Build1 publisher2 min readPublished
Atlassian ends security patches for Connect-based Cloud apps at the end of 2026
Atlassian stops security patches for its Connect app framework at the end of 2026, more than two years before Data Center reaches end of life in March 2029. Teams already on Cloud reach that date first, because a large share of Marketplace apps were built on Connect and those apps will keep running without fixes.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Atlassian announced a three-phase Connect retirement timeline in March 2025, with fixed enforcement dates and Forge named as the successor framework.
- Since 17 September 2025 the Marketplace has listed no new Connect apps, and Atlassian requires new Cloud apps to be built on Forge with no Connect modules.
- On 31 March 2026 Atlassian froze existing Connect apps, so vendors can no longer ship updates that add features, scopes or permissions.
- Atlassian says customers "won't lose access" to Connect apps after end of support, though "some features may eventually stop working" as the platform changes.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Any Connect app still installed after 2026 is third-party code with access to site data, running on a framework that no longer gets security patches.
- constraint A Connect vendor that needs a new scope or permission to keep up with platform changes cannot ship it after the freeze, so that kind of drift can only be fixed by rebuilding on Forge.
- decision Cloud admins have to sort installed apps by framework and get a Forge date from each Connect vendor, because a frozen app never produces the outage that would prompt the question.
Atlassian staged the retirement so that no app switches off on any given day. New listings stopped first. Updates that add capability stopped second. Support ends last, about nine months after the freeze [2]. I think that is a considerate way to retire a platform other companies sell products on. It also means no single date produces an outage. The author of a dev.to post laying out the timeline wrote: "Almost nobody I talk to knows it exists." [11]
The freeze is narrower than it sounds. A Connect app keeps running after 31 March 2026, and its vendor can still fix what is broken in it [6]. The post's author described the end-of-2026 step this way: "End of support is not a switch-off. It's gradual decay you have to go looking for." [14]
After that date, the label Atlassian gives Connect, as quoted in the post, is "use at your own risk" [7]. The author expects the damage to surface in an audit: "A leak you discover eighteen months later, when a security review asks who owns the unpatched app holding half your workflow data." [13]
The apps involved are the ones admins install once and stop thinking about. The post lists time trackers, diagramming tools, SLA reporters and "ScriptRunner-shaped things" as typical Connect apps. According to the author, a large share of Cloud Marketplace apps are built on the framework [10]. The post does not count how many Marketplace apps are still on Connect today.
Teams that already finished their Cloud move meet this deadline first. Connect support ends more than two years before the March 2029 Data Center end of life [1]. A team can complete its migration ahead of schedule and still be running apps that lost security patches at the end of 2026.
Atlassian describes Forge as the end state. "Forge is Atlassian's modern cloud app development platform that replaces Connect," Atlassian wrote, and it "will become Atlassian's only app development platform," according to the passages the post quotes [9]. The author counts Connect as the second platform pulled out from under app owners in a few years, after Server. The author also calls the reaction "we just re-platformed, why are we doing this again" "a completely fair thing to feel." [12]
What to watch
- Whether Atlassian publishes a count or list of Marketplace apps still built on Connect before the end-of-2026 cutoff.
- Forge release dates from vendors of widely installed Connect apps such as time trackers, diagramming tools and ScriptRunner-type scripting apps.
- Any Atlassian statement naming which Connect features stop working first after end of support, or moving the end-of-2026 date.