Repository navigation
Minor and patch versions breaking changes to API and protocol contracts #55055
jesperronn
started this conversation in
Feedback
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Breaking changes in SAML/OIDC contracts
In keycloak we have historically seen many changes that break the contract between SP and broker or between broker or IDP.
Could be interesting to hear if others share the same pain, and if you had thoughts about flagging all contract changes as BREAKING in some more obvious and visible ways.
Last time i encountered this was the security related change in #54902 (comment) backported to v26.6.8
in that case access to admin-related endpoints resulted in 401 access denied, because v26.6.7=>v26.6.8 required new client scope
kc-admin-api.Earlier i also saw changes for handling of
session_state,nonceand updated default digest algorithms for SAML. I cannot recall the details here so I expect these were all introduced with major version updates. But still i have the feeling that more changes sneak into minor and patch versions, that could potentially break the contract with external service providers and identity providers.Breaking changes in java libraries
Furthermore we have seen examples recently for methods that change their signature, both on minor and patch versions. These are usually easier to find before we deploy. But nevertheless, it means that even the tiniest patch require physical attention.
For examples we saw minor version contain
Definition of breaking changes
In two teams where we discussed this, i could feel the frustration, since every single update requires extra vigilant attention. Both teams had a hard time testing it automatically. So for those teams and from my perspective, a list of any breaking changes would be awesome.
In case i am missing out on something, let me know, link to the articles so that I can investigate further before next security update. Also I am aware that in these days, security incidents can happen very suddenly, leaving no time to polish release notes.
So my question is to other users: How do you manage updates? Share your tips, tricks. Perhaps also share suggestions to how you want the versioning to be moving forward
All reactions