What’s new in Eficode ROOT: September 2026

Bitbucket advances to version 10.2. This step brings modern code-collaboration tooling into everyday use and keeps the environment aligned with current, fully supported Atlassian releases. For teams, it means a faster and more dependable path from opening a pull request to getting it merged. Merge queues now sequence and validate changes automatically, so pull requests land cleanly without breaking the main branch, and default reviewer groups make sure the right people are attached to every review without anyone having to remember to add them. Reinforcing all of this, the underlying Platform 8 upgrade improves performance and consistency across the entire Atlassian stack, giving every connected tool a steadier foundation.

Deprecations and removals

Client Web Fragments removal

Client Web Fragments have been retired and largely succeeded by Client Side Extensions (CSEs). To continue extending app functionality on these pages, transition to the React-based CSE framework. Learn more here.

End of support for the Original theme

With the new light and dark themes that brought accessibility and usability improvements, we’re removing the original theme from all products.

Upcoming Jira REST API changes

The Jira search REST APIs are scheduled for deprecation in December 2027. To maintain uninterrupted service and compatibility, integrations must be transitioned to the newly available Jira API endpoints.

The updated Jira search endpoints are already supported in Bitbucket Data Center versions 10.0.0+, 8.19.22, and 9.4.10.

We recommend reviewing the enhanced search API documentation early to prepare your integrations and prevent operational disruptions. Learn more here.

Responsive pull requests on mobile

Bitbucket enhanced the mobile pull request experience to be fully responsive, allowing you to manage the complete PR lifecycle directly from your mobile device without needing a desktop setup.

Mobile features now include:

• Reviewing PR diffs seamlessly via an optimized interface

• Engaging in team conversations by commenting

• Approving or declining pull requests on the go

These updates help prevent review bottlenecks and support continuous progress wherever you are working.

Supported Display Resolutions:

• Mobile devices: 480px and above

• Tablets: 768px and above

Learn more here. 

Merge queues

Merge queues maintain the stability of critical target branches when managing multiple incoming pull requests. Rather than merging pull requests directly, they are placed into a queue where Bitbucket automatically validates the consolidated changes prior to landing.

Key advantages of merge queues include:

• Preventing breaking changes resulting from conflicting pull requests

• Ensuring core branches remain in a reliable, passing state

• Streamlining merge workflows across high-activity repositories

Learn more here. 

Development information backfill to Jira Software Cloud 

Historical pull request development data can now be backfilled directly to linked Jira Software Cloud instances. In earlier versions, synchronization was limited strictly to new activity. Learn more here.

Manage your integrations and automations with service accounts

Automated tasks and external integrations can now be managed efficiently through dedicated service accounts. These non-user accounts enable secure REST API interactions via OAuth 2.0, allowing custom scripts and tasks to execute while preserving strict access controls. Comprehensive tracking logs every action executed by a service account, ensuring clear operational visibility.

Setting up a service account:

1. Navigate to Administration > User management, then choose Service accounts from the sidebar navigation.

2. Click Create service account.

3. Complete the configuration steps to define the required details, scopes, and target resources.

4. Generate the corresponding OAuth 2.0 authentication credentials.

5. Verify all details and securely store the generated credentials in a safe location.

Learn more here.

Connect securely with OAuth 2.0 for app links

OAuth 2.0 support is now available for application links (app links) across Atlassian Data Center products. As an industry-standard authentication protocol, OAuth 2.0 provides a secure, modern, and highly reliable framework for connecting Atlassian environments with external applications. Reach us and we will enable it for you! 

Refreshed Source view for a consistent experience

The Source view has been redesigned using the newest Atlaskit and custom React components to harmonize with the rest of the application. This update delivers a sleek, uniform interface, elevating readability and streamlining code reviews. Learn more here.

The Look and Feel app is now integrated

The Look and Feel functionality is now natively built into Bitbucket Data Center. This native integration allows you to tailor the appearance of your Bitbucket environment without requiring a separate app installation. Directly within the administration settings, you can now adjust logos, color schemes, and additional branding components to seamlessly reflect your organization's visual identity.

