js deps uuid 26.6 by stianst · Pull Request #49539 · keycloak/keycloak

stianst · 2026-06-01T10:12:55Z

[client-v2] Require 'clientId' in the payload ([client-v2] Require 'clientId' in the payload #47533)
Avoid running CI on copilot branches
Bump vite from 7.3.0 to 7.3.2 in /js (Bump vite from 7.3.0 to 7.3.2 in /js #47785)
Bump the actions-dependencies group across 1 directory with 3 updates (Bump the actions-dependencies group across 1 directory with 3 updates #47168)
fix: mapping mtls enabled to a runtime option (fix: mapping mtls enabled to a runtime option #47751)
Validate .conf extension for --config-file option (Validate .conf extension for --config-file option #47696)
Update health check instructions
Handle special characters in mvnw.cmd Windows paths
fix: combining / removing static and initialization logic (fix: combining / removing static and initialization logic #46918)
Pin Azure CLI to 2.82.0 to fix JSON parsing error (Pin Azure CLI to 2.82.0 to fix JSON parsing error #47828)
Keycloak user enumeration via identity-first login
fix: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls closes: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls #47700
fix: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls closes: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls #47700
fix: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls closes: Duplicate entries created in Role Attributes during concurrent setSingleAttribute calls #47700
CloudNativePG 1.29
[OID4VCI] Fix OID4VCI token typ defaults by credential format ([OID4VCI] Fix OID4VCI token typ defaults by credential format #47779)
Also deploy keycloak-authz-client-tests when deploy-testsuite profile is active
fix typo extraneous $ template in doc (fix typo extraneous $ template in doc #47861)
Allow customization of SAML service provider metadata
Fix Cluster Compatibility Tests for 26.6
Fix low-severity npm transitive dependency vulnerabilities via pnpm overrides (Fix low-severity npm transitive dependency vulnerabilities via pnpm overrides #47688)
Update the translation guidelines for humans and AI
Replace LoginPage#open() with OAuthClient#openLoginForm()
Remove ignored-links after 26.6.0
[OID4VCI] TokenResponse requires credential_identifiers in authorization_details ([OID4VCI] TokenResponse requires credential_identifiers in authorization_details #47404)
Fix requesting tokens with multiple organization scopes
Fix requesting tokens with multiple organization scopes
[OID4VCI-HAIP] Pass oid4vci-1_0-issuer-fail-replay-nonce ([OID4VCI-HAIP] Pass oid4vci-1_0-issuer-fail-replay-nonce #47479)
fix: consistently resetting the configuration (fix: consistently resetting the configuration #47870)
fix: remove extra dependencies from the operator (fix: remove extra dependencies from the operator #47912)
Declarative UI: Avoid silent failure when adding additional path params (Declarative UI: Copy params map to avoid silent failure to add path params #47884)
Update tests in common to use JUnit 6
removed invalid package reference (removed invalid package reference #47906)
Migration Tool - Removing AbstractKeycloak extends. (Migration Tool - Removing AbstractKeycloak extends. #47691)
[OID4VCI-HAIP] Pass oid4vci-1_0-issuer-metadata_test
Updating core-iam team metadata with the area/scim label (Updating core-iam team metadata with the area/scim label #47823)
Split ApiUtil into ApiUtil and AdminApiUtil in old testsuite (Split ApiUtil into ApiUtil and AdminApiUtil in old testsuite #47942)
Migration Tool - Updating MigrateTest. (Migration Tool - Updating MigrateTest. #47509)
Fix session type of access token in offline access refresh token flow
Database data at rest encryption
Add keycloak.v2 device verification template (Fix device user code input styling in keycloak.v2 login theme #47283)
Fixing SSSD LoginPage and ApiUtil changes not propagated from recent base package updates. (Fixing SSSD LoginPage and ApiUtil changes not propagated from recent base package updates. #47949)
Fix multiselect options not highlighted as selected in user profile
Rename 'Pre-Authorized Code Lifespan' to 'Credential Offer Lifespan' (Rename 'Pre-Authorized Code Lifespan' to 'Credential Offer Lifespan' #47563)
