Release notes

Every released version of Oktul Work Item Selector for Jira, newest first.

3.14.0, 21.10.2026

A security update. markdown-it, a library the app’s screens load through Atlassian’s @forge/bridge, moves to 14.3.3, which closes two published vulnerabilities in it. Released the same day the fix was made. Nothing changes in how the app behaves, and no permission changed.

3.13.0, 18.10.2026

Fixes from a security review, and the app’s icon in Jira’s field type list.

• A work item outside the field’s JQL scope is shown as Not available in a field that reads work items as the app. A key written into the field by the REST API or an import could show a work item the person could not otherwise see.
• Work item links and the reverse index are written only for work items inside the field’s scope.
• Search suggestions in advanced search match work item keys only, and a field that reads work items as the person suggests nothing, since a suggestion is made as the app.
• The field type list shows the Oktul Work Item Selector icon beside both field types.
• Less storage and compute: an upgrade rebuilds the index only when its format changed, and each function runs in less memory.

3.10.0, October 2026

A security update. The app deletes only the work item links it created.

• A field that mirrors its selection as work item links now keeps a record of each link it creates, in the app’s own Forge storage: the link id and the keys of the two work items. It deletes a link only when that record matches, or when the link is of the type and direction the field is set to keep. Before, a link id written into the work item property by someone who could edit the work item could have had the app remove a link that person had no permission to remove.
• Links made before this release are still removed while the field keeps its link type. After a type change, or with linking switched off, they stay for a person to remove.
• Dependencies on their newest supported versions, on Node 24. A dependency audit of this release reports nothing.

3.9.0, October 2026

In a multi select field, each chosen work item is a full-width card while editing.

• Each chosen work item is the same card the work item view draws, the width of the field, with a cross to remove it. The chips the picker drew before took their width from their text, so a selection read as a row of small tags. Remove all appears under two or more.
• The search box stays open after a pick, so several work items can be added in a row, and it stops offering what is already chosen.
• Single select is unchanged.
• The manifest declares Jira as a required product.
• Security updates to test and build tooling, and an override for prosemirror-view (GHSA-c8x8-7fp4-3x9w), which the app imports for type definitions only. A dependency audit of this release reports nothing.

3.7.0, October 2026

Security updates to four third-party packages. The app behaves exactly as before.

The updated packages are fast-uri, undici, markdown-it and brace-expansion, which between them carried 17 published advisories, the most serious rated high: host confusion in URI parsing, and denial of service in WebSocket decompression.

None of the four runs inside the app. They arrive through Atlassian’s Forge packages, which reference them for type definitions only, and through the lint tools that check the app’s source code. The code deployed to your site and the workflow validator’s configuration screen contain none of them. They were updated anyway, so that a dependency audit of this release reports nothing.

3.6.0, September 2026

The picker is shorter: no Load more button, and each column cut to 40 characters.

• The Load more work items button is gone. The picker opens on the first 25 work items in scope, and typing narrows the list. The button paged through the rest of the scope 25 at a time.
• Each column in a picker option is cut to 40 characters, spaces included, and ends in an ellipsis where it was cut. A long summary or description used to stretch the edit box. The cards on the work item are unchanged.

3.5.0, September 2026

The app follows each person’s Atlassian profile language, in English or Estonian.

Every screen is translated: the picker, the work item view, the field configuration screen and its knowledge base, the Automation action’s form and the workflow validator’s configuration. So are the field type names and descriptions Jira lists, and the message Jira shows when a typed value is rejected. Any other profile language shows English.

Three kinds of text stay in English: error messages from the app’s backend, messages in the Automation audit log, and the workflow validator’s default block messages. An administrator can replace each block message with their own wording, in any language.

• Field settings open one section at a time. Work item scope opens first, and opening another section closes the one that was open. The knowledge base and the help card stay open.
• Save checks the configuration instead of staying disabled. An invalid scope used to disable it, and with the sections folded away the reason could be out of sight. Save now checks the scope again, and a rejected scope, column set or link type opens the section it concerns.
• The cursor stays where you put it. Editing the middle of the JQL scope, the picker’s placeholder text, the Automation action’s work items or a validator message moved the cursor to the end after every keystroke.
• The JQL scope box no longer takes focus by itself.
• Clear keeps the work items box on screen. With Clear the selection chosen, the Automation action hid the box while the keys still in it stopped the rule from running. The box now stays visible until it is empty.
• Shorter wording throughout the app, with one term per concept: work item in English, pilet in Estonian.

3.4.0, September 2026

First release: work item picker custom fields, scoped by JQL per field context.

Two custom field types, Oktul Work Item Selector (Single Select) and Oktul Work Item Selector (Multi select), holding up to 100 work items, the Forge platform limit.

• JQL scope per field context, validated live as it is typed. Placeholders read the current work item and user, so one configuration behaves differently on every work item: parent = {{issue.key}}, assignee = {{user.accountId}}.
• Permission mode: search as the viewer, or as the app.
• One to seven columns on each card, drawn the way Jira draws them.
• Four JQL functions and eight aliases covering both directions of a relationship, plus Automation smart values and JQL autocomplete.
• A “Set work item selection” Automation action: replace, add to, remove from, clear.
• A workflow validator: require a selection, require statuses, restrict projects, prevent circular dependencies.
• Optional native Jira links, created and removed with the selection.

No data leaves Atlassian. The app declares no external permissions.

The version here is the Marketplace version, which is what you compare against the version installed on your site. It runs independently of the source repository’s own numbering.

---

Each release runs several hundred automated tests, including injection and security suites, before it reaches the Marketplace.

---

A problem or a question? Write to support@oktul.com or open a request in the Help Center (opens in a new tab).