Bitbucket has refreshed color accessibility

Bitbucket now features an upgraded full-color accessibility mode. Designed to support individuals with color vision deficiencies, this enhancement ensures a more inclusive navigation experience across the platform. Users affected by protanopia will notice greens shifted to blues and reds to oranges, whereas the new tritanopia mode transitions blues to greens and yellows to oranges.

By introducing these options, Bitbucket strengthens its commitment to accessibility, empowering every team member to work efficiently and comfortably.

To turn on color accessibility, navigate to Profile > Accessibility settings and select your preferred mode. Learn more here.

Instance health checks are now available

This release introduces the Instance Health feature, delivering real-time visibility into the status and stability of your environment. System health is continuously evaluated to detect potential issues early, enabling proactive intervention before workflows are disrupted.

Dedicated checks now monitor key areas, including certificate expiration, application link client credential validity, and security vulnerabilities. These diagnostics are accessible directly from the Instance Health tab within Troubleshooting and Support Tools (ATST), complete with actionable remediation guidance and targeted documentation links for efficient resolution. Learn more here.

Add scopes to REST endpoints to use OAuth 2.0 2LO

Granular access control and enhanced security are now available for REST endpoints through the newly introduced @ScopesAllowed annotation.

Applying the @ScopesAllowed annotation allows endpoints to be securely accessed using OAuth 2.0 Client Credentials tokens (2LO).

For instance, adding this annotation ensures that an access token must explicitly contain the WRITE scope before granting entry to the endpoint. Learn more here.

Repository search index insights

Repository administrators now have access to a dedicated search indexing page directly within repository settings, simplifying the process of diagnosing and resolving search anomalies. This centralized hub presents a clear overview of indexing health, featuring real-time status indicators, comprehensive error diagnostics for unsuccessful indexing runs, and precise details regarding the most recently indexed commit alongside its timestamp.

Learn more here.

Default reviewer groups for pull requests

Assigning default reviewer groups to pull requests removes the hassle of picking individual reviewers manually every time. Once configured, all default reviewers belonging to your chosen groups are automatically assigned as soon as a pull request is created.

To enable this, simply choose your desired reviewer groups when setting up default reviewers for your repository. Learn more here.

GitLab steps up to version 19.2, the release where the GitLab Duo Agent Platform crosses from preview into production-ready tooling. This update is about turning AI assistance from a collection of experiments into supported, day-to-day capabilities, while hardening the security and governance controls that keep that automation trustworthy. For your team, it means the AI helpers you have been trialling can now take on real workloads, and administrators gain firmer, instance-wide control over how they operate. The standout moves are the CI Expert Agent and the GitLab Duo CLI both reaching general availability — bringing production-grade pipeline guidance and terminal-native AI into everyday use — alongside generally available custom flows for automating multi-step work. Reinforcing all of this, fine-grained personal access tokens reach GA for least-privilege automation, a new AI audit event report gives security and compliance teams a single record of agent activity, and scheduled pipeline execution policies let you enforce scans and compliance jobs across every project from one place.

Administration

Code Review Flow for GitLab Duo Enterprise seats (Premium, Ultimate)

Until now, whenever a user with a GitLab Duo Enterprise seat requested a review, GitLab Duo Code Review always handled it — even when the group had Code Review Flow switched on — and there was no way to apply the agentic flow to everyone. Top-level group Owners can now change that default so every review runs through Code Review Flow regardless of a user's seat, with each review drawing on GitLab Credits. The result is that Enterprise-seat users get the same repository-wide context awareness, multi-step reasoning, and review sessions that everyone else already benefits from. Learn more here.

Disable built-in project templates (Premium, Ultimate)

When an organization standardizes on its own custom project templates, GitLab's built-in vendor templates only clutter the selection screen and can, in some cases, sidestep server-side hooks or other repository controls. Administrators can now switch off built-in templates globally from the Admin area, or at the group level for subgroups, and the setting cascades to subgroups automatically rather than needing to be repeated everywhere. The value can be enforced so groups cannot override it, and both the instance and group settings are manageable through the REST and GraphQL APIs; on GitLab.com, only the group-level setting is available. Learn more here.

