Bitbucket Updates & Release Notes

What's changing

On 30 Nov 2026 Git requests authenticated using OAuth2.0 via the Git Credential Manager (GCM) will be blocked for versions prior to 3.0.0. This is caused by the lack of support for rotating OAuth refresh tokens, which have recently begun being enforced for Bitbucket’s OAuth 2.0 implementation. See:  https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052 . Atlassian contributed changes to the open source project to include support for the rotating refresh token model, which was bundled in the v3.0.0 release ( https://github.com/git-ecosystem/git-credential-manager/releases/tag/v3.0.1 )

What you need to do

• If
  • Action/s Required?
• You are NOT using Git Credential Manager
  • No action is required
• You ARE using Git Credential Manager configured with personal access tokens
  • No action is required
• You ARE using Git Credential Manager configured with OAuth2.0
  • You must upgrade Git Credential Manager to a version 3.0.0 or higher by 30 Nov 2026 if you wish to continue to authenticate Git using this mechanism. Simply upgrading the version should ensure seamless authentication.

Attached file

Note: Impacted users will see a message after each git push operation prior to upgrade.

What's changing

Branch restrictions now support adding the following to Write Access and Merge Access branch permissions in your branch restriction rules:

• Repository access tokens (RAT)
• Project access tokens (PAT)
• Workspace access tokens (WAT)
• Forge apps
• Rovo Dev

This applies to both repository and project-level branch restrictions.

What you need to do

No action is required. To use this feature, navigate to Repository settings → Branch restrictions or Project settings → Branch restrictions and add your access tokens, Forge apps or Rovo Dev to the desired permission rules.

For more information see our community post.

Bitbucket pull request (PR) update events for Forge apps now feature an additional changes field in their payloads. This field is present when a PR is updated due to a new commit being pushed to the source branch.

This update allows Forge apps to distinguish between code-level updates (new commits) and metadata updates (such as changes to the title or description). This is a backward-compatible change; no existing fields have been removed or renamed.

What you need to do

For most apps, no action is required. If your app is already listening to Bitbucket PR update events, the additional field will automatically be available in the event payload.

However, if you validate event payloads with a strict schema, ensure your validator is updated to allow the new changes property. You can review the updated payload structures in the Bitbucket pull request updated event reference documentation.

Bitbucket has added support for bearer authentication for API tokens.

What’s changing:

Bitbucket Cloud has added support for Bearer authentication when using API tokens. You can now authenticate your API requests by sending the token in a Bearer authorization header, providing a more standard and secure alternative to Basic authentication.

curl --request POST \
--url 'https://api.bitbucket.org/2.0/repositories/{workspace}/{repository}/commits' \
--header "Authorization: Bearer {api_token}" \
--header 'Accept: application/json'

What you need to do:

No action is required. Bitbucket Cloud continues to support both Basic and Bearer authentication for API tokens. If you have existing integrations using Basic authentication, they will continue to work without modification.

For more information on creating and using tokens, see the API tokens documentation.

As announced in 05 Feb 2026, we have removed the Bitbucket Cloud Connect addon linker APIs. These endpoints are no longer available.

What’s changing

The following REST API endpoints have been removed from Bitbucket Cloud:

• GET /2.0/addon/linkers
• GET /2.0/addon/linkers/{linker_key}
• GET /2.0/addon/linkers/{linker_key}/values
• PUT /2.0/addon/linkers/{linker_key}/values
• POST /2.0/addon/linkers/{linker_key}/values
• DEL /2.0/addon/linkers/{linker_key}/values
• GET /2.0/addon/linkers/{linker_key}/values/{value_id}

What you need to do

If you were using these endpoints, you must update your integrations to remove these calls as they will now return an error. For more information on the end of support for Connect on Bitbucket Cloud, please refer to the official announcement.

We’ve added new navigation targets for the Forge bridge’s router object. These allow you to use the router API to navigate to supported UI module pages in Bitbucket.

