Security fix for CVE issue with dependency and improvements to Dark Theme Support.

On  we released version 3.1.2 of Userscripts for Confluence!

Summary

This is a security fix based on a CVE report.

It also provides some improvements for Confluence Dark Theme, especially in the Swagger UI.

New and Noteworthy

This release provides the following new and noteworthy features.

CVE-2025-48924

The Userscripts for Confluence app uses the platform dependency to commons-lang in a version that has been reported vulnerable to CVE-2025-48924.

For detailed information, please refer to https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1.

The vulnerability is reported to be fixed in 3.18.0. This version updates this dependency.

Dark Theme Support

This version provide a couple of fixes to render compliant to Dark Theme.

Installation Instructions

Simply install the app via the Atlassian Marketplace or the downloaded OBR artifact.

If you use a previous version of Confluence, please select Userscripts for Confluence 2.4.3.

Upgrade Instructions

This version supports Confluence version 9.2.x. and later.

For previous versions of Confluence there are separate versions of the projectdoc Toolbox:

  • If you use a version of Confluence < 9.x , please select Userscripts for Confluence 2.4.3
  • For Confluence 9.0.x and 9.1.x we recommend to upgrade to Confluence 9.2.x (LTS) or alternatively use version 3.0.x of Userscripts for Confluence

List of Changes

Key Summary T P Status Resolution Description
USR4C-49 Update CSS and Images for Dark Theme Improvement Major Done Fixed

Make the highlighting in the scripts’s list and the images compatible with Confluence Dark Theme.

USR4C-47 CVE-2025-48924 affects pkg:maven/org.apache.commons/commons-lang3@3.17.0 Bug Blocker (migrated) Done Fixed

The Userscripts for Confluence app uses the platform dependency to commons-lang in a version that has been reported vulnerable to CVE-2025-48924.

For detailed information, please refer to https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1.

The vulnerability is reported to be fixed in 3.18.0 and above.

USR4C-48 start-index defaults to zero Bug Minor Done Fixed

The start-index parameter of the /userscripts REST service is marked as required.

The parameter must be marked as optional since it defaults to zero.