# Preparing for Confluence 9.0 - EAP out now **URL:** \ **Category:** Confluence Data Center Announcements\ **Tags:** announcement, platform-7, eap, confluence-data-center, data-center\ **Created:** [January 11, 2024, 10:59pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160 "2024-01-11T22:59:44Z")\ **Posts on this page:** 20\ **Page:** 13
**Author:** ![scott.dudley](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/scott.dudley/32/53884_2.png) [@scott.dudley](https://community.developer.atlassian.com/u/scott.dudley)\ **Post date:** [May 27, 2024, 1:47pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/246 "2024-05-27T13:47:33Z")
Hi @m.frank, If you’re still stuck trying to find the source of the banned import, you can follow the steps I posted [here](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/10) to debug the build process and see exactly where the OSGi package reference is being picked up. And if it’s not found at build time (meaning the banned package is not listed in your META-INF/MANIFEST.MF) and the error only occurs at runtime when loading your plugin, then you need to double-check that you don’t have any ``s whatsoever hidden somewhere in your .JAR, in a nested .JAR, or somewhere in an .OBR. ---
**Author:** ![aorlov](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@aorlov](https://community.developer.atlassian.com/u/aorlov)\ **Post date:** [May 27, 2024, 4:42pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/248 "2024-05-27T16:42:28Z")
I agree. The current state of this solution is really hard to maintain. I tried to use " Allowlist method invocations within your Velocity templates" in my addon and I should do so many duplicates. I have one DTO, but should declare every method. ```auto com.example.my.SomeDto#methodOne() com.example.my.SomeDto#methodTwo() com.example.my.SomeDto#methodThree() com.example.my.SomeDto#methodFour() com.example.my.SomeDto#methodFive() com.example.my.SomeDto#methodSix() com.example.my.SomeDto#methodSeven() ``` Will be the better approach in the future? Another bad part: If I add new property to my DTO then I should remember to add this in my `atlassian-plugin.xml` or it won’t work in velocity. I hope, that Atlassian will provide some alternative in the future. Maybe declare via annotations on the class? Or tag `class`? ---
**Author:** ![scott.dudley](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/scott.dudley/32/53884_2.png) [@scott.dudley](https://community.developer.atlassian.com/u/scott.dudley)\ **Post date:** [May 27, 2024, 5:30pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/249 "2024-05-27T17:30:48Z")
@GorkaGalloBustinza > I’m having Velocity method invocations blocked even though I have them allowlisted in the descriptor file. This happens in m97 but not in the previous milestong. Has anything changed? I just spent an hour trying to track down a similar problem. It looks like m97+ validates the entire `` module, and if there is an error in any single method name, the entire allowlist will be disabled. Look for log entries like this during plugin load: `WARN [allowlist.impl.internal.PluginAllowlistConfigurator] getModuleMethodAllowlist Invalid method(s) METHODNAME defined for class CLASSNAME- disabling Velocity Allowlist plugin module YOURMODULE` In my case, I had one method parameter that was accidentally a `long` and not a `Long`, which are represented separately in the allowlist (`long` vs `java.lang.Long`). As an aside, while debugging this, I discovered that `` seems to support `` and `` elements, in addition to the documented `` element. I have not tried these. ---
**Author:** ![GorkaGalloBustinza](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/gorkagallobustinza/32/52186_2.png) [@GorkaGalloBustinza](https://community.developer.atlassian.com/u/GorkaGalloBustinza)\ **Post date:** [May 28, 2024, 5:56am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/250 "2024-05-28T05:56:13Z")
This is still on going according to [Preparing for Confluence 9.0 | Confluence Data Center 8.9 | Atlassian Documentation](https://confluence.atlassian.com/doc/preparing-for-confluence-9-0-1333827518.html), so hopefully they will provide a guide when it’s ready about how to proceed and which is the best way. Thx! ---
