Velocity allow list / what to add to my atlassian_plugin.xml

From my ContextProvider class I am adding objects to the context map, so that I can use these objects in my velocity template. But starting with Jira 10.5 I can only use primitive types like String as parameter. I cannot use arrays for examples, which I added to the context, e.g.

#foreach( $projectroledetail in $projectroledetails )

ProjectRoleDetails is of type Collection (actually TreeSet). ProjectRoleDetails is a bean with attributes and get methods.

Is there possibility to reenable this, so I can use collections and custom objects? Can I use the velocity allow list plugin module?

Best regards, Holger

Yes, you have to use the Velocity Allowlist plugin module.

Have a look at the log file while using your ContextProvider. There should appear some log entries regarding blocked methods. You can then simply copy and past those methods into your Allowlist.

Thank you! Found it in atlassian-jira.log, e.g.

2025-09-28 15:03:53,112+0200 http-nio-2990-exec-3 WARN admin 903x4358x1 13799m5 0:0:0:0:0:0:0:1 /projects/CMTP [velocity] Invocation blocked as method is not allowlisted: jira.plugin.projectroletab.ProjectRoleDetails#getGroups()