Fine-grained PAT permissions are generally available (All tiers)

Fine-grained personal access tokens are now generally available. Unlike legacy PATs, which unlock every project and group you belong to, a fine-grained token can be limited to specific resources and actions — making it far easier to apply least-privilege principles to your automation and integrations and to contain the damage if a token ever leaks. To keep setup painless, the Add permissions with Duo feature helps you pick the right scopes as you create a token, and your existing legacy PATs keep working exactly as before. With this GA release, fine-grained PATs cover the full REST API surface plus the most commonly used GraphQL types and mutations. Learn more here.

Instance-level custom review instructions (Premium, Ultimate)

Previously, custom review instructions for GitLab Duo could only be set at the project or group level, so an administrator who wanted consistent guidance — security rules, internal coding standards — across an entire instance had to copy the same instructions into every project. You can now define review instructions once for the whole instance: nominate a template project, and when GitLab Duo reviews code, it merges that instance-level .gitlab/duo/mr-review-instructions.yaml with any group- and project-level instructions, giving the organization a single source of truth. Both Code Review Flow and GitLab Duo Code Review honor these instance-level instructions. Learn more here.

AI

AI audit event report (beta) (Premium, Ultimate)

AI audit event reports arrive in beta, giving security and compliance teams one unified, downloadable record of GitLab Duo agent activity. Previously, that activity was spread across pipeline jobs and event histories, which made reconstructing a session for incident investigation, compliance review, or AI governance reporting a slow, manual job. Now every agent session produces a single audit artifact capturing its inputs, model, and configuration context, the chronological event timeline, and its outputs. You can browse these events from the Governance page, filter by agent and session, drill into individual events, and download the underlying session artifact. Learn more here.

Bulk AI Catalog items enablement (Premium, Ultimate)

Enabling public custom and external agents, and public custom flows, in the AI Catalog no longer means clicking through projects one by one. You can now select up to 100 projects in a single action, turning what used to be repetitive administration into a single step. Learn more here.

CI Expert Agent is now generally available (All tiers)

The CI Expert Agent reaches general availability. This AI-powered assistant helps you create, debug, and optimize GitLab CI/CD pipelines by analyzing your repository and guiding you through your pipeline configuration. The GA release builds on the beta and design-partner program and is now ready for real production workloads, lowering the barrier to adopting CI/CD across your projects. It also integrates with Orbit: where Orbit and its Knowledge Graph are enabled, the agent draws on graph-based code intelligence for more contextual recommendations (Orbit and the Knowledge Graph remain in beta). Learn more here.

GitLab Duo custom flows are now generally available (Premium, Ultimate)

Custom flows — AI-powered workflows you build to automate complex, multi-step tasks across your projects — are now generally available. Teams define the steps, components, and triggers so repetitive development and operational work run automatically in response to GitLab events, executing directly in GitLab CI/CD without leaving the platform. Highlights include YAML-defined reusable workflows, multi-agent orchestration, human-in-the-loop checkpoints for approval at sensitive steps, native GitLab triggers (mentions, assignments, pipeline, and merge request lifecycle events), creation and management from projects or the AI Catalog, public/private visibility controls, secure execution via service accounts and composite identity, and upfront YAML validation that catches configuration issues before runtime. Learn more here.

GitLab Duo CLI is now generally available (Premium, Ultimate)

The GitLab Duo CLI brings the Agent Platform straight to your terminal, and it is now generally available. Because it understands your GitLab project, pipelines, and agent configurations, you can ask complex questions about your codebase and have it act autonomously on your behalf — with context that external tools simply do not have. It offers an interactive chat mode and a headless mode for CI/CD, administrator on/off control for Self-Managed and Dedicated, model selection and shared sessions, tool approvals, Model Context Protocol connections, slash commands (including context usage and compaction), and support for skills and AGENTS.md customisation. Install it through the GitLab CLI (glab) or as a standalone tool. Learn more here.