**Author:** ![adam.labus](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/adam.labus/32/39809_2.png) [@adam.labus](https://community.developer.atlassian.com/u/adam.labus)\ **Post date:** [May 28, 2024, 6:27am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/251 "2024-05-28T06:27:48Z")
Hi Guys, **EDIT** : however, this problem also affects some built-in resources ![Screenshot 2024-05-28 at 09.35.47](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/d/b/db851a7e014c196db3dc3c69dba02db78c3b1254.png) In recent versions of Confluence 9 (also the last one), some of our resources (JS) randomly do not load in Chrome with the error ERR\_INVALID\_CHUNKED\_ENCODING. These scripts are loaded dynamically depending on what is executed in the application GUI by loading them on demand. The same files opened in a new tab load correctly. The same scripts in Confluence 8 work correctly every time and the above problem does not occur. Everything tested on the same network and the same machine. Has anyone encountered such problems? Cheers ---
**Author:** ![Kusal](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/kusal/32/46420_2.png) [@Kusal](https://community.developer.atlassian.com/u/Kusal)\ **Post date:** [May 28, 2024, 7:52am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/252 "2024-05-28T07:52:19Z")
Confirming that Velocity Allowlist development is still in progress and formal developer documentation will be available once complete. ---
**Author:** ![kmacleod](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/kmacleod/32/49635_2.png) [@kmacleod](https://community.developer.atlassian.com/u/kmacleod)\ **Post date:** [May 28, 2024, 9:23am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/253 "2024-05-28T09:23:06Z")
This is correct. Confluence 9 and Platform 7 are both compiled targeting Java 17 bytecode. If you compile against that version, the resulting classes can only be used on Java 17. If you need to generate artefacts that work on Java 11 and older Confluence versions, you’ll need to compiler against those older versions. Generally, you’ll get better results compiling against your oldest supported Confluence version, and testing against the newer ones. If your app compiles against Java 11 and Confluence 7/8, the class files will still work on Java 17. ---
**Author:** ![kmacleod](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/kmacleod/32/49635_2.png) [@kmacleod](https://community.developer.atlassian.com/u/kmacleod)\ **Post date:** [May 28, 2024, 9:28am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/254 "2024-05-28T09:28:47Z")
The `com.octo` packages are no longer exported from the OSGi system bundle as of Confluence 9.0, as you’ve noticed. This shouldn’t be a problem, though, unless your app is trying to use those classes that you listed, which do depend on `com.octo`, in which case it’ll transitively pull it in (or try to). I can’t think of any other reason why this would happen. ---
**Author:** ![m.frank](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/m.frank/32/55407_2.png) [@m.frank](https://community.developer.atlassian.com/u/m.frank)\ **Post date:** [May 28, 2024, 2:35pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/255 "2024-05-28T14:35:59Z")
Hey @kmacleod, thanks for the response. I checked again against the classes, that are using the `com.octo` dependency and **finally** found the place that is causing the issue. We are using the `com.atlassian.confluence.pages.actions.ViewPageAction` what imports the `com.atlassian.confluence.security.CaptchaManager`, what is using the `com.octo.captcha.service.image.ImageCaptchaService` import. However, I think the solution would be, to include the `com.octo` dependency into my pom and compile it, right? So that’s what I wanted to try, but the problem is, that `com.octo` has a high vulnerability and is depending on an import `com.sun.image.codec.jpeg` from Java 7. So it is still not possible to install it on Confluence 9. Any suggestions here? Should I use something else instead of the `ViewPageAction` class? Thanks! ---
