sooperset/mcp-atlassian v0.24.4 on GitHub

🐛 Bug Fixes

stdio servers exit on SIGTERM and Ctrl+C. The signal handler set a shutdown flag that nothing read, so a stdio server kept running after the client closed or docker stop asked it to stop, leaving orphaned Python and Docker processes. The server now stops on SIGTERM and SIGINT, and exits after a 5-second grace period if a blocked stdin read keeps it from stopping cleanly (#909, #1856). Thanks to @rodrigoGA for the report.
No more file-descriptor and CLOSE_WAIT leak under HTTP transports. Request-scoped Jira and Confluence sessions are now closed at the end of each request, and attachment downloads close their response (#1683, #1850). Thanks to @blakeouy for the fix.

OAuth proxy works with clients that send a resource parameter. With ATLASSIAN_OAUTH_PROXY_ENABLE=true, clients such as Claude Code and the MCP Inspector send the RFC 8707 resource parameter, which Atlassian rejected. The proxy no longer forwards it upstream (#1137, #1839). Thanks to @TF88641 for the report and @chrikoch for the fix.
Forced scopes now apply to every authorize request. ATLASSIAN_OAUTH_SCOPE was enforced only when a client registered. A client could then request a narrower subset on /authorize, for example after the scope list was extended on a running deployment, and get a token that tools then failed with (401 scope does not match). The proxy now sends the forced scopes upstream on every authorize request (#1840). Thanks to @chrikoch.

Editing a Cloud comment keeps its images and files. jira_edit_comment rebuilt the body from Markdown and dropped existing media nodes, and Jira then deleted the attachments behind them. The edit now keeps the comment's existing media (#1678, #1855). Thanks to @prikrylmojmir-arch for the report.

confluence_update_page_section no longer wipes a page when given its title. Passing the page's own title as heading_text matched the leading <h1> and replaced the whole body. It now returns an error that explains the title is not a section heading (#1732, #1853). Thanks to @Gerald1965 for the report.
Re-uploading an existing attachment works on Cloud OAuth. The version lookup used a v1 endpoint that returns 410 under OAuth. It now uses the v2 API and falls back to v1 only where v2 is unavailable (#1770, #1854). Thanks to @jasandov for the report.

fastmcp 3.4.7 or later is required. Earlier versions built the private_key_jwt audience as //token when PUBLIC_BASE_URL had no path, so CIMD clients such as the ChatGPT connector failed at /token. certifi is refreshed to 2026.10.23 (#1716, #1851). Thanks to @rokeeffe-thp for the report.
cryptography 48 and later are allowed. The <47 ceiling blocked fixes for published cryptography advisories. The floor is now 50.0.0 (#1638, #1641). Thanks to @dibyanduroy.

Full Changelog: v0.24.3...v0.24.4