GitLab MCP server is now available for Free users (All tiers)

The GitLab MCP server no longer requires a paid subscription, so connecting your AI tools and agents to GitLab is now possible on any plan. That means AI-powered automation and integration work out of the box, with no upgrade required. Learn more here.

Turn on MCP server independently from the Agent Platform (All tiers)

For finer control over how external tools connect to your instance or group, the GitLab MCP server can now be switched on or off separately from Agent Platform settings. Previously, the two shared a single toggle, so you could not enable the MCP server without also enabling Agent Platform features. Now you can let other tools reach GitLab as an MCP server without turning on the Agent Platform — or keep the MCP server off while you use Agent Platform features. Learn more here.

UI/UX

Recognize contributors with GitLab Achievements (Premium, Ultimate)

GitLab previously had no built-in way to formally recognise team members, customers, and contributors, so effort often went unacknowledged and communities lacked a consistent way to celebrate the people behind their projects. You can now create custom achievements at group level — each with a name, description, and avatar — and award them to users, who then choose which ones to show on their profile. It gives maintainers a visible way to reward participation and helps build stronger, more motivated communities. Learn more here.

Start foundational flows from Agentic Chat (All tiers)

Foundational flows used to be started only from specific UI actions, mentions, or assignments. You can now kick them off straight from Agentic Chat in the GitLab UI, as part of the conversation. When your request matches a specialist workflow, Agentic Chat hands off to the Developer Flow (implements changes or opens a merge request), the Code Review Flow (reviews a merge request), or the Fix CI/CD Pipeline Flow (diagnoses and repairs a failed pipeline). You approve the handoff in chat, then follow progress in the conversation or under AI > Sessions. Learn more here.

GitLab Flavored Markdown references in personal snippets (All tiers)

GitLab Flavored Markdown (GFM) references now work with personal snippets in two directions. GitLab processes GFM references inside personal snippet descriptions and comments, just as it does for project snippets and elsewhere; and you can reference a personal snippet from anywhere GFM is supported — comments, issues, and merge request descriptions — using the same $<id> syntax that already works for project snippets. Because snippet IDs are unique across personal and project snippets, each ID always resolves to a single snippet. Learn more here.

Reporting

Configure ID tokens in flows (All tiers)

You can now use ID tokens to authenticate with third-party OpenID Connect (OIDC) services without storing long-lived credentials — for example, for keyless signing of binaries and commits, or to pull secrets from a secrets manager. To use it, add the id_tokens keyword to your agent configuration and set the service to trust tokens issued by the GitLab Duo Agent Platform. Learn more here.

Usage billing checks for GitLab Duo Agent Platform Self-Hosted (Premium, Ultimate)

For Self-Managed customers running self-hosted models with an online license, the GitLab Duo Health check now confirms that the instance can reach the endpoints required for usage billing: the Customers Portal, the AI Gateway, and the Duo Workflow Service. Previously, if a firewall blocked any of these, administrators had no warning until users hit a broken feature. This validation lets administrators diagnose connectivity problems and review their firewall allowlist before anyone is disrupted. Learn more here.

Project development

Automatic rebase before merge (All tiers)

On projects using the semi-linear or fast-forward merge method, a source branch that fell behind its target used to force a two-step dance: select Rebase, wait for it to finish, then go back and select Merge. You can now enable automatic rebase prior to merge in a project's merge request settings, and GitLab rebases the source onto the target at merge time, so you complete everything with a single action. If preserving GPG signatures on individual commits matters to you, simply leave the setting off. Learn more here.

Custom Agent validation (All tiers)

Previously, you could save a custom agent in the AI Catalog whose prompt would fail at run time — for instance, prompts that tripped security rules left the agent silently doing nothing. Now, when you create or update a custom agent, GitLab validates the prompt configuration up front and surfaces any errors before you save, so you find out about problems while you can still fix them. Learn more here.