What’s changing

The following Bitbucket modules are now supported as navigation targets:

• bitbucket:workspaceGlobalPage
• bitbucket:workspacePersonalSettingsPage
• bitbucket:workspaceSettingsMenuPage
• bitbucket:projectSettingsMenuPage
• bitbucket:repoMainMenuPage
• bitbucket:repoSettingsMenuPage

What you need to do

You can now update your Custom UI or UI Kit apps to use these targets with router methods. For implementation details and examples, see the router object documentation.

Additional fields available in Bitbucket Forge events. This change is backward-compatible; no existing fields are removed or renamed.

What’s changing:

Bitbucket Forge events now include additional fields in their payloads. This update allows Forge apps to access more comprehensive data directly from the event, reducing the need to make separate API calls back to Bitbucket to fetch missing details.

The following event types are updated with additional fields:

• Repository created events
• Repository push events
• Build status events
• Pull request events

What you need to do:

No action is required. If your app is already listening to these Bitbucket Forge events, the additional fields will automatically be available in the event payload. If you validate event payloads with a strict schema, ensure your validator allows additional properties.

You can review the updated payload structures in the Bitbucket events reference documentation.

Bitbucket Forge page modules will now have their menu items grouped into sections by their app. This change improves the organization of the Bitbucket navigation menu, making it easier for users to identify which menu items belong to specific apps.

What’s changing:

The following modules will now have their menu items grouped by app:

• bitbucket:workspaceGlobalPage
• bitbucket:workspaceSettingsMenuPage
• bitbucket:workspacePersonalSettingsPage
• bitbucket:repoMainMenuPage
• bitbucket:repoSettingsMenuPage
• bitbucket:projectSettingsMenuPage

What you need to do:

No action is required from you. If your app uses these modules, their menu items will automatically be grouped. You can see the linked documentation pages for example screenshots of the new grouping behaviour.

We've introduced a structured process for partners and Atlassian to jointly investigate security incidents affecting your app or the customer data it handles.

What's changing

• Log sharing for Forge apps: Atlassian can now share incident-scoped platform logs and app telemetry with you during an investigation. This provides the data you need to diagnose and resolve issues faster.
• A single reporting path: You can now report security incidents through the new developer support portal form. This form serves as the shared record for both you and Atlassian.

What you need to do

• Review the program overview page to understand eligibility and support levels.
• Ensure your security contact information is up to date in the partner account to ensure you are ready before an incident occurs.

We've introduced the Tile component for Forge UI Kit apps, now available in Preview. The Tile component is a rounded square container for displaying assets like emojis, or objects in a consistent, styled way.

The component supports various sizes (from 16px to 48px), customizable background colors using design tokens, optional borders, and adjustable internal padding for different asset types including third-party logos.

For implementation details and examples, see the Tile component documentation.

To maintain system stability as our usage scales, we updated Bitbucket Pipelines to only detect the [skip ci] or [ci skip] label within the first 200 characters of a commit message. This means pipelines won’t be skipped if the label appears further in a long message.

To ensure your builds are intentionally skipped, place the label near the start of your commit message, ideally in the subject line. Manual runs are not affected by this change.

For details, read
 https://support.atlassian.com/bitbucket-cloud/kb/how-to-skip-triggering-an-automatic-pipeline-build-using-skip-ci-label/ .

What’s changing

We’ve introduced a new Bitbucket REST API endpoint that allows a Forge app to retrieve the clientKey of its linked Connect app installation.

This endpoint supports the migration process from Connect to Forge. By retrieving the clientKey, the installed Forge app can identify the equivalent Connect app installation, enabling you to perform data migration or cleanup tasks effectively.

What you need to do

To use this endpoint, ensure you have configured the linkage between your Connect and Forge apps.

• Add the forgeAppId key to your Connect app descriptor.
• Use the new endpoint to fetch the clientKey during your app's migration logic.