Atlassian Forge 2026-08-31

Apply the Node.js 24 prompt first, including its JavaScript baseline, for APIs and controls exposed by the deployed runtime. These rules cover the 2026-08-31 Forge platform snapshot for standard Atlassian commercial cloud: Node.js functions, UI Kit, Custom UI, hosted storage, Forge Remote, events, Realtime, and Rovo actions. Atlassian operates the function host and runtime; baseline rules about process startup flags, HTTP servers, and operating-system configuration apply to infrastructure you operate. Preview and EAP features require their own contract review.

Runtime, manifests, and invocation isolation

• Set app.runtime.name: nodejs24.x. Keep the Forge packages compatible and patched, and use a Forge CLI release within its six-month support window; an accepted runtime or CLI value does not establish ongoing security support.
• Treat manifest.yml, resource bundles, provider configuration, and deployment variables as privileged inputs. Request only the OAuth scopes, modules, and egress needed by the app, and review generated scope changes from forge lint --fix before deploying.
• Review the actual major/minor version outcome and the permissions approved for each installation before enabling new operations. Minor updates, including a runtime-only change, propagate within the installed major version without renewed admin consent; do not assume deployment upgraded every installation's permissions.
• Keep tenant data, credentials, mutable API clients, and authorization decisions inside the invocation. Do not retain them in module-level variables, singleton caches,