Exclude merge requests from automatic code reviews (Beta) (All tiers)

When automatic reviews were turned on, GitLab Duo reviewed every eligible merge request — including bot-authored dependency updates, feature branches, and experimental work, not just the changes your team actually wanted feedback on. You can now exclude specific merge requests using exclusion rules: define a .gitlab/duo/mr-review-automated-rules.yaml file for a project or group with rules based on author, source branch, or target branch, supporting glob patterns such as dependabot/* or *-bot. A manual review is still available for any excluded merge request. The feature is in beta, behind the duo_code_review_automated_rules flag, which is enabled by default. Learn more here.

Fix CI/CD Pipeline Flow suggests targeted fixes (All tiers)

GitLab Duo's Fix CI/CD Pipeline Flow gains two core improvements: when the relevant files are already in your merge request diff, fixes arrive as code suggestions right on that merge request; and the flow now classifies pipeline failures before acting, giving you a more targeted diagnosis. It also analyses child pipeline failures across the full pipeline hierarchy, lets you tailor its behavior per project with an AGENTS.md file, and collapses AI reasoning by default to keep merge request comments tidy. Learn more here.

GitLab Duo reads and responds to reviews in merge requests (All tiers)

GitLab Duo and MCP-based agents can now read merge request review conversations, giving your AI assistant the full context of reviewer feedback, unresolved threads, and discussion history. From there, you can ask the agent to summarise review comments, draft responses, and post replies directly into merge request discussions — all without leaving your workflow. Learn more here.

Resolve review discussions with GitLab Duo (Beta) (Premium, Ultimate)

Clearing a review comment used to mean switching to your editor, making the fix, committing, pushing, and then closing the thread by hand — repeated for every unresolved discussion, with the context-switching adding up across a busy review. You can now select Resolve with GitLab Duo on any review discussion: Duo reads the comment and the surrounding code, implements the change the reviewer described, and commits it to your branch. It then replies with a short summary of what changed and why, and resolves the thread, and you can always review the change and reopen the thread if the fix misses the mark. Learn more here.

Ultimate only

Vulnerability report exports correctly apply filters

Exporting a vulnerability report with filters applied now produces a CSV that contains only the filtered data, so the export matches exactly what you were looking at on screen. Learn more here.

Dependency scanning auto-remediation (Beta)

GitLab 19.2 introduces dependency scanning auto-remediation in beta, bringing automated vulnerability fixing directly into your dependency scanning workflow through two capabilities. Automated dependency version bumps monitor your projects and open merge requests to move vulnerable dependencies to safe versions without manual intervention, targeting patch and minor versions by default. Agentic Breaking Change Resolution extends this to complex updates: when a version-bump merge request fails its pipeline on a breaking change, GitLab Duo analyses the pipeline errors, the dependency's changelog, and how your code uses the dependency, then commits fixes to the same merge request and re-runs the pipeline until it passes — and enabling it extends version bumps to include major versions (it consumes GitLab Credits). Together they form a complete loop: GitLab opens the merge request, and when the update is complex, GitLab Duo resolves it. Learn more here.

Non-default branch tracking (beta)

You can now track vulnerabilities on branches beyond the default branch, working best when you target a small number of long-lived release branches — for example, environment branches (project-qa, project-prod) or platform branches (project-iOS, project-android). The beta lets you add tracked branches on the security configuration page (up to twice the number of projects in the namespace), filter by branch on both the vulnerability report and the project-level security dashboard, track every vulnerability type, including CVEs (previously out of scope), keep vulnerability status metadata consistent when a branch merges into the default branch, and update vulnerability status on tracked branches. Learn more here.

Scheduled pipeline execution policies are GA

Scheduled pipeline execution policies are now generally available. Define a schedule once in a security policy project and enforce it across every project in scope — no need to touch each project's .gitlab-ci.yml, and when requirements change, you update one policy instead of coordinating edits across many CI/CD files. Use them to run compliance scripts, security scans, or other custom jobs on a daily, weekly, or monthly cadence independent of commit activity, which is ideal for repositories without regular changes (for example, running dependency scans to catch newly disclosed vulnerabilities). Each policy runs as its own pipeline, with time zone support, time window distribution, and branch targeting. Learn more here.