feat(admin cli client v2): show help based on Keycloak server version (Client API v2 CLI client: provide help and autocomplete based on Keycloak version of the logged session #47525)
Add CoC to README (Add CoC to README #47964)
fix: introduces the concept of a synthetic option (fix: introduces the concept of a synthetic option #47399)
fix(admin-ui): replace explicit catch (error: any) with proper types (fix(admin-ui): replace explicit catch (error: any) with proper types #47397)
Add Vietnamese (vi) locale support with initial translations
Remove console.log from admin UI workflow test
Bump docker/login-action from 3.7.0 to 4.1.0 (Bump docker/login-action from 3.7.0 to 4.1.0 #47977)
removed postinstall script (removed postinstall script #47907)
refactor(admin-ui): replace use-react-router-breadcrumbs with React Router native useMatches
Add account-console to defaultClients to prevent deletion of built-in client
Fix NumberFormatException in OIDC attribute mapper for empty/invalid values
Update migrate_db.adoc (Update migrate_db.adoc #47894)
Prevent duplicate entries and reordering in openapi.yaml on incremental builds (Prevent duplicate entries and reordering in openapi.yaml on increment… #47968)
Update with core authn team (Update with core authn team #47780)
Continue with next step when IdP returns an error
Not possible to sync latest keycloak-admin-client to keycloak-client (Not possible to sync latest keycloak-admin-client to keycloak-client #47950)
New client service - PUT/POST - update or create client (New client service - PUT/POST - update or create client #47029)
Bump azure/login from 2.3.0 to 3.0.0 (Bump azure/login from 2.3.0 to 3.0.0 #47973)
Fixing product name convention in the docs
Added the doc for cnpg monitoring standbys
Make sure user-defined user profile config is set if provided
Fixing explicit docs anchor for organizations
Disable automatic redirect handling in the HTTP provider
Migrate session package to new test framework
[OID4VCI] Migrate and consolidate OID4VC Protocol Mapper tests to new test framework
Sync client scope state between tabs in dedicated scopes
Fix typo: boostrap to bootstrap in documentation files and strings (Fix typo: boostrap to bootstrap in documentation files and strings #48034)
[OID4VCI] Remove unwanted clientId=test-app from OID4VCIssuerTestBase
fix: MigrateTo26_6_0 should only add organization step to built-in browser flow
Running browser flow organization migration on 26.6.1
Review - update the VERSION, rewording the migration
Allow deleting subflows and executions if the parent is not a built-in flow
[OID4VCI] Default client scopes not configured correctly ([OID4VCI] Default client scopes not configured correctly #47903)
Translations update from Hosted Weblate (Translations update from Hosted Weblate #47830)
Account UI throws error when accessing applications tab without permissions
Migrate Organization Groups tests into new testsuite
Allow organization IdPs for members linked to another broker
Account UI throws error when opening an unknown path (Account UI throws error when opening an unknown path #48054)
Handle resource IDs matching the resource type for "Enforce access to" -> "All"
Add workflows to the area drop-down when opening new issues
Update Openshift version referenced in the HA guide from 4.18 to 4.21
Pass and use rememberMe option in passkeys authenticators
Detect insecure context for HTTPS iframes embedded in HTTP pages
when the realm session limit is exceeded and behavior is set to Termi… (when the realm session limit is exceeded and behavior is set to Termi… #48064)
fix: using inputstream to represent patches (fix: using inputstream to represent patches #47953)
Override hasDirectRole in GroupAdapter to use targeted query
Use the correct resource in ClientResourceTypeWorkflowProvider#resolveResource
Build Quarkus from source in quarkus-next workflow (Build Quarkus from source in quarkus-next workflow #47892)
makes redirect uris validation more relaxed (makes redirect uris validation more relaxed #48004)
feat(admin-api-v2): make CLI discriminator subcommand optional (Client API v2 CLI client: make discriminator subcommand optional #48018)