**Author:** ![scott.dudley](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/scott.dudley/32/53884_2.png) [@scott.dudley](https://community.developer.atlassian.com/u/scott.dudley)\ **Post date:** [May 28, 2024, 3:09pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/256 "2024-05-28T15:09:33Z")
@m.frank You cannot generally package something that is already included in the system bundle, because you will end up with two different versions of the same class and (at best) ClassCastExceptions whenever something references it. Also, Spring Scanner OSGi imports do not pull in classes transitively, meaning you need to directly use a method before the referenced classes will be listed in the imports. So, if you’re using one of the referenced classes from a banned package directly, then you need to find a way to stop doing that. If you are not, then you have a different problem. In the latter case, your next step for debugging is to check the `META-INF/MANIFEST.MF` after a build to see if the banned package is listed there. If it is listed there, see my [above post](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/246) about adding debug breakpoints to Maven, and use that to figure out exactly where the reference came from within your code, and fix that code. If it is not listed in the `MANIFEST.MF`, then you either have a `` that you forgot about, or else your plugin is not 100% properly configured as a transformerless plugin which causes it to be transformed anyway (meaning you need to double-check all of the Spring Scanner configuration instructions). The transformation process _does_ include all transitive dependencies, but they are added at runtime, so you will still see those types of errors even if the dependency is not listed in your `MANIFEST.MF`. (Atlassian should really just modify the plugin system to refuse to load any requires-transformation plugin, because none of them will work in Platform 7 anyway due to the banned dependencies.) ---
**Author:** ![m.frank](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/m.frank/32/55407_2.png) [@m.frank](https://community.developer.atlassian.com/u/m.frank)\ **Post date:** [May 29, 2024, 7:32am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/257 "2024-05-29T07:32:03Z")
Hey @scott.dudley, thanks for the support. I love your post about debugging the Analyzer class! I’ll definitely document it internally for future problems too 😃 However, also with debugging there, I was not able to find the `com.octo` import. But with the hint from @kmacleod, I was finally able to find where it comes from. As I mentioned in my other post, it’s related to the `ViewPageAction` class, we extend. To be honest, I do not completely understand how this should work now? I think there is no alternative for us to this class to extend from, and how can Atlassian use it in their `CaptchaManager` class, without providing the dependency (also with the dependency that depends on Jira 7 imports)? - is this working because of the last thing you mentioned, that Atlassian adds the dependencies at runtime? However, for now, I commented the part out, where we extend from this class, just to be able to skip this error for now, and “having fun” with the next upcoming errors. Thank you! ---
**Author:** ![kmacleod](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/kmacleod/32/49635_2.png) [@kmacleod](https://community.developer.atlassian.com/u/kmacleod)\ **Post date:** [May 29, 2024, 8:14am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/258 "2024-05-29T08:14:52Z")
I’ve had a dig around in `ViewPageAction`, and the `CaptchaManager` field was only in there for historical reasons, so I’ve removed it, which should fix your immediate problem when the next EAP comes out. More generally, though, using `ViewPageAction` in your own plugin is going to be brittle, since that class (and most of the other action classes) are not intended for re-use outside Confluence core. ---
**Author:** ![m.frank](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/m.frank/32/55407_2.png) [@m.frank](https://community.developer.atlassian.com/u/m.frank)\ **Post date:** [May 29, 2024, 8:46am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/259 "2024-05-29T08:46:23Z")
Hey @kmacleod, nice to hear that! Looking forward to the next EAP then 🙂 Ok, thanks for the hint. We will investigate, if we can get rid of it in the future. ---
**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\ **Post date:** [May 29, 2024, 11:19am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/260 "2024-05-29T11:19:39Z")
Hello I’m trying to run one of our apps the first time on Confluence 9. I get this OSGI error I do not understand: ```auto Caused by: org.osgi.framework.BundleException: Unable to resolve ch.mibex.confluence.include [303](R 303.0): missing requirement [ch.mibex.confluence.include [303](R 303.0)] osgi.wiring.package; (&(osgi.wiring.package=bucket.user)(version>=9.0.0.m97)(version<=9.0.0.m97)) Unresolved requirements: [[ch.mibex.confluence.include [303](R 303.0)] osgi.wiring.package; (&(osgi.wiring.package=bucket.user)(version>=9.0.0.m97)(version<=9.0.0.m97))] ``` What bundle it actually cannot resolve? `osgi.wiring.package` or `bucket.user` In my manifest there is not import for both of these packages, so I am very confused what it is complaining about? ---
