> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt. # Upgrade JumpServer has two upgrade paths. Choose the one that matches the edition and installation method used for the deployment. | Edition | Upgrade method | Package source | | ------------------ | ---------------- | ------------------------ | | Community Edition | Online installer | GitHub releases | | Enterprise Edition | Offline package | JumpServer delivery team | Warning An upgrade restarts services and can interrupt active sessions. Plan a maintenance window, notify users, and create a verified database backup before you begin. See [Backup & Restore](https://www.jumpserver.com/docs/operations/backup-restore.md). ## Before you begin - Read the [changelog](https://www.jumpserver.com/docs/reference/changelog.md) and release notes for the target version, including database and Redis requirements. - Confirm the supported upgrade path in [Upgrade & Maintenance](https://www.jumpserver.com/docs/operations/upgrade-maintenance.md). - Back up the database and the active configuration with `./jmsctl.sh backup_db`; copy the backup off the host. - Keep the current installation package and configuration until the new version has been verified. - Run the commands as `root` or a user with superuser privileges. ## Community Edition: online upgrade Use this path when JumpServer was installed with the online one-line installer and the server can reach GitHub. 1 Change to the `/opt` directory. `sh cd /opt ` 2 Download the installer package for the target version. ```sh wget https://github.com/jumpserver/installer/releases/download/v5.1.1/jumpserver-installer-v5.1.1.tar.gz ``` 3 Extract the package. ```sh tar -zxvf jumpserver-installer-v5.1.1.tar.gz ``` 4 Change to the extracted directory. ```sh cd jumpserver-installer-v5.1.1 ``` 5 Run the upgrade. `sh ./jmsctl.sh upgrade ` 6 Start the services. `sh ./jmsctl.sh start ` ## Enterprise Edition: offline package upgrade Use this path when JumpServer was installed from an Enterprise offline package. The package is provided by the JumpServer delivery team and does not require internet access on the target server. 1 Obtain the Enterprise upgrade package and confirm that its version and CPU architecture match the target deployment. 2 Change to the `/opt` directory. `sh cd /opt ` 3 Place the offline package in `/opt`. Upload it from the delivery portal, or use `wget` when the server can reach the download URL. **Upload** 1 Download the package from the offline package site provided by the delivery team. 2 Upload the package to `/opt` on the deployment server. **wget** 1 Copy the package download link from the delivery portal. 2 Replace `YOUR_DOWNLOAD_URL` with the copied link and download the package. ```sh cd /opt && wget -O jumpserver-ee-v5.1.1-x86_64.tar.gz "YOUR_DOWNLOAD_URL" ``` 4 Extract the package. ```sh tar -zxvf jumpserver-ee-v5.1.1-x86_64.tar.gz ``` 5 Change to the extracted directory. ```sh cd jumpserver-ee-v5.1.1-x86_64 ``` 6 Run the upgrade. The default options are sufficient for a standard deployment. `sh ./jmsctl.sh upgrade ` 7 Start the services. `sh ./jmsctl.sh start ` ## After the upgrade 1. Check the service state: ```sh ./jmsctl.sh status ``` 2. Sign in and confirm the version shown in the UI. 3. Verify that users can open sessions and that recent recordings and audit logs are still available. 4. For Enterprise Edition, confirm that the license is still valid. If needed, import it again from [License](https://www.jumpserver.com/docs/reference/license.md). 5. Review the Core and component logs for errors: ```sh ./jmsctl.sh tail core ``` 6. If the upgrade fails, stop the services and restore the backup from [Backup & Restore](https://www.jumpserver.com/docs/operations/backup-restore.md). ## Version-specific upgrade notes These notes describe the behavior changes and fixes in each target version. They do not change the upgrade commands in the preceding sections. ### JumpServer v5.1.0 Changed in v5.1.0 | Change | What to check after the upgrade | | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OpenBao enables HTTPS by default | Verify the OpenBao certificate and CA configuration, and update clients that connect to OpenBao directly. See [Security hardening](https://www.jumpserver.com/docs/operations/security-hardening.md). | | DBX replaces DBeaver as the default remote database application | Confirm that database sessions in Luna Workspace open with DBX. See [Connection settings](https://www.jumpserver.com/docs/features/client/connection-settings.md). | | Tinker provides standalone RDP desktops through the Windows authentication plugin instead of RemoteApp | Review published Windows applications and the Tinker hosts that serve them. See [RemoteApp](https://www.jumpserver.com/docs/features/system-settings/infrastructure/remote-app.md). | | MFA user settings follow the system configuration by default | Confirm the system-level MFA policy before users sign in. See [Authentication](https://www.jumpserver.com/docs/features/system-settings/security/authentication.md). | | KoKo TUI restores the plain-text connection mode | Review terminal access for direct SSH connections. See [SSH Terminal](https://www.jumpserver.com/docs/features/workbench/ssh-terminal.md). | ### JumpServer v5.1.1 Changed in v5.1.1 | Change | What to check after the upgrade | | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | High availability deployments apply stronger persistent write protection to databases and Redis | Confirm that databases and Redis keep working after container restarts, re-creation, and failure recovery. See [Deployment topologies](https://www.jumpserver.com/docs/operations/deployment-topologies.md). | | Redeployment and switchover checks tolerate normal replication lag | Confirm that redeployment and switchover finish without false failure reports. See [Deployment topologies](https://www.jumpserver.com/docs/operations/deployment-topologies.md). | | Access Token format validation preserves fallback compatibility with other Bearer Token authentication methods | Verify API clients that authenticate with Bearer tokens. See [Access keys](https://www.jumpserver.com/docs/features/general/account/access-keys.md). | | Tinker applet host deployment checks Group Policy, disables listener NLA before installation, and stops with guidance when Group Policy requires NLA | Review the deployment result for Tinker hosts. See [RemoteApp](https://www.jumpserver.com/docs/features/system-settings/infrastructure/remote-app.md). | ## Next steps - [Upgrade & Maintenance](https://www.jumpserver.com/docs/operations/upgrade-maintenance.md): supported version paths and post-upgrade checks. - [Backup & Restore](https://www.jumpserver.com/docs/operations/backup-restore.md): create and verify a rollback point. - [Command-Line Tools](https://www.jumpserver.com/docs/operations/cli-tools.md): `jmsctl` service and data commands. - [Enable HTTPS](https://www.jumpserver.com/docs/operations/enable-https.md): secure the upgraded deployment.