Hi everyone, A Confluence 11.0 EAP milestone is now available. EAP releases provide a snapshot of our work in progress and give you an opportunity to test and fix your apps before the final release. During the development of Confluence 11.0, we’ll release monthly milestones and betas. To find out …

Yes unfortunately it seems this way… I hope Atlassian will find a solution that still makes it safe but allows us Marketplace Vendors to use state of the Art Browser APIs :blush:

Hi, Regarding the use of unsafe-eval, we do not plan to add that property. For the scenario you described, the recommended approach is to consult the Google Charts team and request a safer version of the library. Additionally, could you provide the specific code paths that invoke eval and new func…

Hi @adam.labus Could you describe the scenario that could only be addressed by data providers for obtaining a nonce value, and that cannot currently be resolved using existing mechanisms? At present, we do not intend to expose the nonce value through data providers.

Hi @AndreaSerra Regarding the inclusion of the wasm-unsafe-eval property, Confluence will not ship with this property enabled by default for all users and also not allow to add this using CSPFragment. Instead, we will offer a system property that allows Confluence administrators to activate it if n…

[image] HimanshuTanwar: Could you describe the scenario that could only be addressed by data providers for obtaining a nonce value, and that cannot currently be resolved using existing mechanisms? At present, we do not intend to expose the nonce value through data providers. Hi @HimanshuTanw…

Hi The error message suggests you are using a new Blob to load the service worker code. If so, try replacing it with a JavaScript file with a web resource entry. This way, the URL won’t be dynamic, and you won’t need to create a CSP fragment.If you are loading the code some other way then please sh…

Hi sandeep, Thanks for the info. I was already on my way of doing so. Sometime ago that blob approach made sense. But I already found a solution that might work, I will report here once I got it implemented and tested. Cheers Bernhard

Thanks @HimanshuTanwar for the answer. What’s the WASM-specific threat model behind the decision? W3C CSP3 split unsafe-eval and wasm-unsafe-eval because they describe different capabilities. unsafe-eval turns strings into live JS in the origin. wasm-unsafe-eval compiles static bytes into sandboxe…

Hi Atlassian Team, How can we handle adding “nonceId” to scripts embedded in VM files in web panels? atlassian-plugin.xml <web-panel key="custom-confluence-web-panel-resources" name="custom-confluence-web-panel-resources" location="atl.header" weight="10"> <context-provider class="com.itlab.c…

Hi @AndreaSerra , @adam.labus , in reference to deferred or lazy loading static resources above: The previous solution didn’t require us to load additional files per page (web-resource in editor context). Unfortunately, now we have to prepare them in advance and add them to almost every page load…

The Atlassian Developer Community

Confluence 11.0 release EAP available now

Confluence Development

ggautam May 28, 2026, 4:34am 30

Answered here: Major release updates for Data Center - #5 by ggautam