Release notes

Every version of Oktul SignPlus for Confluence, newest first.

12.19.0, 04.11.2026

A maintenance release: internal clean-up and documentation. Nothing changes in how the app behaves, and no permission changed.

12.18.0, 03.11.2026

Fixes from our penetration test of 03.11.2026.

• An external signer’s email address stays out of the browser. The page shows a placeholder. The REST API still returns the address.
• Cancelling a pending signing keeps one that has finished in the meantime.
• A page that does not exist is refused like a page you cannot see.
• A signer’s role reads Signer or Viewer in the English signing details.

12.15.0, 31.10.2026

• A group is added by name through Confluence’s group picker, since Confluence removed the old lookup by name.
• Clearer Estonian: the byline and the download button.
• Dependency security updates. No permission changed.

12.14.0, 21.10.2026

A security update. markdown-it, a library the app’s screens load through Atlassian’s @forge/bridge, moves to 14.3.3, which closes two published vulnerabilities in it. Released the same day the fix was made. Nothing changes in how the app behaves, and no permission changed.

12.13.0, 18.10.2026

Security fixes from a review of the whole app, and Assets objects in exported tables.

• An automation rule can export or sign a page only in the spaces a Confluence administrator chooses, under Spaces automation rules can use in the global settings. With none chosen, a rule that uses a SignPlus action stops with a message saying why. Before, a Jira rule could act on any page the app could reach.
• An Assets field in an Oktul Work Item Macro table prints as the page shows it, as a chip with the object’s label and key. It printed as the object’s id when the macro could not look the object up during the export.
• A Confluence account added as a signer gets the address and name Confluence holds for it, never the ones in the request.
• A group added through the REST API is limited to the groups the token’s account belongs to, as it already was in the page.
• A completed signing is confirmed with Dokobit before the signed document is downloaded.
• A signing is recorded as soon as Dokobit holds it, so one cut short by the platform’s time limit can still be found and cancelled. A signing of thousands is cancelled in the background.
• Cancelling needs view access to the page. Refused REST API calls no longer push older entries out of the activity log, and error text written to the app’s logs has addresses, links and tokens removed.

12.9.0, 15.10.2026

Fixes to exported PDFs and to how SignPlus reads space permissions.

• A picture taller than a page no longer squeezes the page. A portrait screenshot printed at a third of its height, and the paragraphs above it printed on top of each other. Such a picture is now drawn narrower, at its own proportions, so its whole height fits on one page.
• Download PDF names the file after the Document name field. It attached page-<id>-<timestamp>.pdf whatever the field said. With the field empty, the file takes the page title, numbered when the page already has a file of that name.
• A space administrator granted through a role is recognised, and so is a person who can view a space through one. Confluence leaves role grants out of the permission list SignPlus read, so an administrator of a colleague’s personal space was told they could not view it.
• A whiteboard’s address is written into the signed document as text. An address containing a quote could add markup to the PDF. Only an http or https address becomes a link.

The signed document changes for a page with a picture taller than a page, and for a whiteboard whose address contains ", < or >.

12.6.0, 10.10.2026

Support for Oktul Regex Field for Jira. A paragraph field of that app in a Jira work items table or a Work Item Macro table now prints in the signed document as the text it holds, one paragraph per line, instead of its stored value. The single-line field already printed as its text. Nothing else changes in how SignPlus signs a page.

12.5.0, 10.10.2026

A minor update that prepares SignPlus for Oktul Regex Field for Jira, so that its paragraph field will print in a signed document as the text it holds. Until that app is published nothing changes in how SignPlus signs a page, what the signed document contains or how it is set up.

12.4.0

The first Marketplace release, listed on 09.10.2026.

What changed in this build since these pages were first written, 26.09.2026

Signing

• A Confluence group can be added as signers or viewers. Every member is invited when the signing is sent, and a signing reaches up to 25,000 people, where it reached 100.
• A signing started from the page is sent in the background, so closing the page does not stop it. A signing goes to everybody or to nobody.
• The signing details filter the list to who has signed, who has not and who declined.
• Deleting a finished signing is a Confluence administrator’s by default, with a site setting to allow space administrators, page editors or the person who started it.
• SignPlus checks with Dokobit itself, once an hour, about up to 1,000 pending signings it has not checked for an hour, so a lost notice no longer leaves a signing open.
• There are two signing modes, Test and Your own token. Real signing is always on your own Dokobit account.
• SignPlus asks Dokobit about a token before storing it, and does not save one Dokobit refuses.

The document

• Jira work items tables, Oktul Work Item Selector fields and Oktul Work Item Macro for Confluence tables print as the page draws them, with Work Item Selector values as work item cards.
• Confluence’s three kinds of table keep their own looks: tables an author drew, work items and Assets tables, and listings such as the meeting notes index and the user list.
• Merged cells print merged, with the cell’s fill and no line across it.
• Animated GIFs print as one still picture, in place: the frame the animation rests on longest.
• A picture the page already draws is no longer appended again as an attachment.
• An image laid out at zero size no longer fails the whole export.

Export styling

• An uploaded font can have a bold face of its own, used for headings and bold text.
• The header, the footer and each area of the first page take a colour of their own.
• The first page can have a background picture, drawn edge to edge.
• The preview of the first page, the header or the footer sits beside the settings while that section is open.

Automation

• The two Jira actions pick the page from a space and a title search, add signers without leaving the step, take a deadline from date pickers or a smart value, and list the smart values they return, written out whole.

• Both actions’ forms are laid out in sections like the settings screen, one open at a time. Signers added on the form stay on it, and every field is kept with the rule when it is saved.

• Export a page as PDF names the attached file after the document name, or the page title.

Security

• Every value SignPlus receives is checked before it is used: identifiers such as page ids and signing references must have their shape, and names, messages and other text lose control characters and the Unicode controls that reorder text on screen, and are held to a length. Security covers it.
• A webhook address must be a public https host, and a header may not contain a line break or replace a header SignPlus sets. Both are checked when saved and again before every delivery.
• REST API replies tell caches not to keep them.
• SignPlus takes part in Atlassian’s personal data reporting. Each week it reports the Confluence accounts it holds names and email addresses for, erases them for an account that was closed and refreshes them for one that changed. Retention covers it.

Byline and settings

• The byline under the page title reads Sign this page with a signature icon, and uses Confluence’s own status icons once a page has a signing.
• Every screen is available in Estonian. The byline’s signing state and the sentences SignPlus shows when it refuses a request stay in English.

Approval

Compared with the build these pages first described, this one adds four read scopes (read:content-details:confluence, read:confluence-groups, read:jira-work and search:confluence) and one new host, dam-cdn.atl.orangelogic.com, Atlassian’s image library hosted by Orange Logic, which receives only the request for a picture. A site running the earlier build approves them once, on upgrade. Each is explained in privacy and data handling.

---

A problem or a question? Write to support@oktul.com or open a request in the Help Center (opens in a new tab).