**Author:** ![EliasBrattliSorensen](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/eliasbrattlisorensen/32/41934_2.png) [@EliasBrattliSorensen](https://community.developer.atlassian.com/u/EliasBrattliSorensen)\ **Post date:** [May 29, 2024, 11:25am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/261 "2024-05-29T11:25:59Z")
@RomanStoffel I believe it’s referenced transitively from `com.atlassian.confluence.user`, which extends the package. Maybe it’s depending on how your imports are constructed with resolution and version? ---
**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\ **Post date:** [May 29, 2024, 11:33am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/262 "2024-05-29T11:33:44Z")
The things which seem user related imports in the manifest of our are `com.atlassian.user` and `com.atlassian.sal.api.user`. They seem to be exported? How can we debug / find out these issues? Because for me this `bucket.user` comes from no-where. ---
**Author:** ![EliasBrattliSorensen](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/eliasbrattlisorensen/32/41934_2.png) [@EliasBrattliSorensen](https://community.developer.atlassian.com/u/EliasBrattliSorensen)\ **Post date:** [May 29, 2024, 11:35am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/263 "2024-05-29T11:35:12Z")
@RomanStoffel Check our some earlier comments about the same package like this one: [Preparing for Confluence 9.0 - EAP out now - #43 by AndreasEbert](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/43). Could it be you’re using old component-import tags and not spring scanner? ---
**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\ **Post date:** [May 29, 2024, 11:44am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/264 "2024-05-29T11:44:15Z")
Ok this looks similar to @AndreasEbert issue. I still do not understand how the mechanism works though. There is nothing in the manifest. In his post he mentioned that he can see the difference in some imports. Basically, what I’m curious about: How can I see the ‘real imports’, if somehow stuff is sneaked in by magic? Because again, that `bucket.user` does not show up in the generated OSGi manifest. So there is some secret mechanism in OSGi / or Atlassian which adds stuff? Is so, how can I inspect that? ---
**Author:** ![EliasBrattliSorensen](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/eliasbrattlisorensen/32/41934_2.png) [@EliasBrattliSorensen](https://community.developer.atlassian.com/u/EliasBrattliSorensen)\ **Post date:** [May 29, 2024, 11:45am UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/265 "2024-05-29T11:45:34Z")
Check out this comment @RomanStoffel: [Preparing for Confluence 9.0 - EAP out now - #10 by scott.dudley](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/10). You can debug the maven & osgi build process, maybe that will give you some answers. ---
**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\ **Post date:** [May 29, 2024, 12:18pm UTC](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160/266 "2024-05-29T12:18:59Z")
Ok: Yes, there is some mechanism which transforms / edits the plugin OSGi bundle. I was not aware of that. Is that documented somewhere? Basically, if you install the app, the app will be transformed and put into {confluence}/home/plugins-osgi-cache/transformed-plugins/{your-plugin-with-some-extra-timestamps}.jar. If I open that .jar and inspect the manifest, then I have a gazillion extra imports, including the `bucket.user`. I’ll switch to the Spring Config things and I see =). Or is there a way to opt out of any OSGi manifest manipulation? Update: Trying to switch to Spring Java configuration. But I’m getting unexpected exceptions, see [here](https://community.developer.atlassian.com/t/importing-globalsettings-resulting-in-java-lang-classnotfoundexception-org-springframework-cglib-proxy-factory/80399). Unrelated to Confluence 9 itself, but it blocks me from progressing with Confluence 9 itself. [Previous page](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160.md?page=12) [Next page](https://community.developer.atlassian.com/t/preparing-for-confluence-9-0-eap-out-now/76160.md?page=14)