RFCs are a way for Atlassian to share what we’re working on with our valued developer community.
It’s a document for building shared understanding of a topic. It expresses a technical solution, but can also communicate how it should be built or even document standards. The most important aspect of an RFC is that a written specification facilitates feedback and drives consensus. It’s not a tool for approving or committing to ideas, but more so a collaborative practice to shape an idea and to find serious flaws early.
Please respect our community guidelines: keep it welcoming and safe by commenting on the idea not the people (especially the author); keep it tidy by keeping on topic; empower the community by keeping comments constructive. Thanks!
Project summary
We’re planning several security and accessibility updates for the AUI 10 library coming to Jira Software 11, Jira Service Management 11, Confluence 10, Bitbucket 11, Bamboo 11, and a Crowd version to be released by the end of FY25. We’re still working out the details but wanted to share our plans with you early to give you time to prepare and provide your input. As we continue to work on these changes, we’ll share EAPs and more upgrade guidance.
It’s important that you start preparing now wherever possible and/or replace your AUI usage with Atlaskit.
Problem
AUI contains some outdated components with design and accessibility issues that negatively impact the user experience. We’ve already provided fixes or replacements for the affected components, but their outdated versions remain in the library. Removing them will allow us to create a smaller library we can maintain more efficiently.
AUI is also built on outdated dependencies that are no longer maintained and have open security issues with even more of them likely to appear in the future.
Solution
Internal dependency upgrades
We’re upgrading some outdated internal dependencies, although in future AUI versions we may need to upgrade dependencies again or replace them. This is an example list of the dependencies we’re targeting:
We’ll upgrade to the latest available versions of these components, so the final list may change.
npm: select2 upgraded from 3.5.4 to 4.0.13+ This upgrade will ensure better jQuery 3 compatibility. With it being broken up into plugins, we’re currently leaning towards including everything but we’re interested in hearing your thoughts.- npm: dompurify upgraded from 2.5.7 to 3.1.6+. This dependency is used internally on the tooltip titles. Don’t reuse the version under the hood.
- npm: jquery-form upgraded from 2.67 to 4.3.0+. This upgrade will ensure better jQuery 3 compatibility.
Component removals
We’re removing components for which we’ve provided replacements. Make sure to move to their new versions or migrate to Atlaskit.
Here’s the list of the components we’re removing:
While it’s unlikely, we might also remove the following components:
- Dialog1 - replaced by Dialog2
- InlineDialog1 - replaced by aui-inline-dialog
Deprecations and removals
We’re also deprecating or removing the following:
- Template - AUI Documentation - we’re moving to Soy or the I18n system as appropriate. This is so we can better support fewer languages with tools and prevent security issues from arising from a homebrewed templating language.
- Dark mode (old) - AUI Documentation - we’re removing the old unused dark theme since we’ve introduced a new one. If you’ve followed our recent guide (Prepare your Data Center app for the dark theme) to prepare for dark theme by using design tokens, you should be all set.
- Original theme - since the “light” theme is replacing it, all the fallback values will be gone.
- Redundant polyfills that are now natively supported in browsers, for example npm: css.escape, custom events, and the
<input>placeholder. - npm: @atlassian/tipsy - this is no longer maintained and the AUI library stopped using it internally from version 9.3. You can bundle it if you wish, but we’d recommend moving to Floating UI - Create tooltips, popovers, dropdowns, and more or using Atlaskit or AUI components where possible.
- npm: trim-extra-html-whitespace - this is no longer maintained and only used internally in our public documentation. This shouldn’t be needed in the browser. You can bundle it if you wish, but we recommend finding a maintained HTML minifier.
- Very low usage (likely redundant) Soy templates, web-resources (many have just been renamed), and CSS. We first have to analyze this to come up with an exact list.
Other changes
- Node 22 engine requirement - this will only affect using AUI via NPM, not through the running product. This is so we can upgrade our development tooling and better reflect that we’re already targeting a higher EcmaScript language level.
Asks
While we’re happy to get any feedback on this RFC, we’re particularly hoping to get insights on:
- Anything you’d like to see to make the migration easier.
- Any hard blockers to migration you find.