Jira 9.0 has a release candidate!

Hello again @dortiz,
TL;DR: No, the scripts should not stop working. We don’t plan to do any further changes in this area for the Jira 9 release (unless some serious bugs caused by these changes are reported; if that will be the case - we’ll communicate it broadly).

Some details:

All global variables (e.g. jQuery or AJS) and AMD modules (e.g. jira/flag) won’t be accessible on pages with deferred scripts.

For now we deferred scripts only on the pages mentioned in the Preparing for … document. If you don’t embed the scripts there - you won’t be affected. For now we don’t have plans to defer scripts on other Jira pages, so unless you do this on the pages defined by your App - you should be safe :slight_smile:
On the other hand - we encourage you to move the scripts that are not critical for rendering the content on your page to DEFER or INTERACTION phase as it should speed up the page rendering times for the users and make the perceived performance of your App and Jira faster.

New checkpoint promises are provided by Jira pages by default. However, if you create a new page, you’ll need to add them .

You only need to add them if you plan to use them. If not - no need to bother.

Thank you for raising your concerns - I’ll update the docs so they’re more precise.
I’ll be happy to answer more question if further clarification is needed.
Kind regards,

Hi @dortiz !

JS-generated HTML code does not undergo JSP nor Velocity Templates processing and therefore methods for accessing XSRF token described at Form token handling won’t work in this case.

What worked for me in a gadget was adding the following JS function to the gadget’s content:

function atl_token() {
    const tokenEl = parent.document.getElementById('atlassian-token');
    return (tokenEl && tokenEl.getAttribute) ? tokenEl.getAttribute('content') : undefined;

You’d use it like that:

str+="<form action=‘__ATLASSIAN_BASE_URL__/secure/CalculateCost!previous.jspa’ method=‘POST’ class=‘aui’…
str+=" <input type=‘hidden’ name='atl_token' value='"+atl_token()+"'/>"

kind regards,

I have the same issue, if this won’t be supported then how should we add a configuration page for custom fiels?

we have some strange behavior regarding our velocity files in Jira 9:

(1) Parsing Active Objects is not working anymore
For some AOs we have a structure like

import net.java.ao.Entity;
import net.java.ao.schema.NotNull;

public interface NamedEntity extends Entity

	public Timestamp getCreated();
	public void setCreated(Timestamp timestamp);

	public String getName();
	public void setName(String name);


public interface Template extends NamedEntity
	// Some other data we store

In our vm file we are then calling a method to get the Template object and then trying to parse $template.name. This is working just fine <Jira 9. But since Jira 9 it seems that we only can access variables/ getters from the Templates interface itself but not from the extended one because there will just nothing be parsed. This place remains empty in the final web page as if $template.name would return null. However, from debugging I could see that it is not null.
On the other hand, parsing plain Java classes (e.g. grabbing the ao from the db, transforming it into another Java object and using this one in the template) is still working fine.

(2) Not all statements are being processed
In addition, we have some methods in our Java file we call in the vm file (like $action.formatDate($template.created)). But this is not processed at all. Instead just this expression is printed as plain string to the web page. In the same vm file - some lines below - we are again calling this method again. But there it is processed and is throwing a NullPointer, since $template.created is null (even though from debugging I could see that it is not null, so same issue here as stated in (1)). Why is the expression one time ignored and one time processed?

Is somebody else experiencing strange behavior regarding vm files?
Thanks a lot!


I do have a problem related to web-panels on jira9, on jira8 are working correctly on jira9 when accessing directly the jira issue it is not filled, but during search or when I am already in the issue and when I access again to the same issue by clicking
then also It is loaded

Hi @TomaszPrus !

May we know the approximate release date?

Thank you!


Is somebody else experiencing strange behavior regarding vm files?

We see the same (AO entites unusable in velocity templates). It’s odd there is no mention of security restrictions on this page.

We are doing the same thing as you (use bean classes that allow readonly access to values ao objects). Gets messy with complex object graphs and one to manys etc.

Likely its a security related changes in the velocity Ubspector class that restricts access to classes, things got tightened up in the later 8 series releases JRASERVER-71685, more so now it seems.

Is there any news on this?

I’m a little concerned if we have to maintain two versions of each of our apps.

@TomaszPrus @RomanKolosovskiy @lvysochyn @FilipNowak @skorytnicki @GregRowinski


@TomaszPrus have there been unacnnounced changes to use of active objects via Velocity? It seems like it.

1 Like

@mike1 Since by now we didn’t find any official documentation on this issue, we implemented the following work around: We created a helper class with a method for every attribute we want to access in the vm file. We can then pass the ao to the method and get the data back. So sth like this:

public class UIHelper{
    public UIHelper() {}

	public int getID(Entity entity) {
		return entity.getID();
   // ...

This class is then instantiated in the WebAction java class and can be used like $helper.getID($someEntity) in the vm file.
Definetly not a nice solution but it works for now.
Maybe there will come some official announcement regarding that change with some guidance. But for the time being we will stick to that work around.

1 Like

Hi @adam.labus I tried the your solution to create a seperate module and include it to the plugin to resolve @SupportedMethods issue, but it is not working for me. Is there any working sample project to go trough? Also appreciate if you could mention what is the jira version you build you plugin against.

Hi @mohomedmifraz

Please built this maven project https://it-lab-site.atlassian.net/wiki/download/attachments/276725761/atlassian-security-request.zip?api=v2 using atlas-package. Now from the target directory in this project manually install atlassian-security-request-1.0.0.jar into your maven (Maven – Guide to installing 3rd party JARs) using the correct parameters


Now you can built this example maven project test-plugin.zip
In pom.xml you can see my dependency for Jira 7/8

              Workaround for Jira 7/8

With this workaround, I can build 1 plugin for Jira 7, 8 and 9 without any obstacles for @SupportedMethods

Of course, all my “JiraWebActionSupport” classes has now
@SupportedMethods ({RequestMethod.GET, RequestMethod.POST}) - even for Jira 7/8


1 Like

in our case we used 8.18.0 (as was downloaded for something else), in other words the pom of the new module looks like:




the main pom has the module:



and the module that uses It:


the version that I use for jira9 is 9.0.0-m0011

We also see this behavior in vm files starting Jira 9, most of our expressions/classes are not accessible but others, like ${issue.summary} or ${version.getName()} and a very few of ours are. We haven’t identified what makes a class accessible and would be very handy to know that in the release notes.

We have opted for the solution that @adam.labus has mentioned, we have created an independent project with the missing annotations and we have added the dependency in our apps (Projectrak and Exporter).

We truly believe that this is the best solution, in the future, we would only have to eliminate the dependency.

It seems that jira 9 is already here Jira Software 9.0.x release notes | Atlassian Support | Atlassian Documentation

We are now compatible with Jira 9, thanks to the Atlassian’s that helped us along the way as we asked questions and fed back bugs.

Personally I found the updating of existing threads for new releases to be very confusing, I do not get notified when the content of the initial post changes, if I was relying purely on CDAC I do not think we would have been able to keep track of changes.

On my team, we just monitor the contents of Atlassian’s Maven repository to see when new milestones release, this isn’t ideal but it allowed us to keep up to date this time around.


@andre.fernandes.rodr , did you find a fix for this?


Thanks for responding


Pada tanggal Kam, 23 Jun 2022 09.55, Paul Clark via The Atlassian Developer Community <notifications@atlassiandeveloper.discoursemail.com> menulis:

Hi, has anyone found out the reason why active objects stopped working in Jira v 9?