Security Review Flow (beta)

Security Review Flow spots business logic vulnerabilities directly in merge requests. Rather than scanning for known patterns like a static analysis tool, it reasons about the intent of your code to catch authorization bypasses, data exposure, and logic errors that pattern-based scanners routinely miss. To request a review, assign the Duo Security Review service account as a reviewer; the flow analyses the diff and posts findings as threaded comments at the exact lines where issues occur, each with a CWE classification, a severity rating, and — where possible — an inline suggested fix you can apply without leaving the merge request. Each review consumes GitLab Credits based on the complexity of the diff. Learn more here.

A security manager can configure agentic flows

The Security Manager role can now configure the agentic security flows for projects — SAST Vulnerability Resolution, SAST False Positive detection, Secrets False Positive detection, and Dependency Scanning Vulnerability Resolution — so security personnel can manage these capabilities directly, without needing a broader role. Learn more here.

Jira advances to version 11.3, the newest Long Term Support benchmark and the destination for a single jump that skips every interim release along the way. Settling on an LTS version means a stable, fully supported foundation that stays current for years rather than months, so your projects run on tooling that Atlassian will keep patching well into the future. In practice, everything from custom-field housekeeping to search performance and roadmap planning arrives in one upgrade, without the disruption of stepping through each version in between. Administrators gain a genuinely modern optimization toolkit and stronger, standards-based security, while everyday users get a refreshed Advanced Roadmaps experience and steadier, more reliable boards. The result is a calmer, better-performing Jira that keeps large instances healthy as they grow.

Deprecations and removals

Removal of the deprecated Text gadget

The dashboard Text gadget, deprecated back in Jira 9.11, has now been removed. Its replacement — the Rich Text gadget — has been available for some time and serves the same purpose with better security, so any dashboards still using the old gadget should move across.

End of support for the Original theme

With the new light and dark themes that brought accessibility and usability improvements, the original theme is being removed from all products.

Deprecation of Browse Project properties in workflows

The jira.permission.browse.* workflow step properties — used to restrict issue visibility on particular workflow steps — are deprecated from Jira 11.2 and will be ignored entirely from version 12.0. To keep the same control, move to issue security levels and automation rules, which decide access based on a user’s project role and the current issue status. Learn more here.

Upgrade from ProForma Lite to ProForma Full

If your teams build forms with ProForma, take note: the free ProForma Lite app is no longer supported and has been removed from the Atlassian Marketplace. It won’t receive further updates, compatibility fixes, or support, and it may eventually stop working as Jira moves on to newer versions. To keep your forms running — and to unlock the complete forms experience — move to the full ProForma app, with a 30-day free trial to explore everything before you commit. And if you’re on Jira Service Management, you already have access to all ProForma features at no extra cost. Learn more here.

Instance optimizer

Improve Jira performance with Instance optimizer

Instance Optimizer for Jira brings performance care into one place with automation that keeps the instance stable without constant manual effort. Index auto-healing detects and resolves indexing issues without a full reindex, database integrity checks scan for and fix inconsistencies, and custom-field optimization lets you clean up fields to head off slowdowns before they bite. Together, they give you a proactive, low-effort way to keep Jira responsive as it scales. Learn more here.

Optimize your instance with safeguards

Safeguards let you set recommended limits on the things that quietly erode performance as an instance grows: comments, custom fields, issue types, issues, and projects. When usage nears a limit, system administrators are notified by email and in-app; if an action would breach a limit, it is blocked, and the user sees a clear warning, so the instance stays within safe bounds by design rather than by cleanup after the fact. You choose whether enforcement and notifications are on, keeping full control over how strict the guardrails are. Learn more here.

Optimize your custom fields

Custom-field management gets far more practical. From the recommendations page, you can search, filter, and take bulk actions — including deleting custom fields outright — and see richer detail about how each field is used and what localizing it would cost. A quick scan surfaces fields whose configuration can be streamlined, so trimming the clutter that slows search and indexing becomes a routine task rather than a project. Learn more here.

