoManager.enforceWebSudoProtection
. More details can be found on Adding WebSudo support to your app.
Struts security improvement
Bamboo 10.0 removes support of Struts Dynamic Method Invocation feature. It affected few links which used to pass method name as part of URL in format strutsAction!method.action, most visible change is related to userlogin!doDefault.action
link which was changed to userlogin.action
.