testsuite: fix 'occured' -> 'occurred' in AbstractCommand error log (testsuite: fix 'occured' -> 'occurred' in AbstractCommand error log #48118)
fix: converting db-connect-timeout to be used for all datasources (fix: converting db-connect-timeout to be used for all datasources #48055)
Fixed a broken link in deploy-cnpg.adoc. Slightly rephrased some sentences
fix: creating a cleaner module for use by java clients (fix: creating a cleaner module for use by java clients #47874)
[OID4VCI] QR Code Unbounded Dimensions DoS
[OID4VCI] Add comprehensive testing for pre-installed vc configs
Migrate Organization Authz tests into new testsuite (Migrate Organization Authz tests into new testsuite #48131)
fix: reviewed hidden options for what can be removed (fix: reviewed hidden options for what can be removed #48020)
fix: exposing hidden management options (fix: exposing hidden management options #48167)
Migrate Organization Cache tests into new testsuite
Add CLI options for mTLS database connections
Monitoring of CNPG backups
More robust handling of the algorithm:none in TokenManager. Tests for tokens using 'alg: none' would fail client authentication
Fixing teams ownership for core authn (Fixing teams ownership for core authn #48135)
Proxy: TLS reencryt and passthrough docs
Add info note to the X.509 Canonical DN representation enabled option
Update password after email verification during registration of users (Update password after email verification during registration of users #47538)
AuthZen Evaluation API
Remove http enabled check to cater for TLS terminating proxies
Revert KeycloakProcessor changes and add empty beans.xml
Adding staleness concept to JDBC_PING
[OID4VCI] credential_offer_uri can only be consumed once
Fix duplicated resource on current and next page in Auth Resources (Fix duplicated resource on current and next page in Auth Resources #47446)
Include shared GitHub Actions in dependabot
Bump actions/cache in /.github/actions/corepack-setup (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/corepack-setup #48245)
Bump actions/cache from 4.2.3 to 5.0.5 (Bump actions/cache from 4.2.3 to 5.0.5 #48243)
Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/maven-cache (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/maven-cache #48247)
Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/node-cache (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/node-cache #48248)
Bump actions/cache in /.github/actions/pnpm-store-cache (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/pnpm-store-cache #48250)
Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/prunsrv-setup (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/prunsrv-setup #48251)
Bump actions/cache in /.github/actions/quarkus-snapshot-cache (Bump actions/cache from 4.2.3 to 5.0.5 in /.github/actions/quarkus-snapshot-cache #48252)
Bump actions/upload-artifact from 6.0.0 to 7.0.1 (Bump actions/upload-artifact from 6.0.0 to 7.0.1 #47974)
Bump actions/download-artifact from 7.0.0 to 8.0.1 (Bump actions/download-artifact from 7.0.0 to 8.0.1 #47976)
Bump actions/upload-artifact in /.github/actions/build-keycloak (Bump actions/upload-artifact from 4.6.2 to 7.0.1 in /.github/actions/build-keycloak #48244)
Bump actions/download-artifact (Bump actions/download-artifact from 4.3.0 to 8.0.1 in /.github/actions/integration-test-setup #48246)
Bump actions/upload-artifact in /.github/actions/upload-flaky-tests (Bump actions/upload-artifact from 4.6.2 to 7.0.1 in /.github/actions/upload-flaky-tests #48253)
Bump actions/setup-node in /.github/actions/pnpm-setup (Bump actions/setup-node from 4.4.0 to 6.4.0 in /.github/actions/pnpm-setup #48249)
Bump github/codeql-action in the actions-dependencies group (Bump github/codeql-action from 4.35.1 to 4.35.2 in the actions-dependencies group #48228)
Registration with email verification - corner case scenario for pre-a… (Registration with email verification - corner case scenario for pre-a… #48208)
Initial support for OAuth 2.0 Attestation-based client authentication (Add support for OAuth 2.0 Attestation-based client authentication #47962)