One place to clean them all

Cleanup no longer lives in a separate corner of Jira. The older Clean up functionality is being retired and the Audit Custom Fields link removed, with those capabilities — including project and issue archiving — folded into the Instance Optimizer app. The payoff is simple: every housekeeping tool sits in one place, with more automated and efficient ways to keep your instance tidy. Learn more here.

Advanced Roadmaps for Jira

A refreshed look and feel

First introduced in Jira 10.7 and now the default in Jira 11, the modernized Advanced Roadmaps interface brings a restructured layout, smoother program and plan management, and a full dark theme. The feature flag that once guarded these changes has been removed, so the new look is simply how Advanced Roadmaps works — consistent with the rest of Jira, more accessible, and easier to navigate. Learn more here.

Find missing issues, backed by a higher issue limit

The new Find your issue tool takes the guesswork out of a plan that seems to be hiding something: search by issue key and Jira checks your plan’s filters and settings, then explains exactly why the issue isn’t showing. It pairs naturally with a raised backend limit — plans can now return up to 10,000 issues (the frontend limit stays at 5,000) — so large plans stay stable, and fewer issues drop out of view in the first place. Learn more here.

Cleaner filtering for unsaved issues

Newly created issues no longer pick up an issue source until you save them to Jira. Previously, they were linked to their source the moment they were created, so filters applied to unsaved issues too; now a plan reflects only what has actually been committed, giving you cleaner, more predictable filtering while you draft.

Stricter permission handling

Issue filters used as a plan’s issue source now respect Jira’s permission model without exception. If you don’t have permission to view a filter, its issues won’t appear in the plan — bringing plan visibility in line with the rest of Jira and closing a long-standing inconsistency. To keep issues visible, make sure they’re saved and that you have access to the relevant filters.

Manage your integrations and automations with service accounts

Automated processes and external integrations can now run through dedicated service accounts — specialized, non-user accounts built for secure, controlled automation. Each one reaches Jira’s REST APIs using OAuth 2.0, so scripts and scheduled tasks execute under tightly scoped permissions instead of a real person’s credentials, and every action a service account takes is tracked for full visibility.

To set up a service account:

1. Go to Administration, then User management, and select Service accounts from the sidebar.

2. Select Create service account.

3. Follow the prompts to configure the account’s details, scopes, and resources, then generate its OAuth 2.0 credentials.

4. Review everything and copy the credentials to a safe place.

Learn more here.

View your repo health with Sync history

Administrators managing linked repositories get a clear audit trail of recent syncs through the new Sync history view in the Distributed Version Control System (DVCS) section. Rather than guessing whether a repository is syncing cleanly, you can open a table of every sync from the past seven days — start and end time, status, duration, sync type, and the reason for any failure — and isolate problems in seconds.

To check the sync history of a repo:

1. Go to Settings, then Applications.

2. Open your account under DVCS accounts.

3. Next to the repo you want to check, select Show sync history.

Learn more here.

Redirect email replies for Jira notifications

Email notifications can now send replies somewhere other than the From address. A new Receive replies at field lets you set the Reply-to header on outgoing mail — per SMTP server, per project, or during setup — so responses land in the right mailbox and sensitive addresses stay protected from mismatches. Learn more here.

Security and authentication

Add scopes to REST endpoints to use OAuth 2.0 2LO

A new @ScopesAllowed annotation lets developers lock REST endpoints down to OAuth 2.0 Client Credentials (2LO) tokens that carry the right scope. Annotating an endpoint means a token must explicitly hold, for example, the WRITE scope before it is granted access, giving integrations fine-grained, least-privilege entry rather than broad reach. Learn more here.

OAuth 2.0 security improvements

The OAuth 2.0 provider gains several protective defaults: access tokens now expire after at most an hour; client IDs and secrets last 90 days by default (adjustable up to two years) to encourage regular rotation; rotated credentials can be revoked; administrators can revoke a user’s refresh tokens; and each client-and-user pair is capped at 25 refresh tokens. Together, these changes shrink the window of risk if a credential is ever exposed and keep token sprawl in check, and each limit remains configurable through system properties if your environment needs different values.

That’s all for September! See you in October!