For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/upgrade.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Upgrade

    JumpServer has two upgrade paths. Choose the one that matches the edition and installation method used for the deployment.

    EditionUpgrade methodPackage source
    Community EditionOnline installerGitHub releases
    Enterprise EditionOffline packageJumpServer delivery team
    Warning

    An upgrade restarts services and can interrupt active sessions. Plan a maintenance window, notify users, and create a verified database backup before you begin. See Backup & Restore.

    Before you begin

    • Read the changelog and release notes for the target version, including database and Redis requirements.
    • Confirm the supported upgrade path in Upgrade & Maintenance.
    • Back up the database and the active configuration with ./jmsctl.sh backup_db; copy the backup off the host.
    • Keep the current installation package and configuration until the new version has been verified.
    • Run the commands as root or a user with superuser privileges.

    Community Edition: online upgrade

    Use this path when JumpServer was installed with the online one-line installer and the server can reach GitHub.

    1
    Change to the /opt directory. sh cd /opt
    2

    Download the installer package for the target version.

    wget https://github.com/jumpserver/installer/releases/download/v5.1.1/jumpserver-installer-v5.1.1.tar.gz
    3

    Extract the package.

    tar -zxvf jumpserver-installer-v5.1.1.tar.gz
    4

    Change to the extracted directory.

    cd jumpserver-installer-v5.1.1
    5
    Run the upgrade. sh ./jmsctl.sh upgrade
    6
    Start the services. sh ./jmsctl.sh start

    Enterprise Edition: offline package upgrade

    Use this path when JumpServer was installed from an Enterprise offline package. The package is provided by the JumpServer delivery team and does not require internet access on the target server.

    1

    Obtain the Enterprise upgrade package and confirm that its version and CPU architecture match the target deployment.

    2
    Change to the /opt directory. sh cd /opt
    3

    Place the offline package in /opt. Upload it from the delivery portal, or use wget when the server can reach the download URL.

    Upload
    wget
    1

    Download the package from the offline package site provided by the delivery team.

    2

    Upload the package to /opt on the deployment server.

    4

    Extract the package.

    tar -zxvf jumpserver-ee-v5.1.1-x86_64.tar.gz
    5

    Change to the extracted directory.

    cd jumpserver-ee-v5.1.1-x86_64
    6

    Run the upgrade. The default options are sufficient for a standard deployment. sh ./jmsctl.sh upgrade

    7
    Start the services. sh ./jmsctl.sh start

    After the upgrade

    1. Check the service state: 
      ./jmsctl.sh status
    2. Sign in and confirm the version shown in the UI.
    3. Verify that users can open sessions and that recent recordings and audit logs are still available.
    4. For Enterprise Edition, confirm that the license is still valid. If needed, import it again from License.
    5. Review the Core and component logs for errors: 
      ./jmsctl.sh tail core
    6. If the upgrade fails, stop the services and restore the backup from Backup & Restore.

    Version-specific upgrade notes

    These notes describe the behavior changes and fixes in each target version. They do not change the upgrade commands in the preceding sections.

    JumpServer v5.1.0

    Changed in v5.1.0
    ChangeWhat to check after the upgrade
    OpenBao enables HTTPS by defaultVerify the OpenBao certificate and CA configuration, and update clients that connect to OpenBao directly. See Security hardening.
    DBX replaces DBeaver as the default remote database applicationConfirm that database sessions in Luna Workspace open with DBX. See Connection settings.
    Tinker provides standalone RDP desktops through the Windows authentication plugin instead of RemoteAppReview published Windows applications and the Tinker hosts that serve them. See RemoteApp.
    MFA user settings follow the system configuration by defaultConfirm the system-level MFA policy before users sign in. See Authentication.
    KoKo TUI restores the plain-text connection modeReview terminal access for direct SSH connections. See SSH Terminal.

    JumpServer v5.1.1

    Changed in v5.1.1
    ChangeWhat to check after the upgrade
    High availability deployments apply stronger persistent write protection to databases and RedisConfirm that databases and Redis keep working after container restarts, re-creation, and failure recovery. See Deployment topologies.
    Redeployment and switchover checks tolerate normal replication lagConfirm that redeployment and switchover finish without false failure reports. See Deployment topologies.
    Access Token format validation preserves fallback compatibility with other Bearer Token authentication methodsVerify API clients that authenticate with Bearer tokens. See Access keys.
    Tinker applet host deployment checks Group Policy, disables listener NLA before installation, and stops with guidance when Group Policy requires NLAReview the deployment result for Tinker hosts. See RemoteApp.

    Next steps