Remove preview feature sections from Kubernetes docs
Do not use inline handlers when rendering org buttons
fix: ensures that owner references are updated after an upgrade (fix: ensures that owner references are updated after an upgrade #48213)
Remove deprecated method OAuthClient#clientId (Remove deprecated method OAuthClient#clientId #48240)
Ordering of permission and policy calls leads to exposure of a client ID
Able to update Identity Provider alias via admin console and API
Make IDP alias immutable in REST API
Search realms by displayName closes Search realms by "Display name" in the "Manage realms" view #45292
[Old Arquillian testsuite] Migrating Assert JUnit4 to Assertions JUnit5 ([Old Arquillian testsuite] Migrating Assert JUnit4 to Assertions JUnit5 #47893)
[OID4VCI-HAIP] Pass oid4vci-1_0-issuer-happy-flow (encrypted) ([OID4VCI-HAIP] Pass oid4vci-1_0-issuer-happy-flow (encrypted) #47674)
Introduce ManagedRealm in old testsuite (Introduce ManagedRealm in old testsuite #48305)
Remove legacy Client API V2 service (Remove legacy Client API V2 service #48091)
Build QOSDK from source in quarkus-next workflow (Build QOSDK from source in quarkus-next workflow #48174)
Enforce the remote management check (Enforce the remote management check #48111)
A User belonging to multiple organization should be allowed to change his organization choice during login (A User belonging to multiple organization should be allowed to change… #48165)
Add a title atttribute for the freemarker templates (Add a title atttribute for the freemarker templates #48276)
Disable FreeMarker ?new() built-in in themes. Closes FreeMarker templates allow instantiation of new objects and even running OS commands #47915 (Disable FreeMarker ?new() built-in in themes. #48280)
Fix Maven repository extraction on Aurora/Azure VMs (Fix Maven repository extraction on Aurora/Azure VMs #48175)
Introduce manage-organizations, view-organizations admin roles for Organization management
Fix build problems (Fix build problems #48325)
Add documentation changes for verifying the keycloak email for user
HAProxy tls-passthrough blueprint
feat(admin-api-v2): rename 'update' command to 'apply' (Client API v2 CLI client: rename update command to apply to reflect that it can create resources as well as update them #48134)
No escape approach for JS code inside the FTL pages
Update timeout for FIPS integration tests in ci.yml (Update timeout for FIPS integration tests in ci.yml #48361)
Fix SSSD tests (Fix SSSD tests #48360)
Replace @beforeeach guard with @testsetup in ClientApiV2AuthorizationTest (Replace @BeforeEach guard with @TestSetup in ClientApiV2Authorization… #48364)
[OID4VCI] Remove unwanted selenium exception handling ([OID4VCI] Remove unwanted selenium exception handling #48312)
SignatureProvider null check
fix: use distance measure for unknown options (fix: use distance measure for unknown options #48217)
Missing migration to update the group resource type with the manage-membership-of-members scope
Restore Quarkus snapshot cache in unit-test-setup for quarkus-next (Restore Quarkus snapshot cache in unit-test-setup for quarkus-next #48358)
[OID4VCI] Revisit invalid authorization requests handling ([OID4VCI] Revisit invalid authorization requests handling #47850)
chore(testsuite): migrate error package to new test framework (Migrate error package to new test framework #48186)
chore(tests): migrate vault package to new test framework (Migrate vault package to new test framework #48266)
Refactor builders in testsuite part 1 (Refactor builders in testsuite part 1 #48315)
fix: correctly handle duplicate values in setAttribute()
[OID4VCI] Fix JWT proof validation gaps and attestation verification ([OID4VCI] Fix JWT proof validation gaps and attestation verification #47995)
Update SAML documentation with default cache TTL (Update SAML documentation with default cache TTL #48373)
Translations update from Hosted Weblate (Translations update from Hosted Weblate #48092)
Fix log messages in workflow step providers
Add details to AdminEvent in UserResource.removeCredential
chore: migrate url package to new test framework (Migrate url package to new test framework #48212)
Move OID4VCIssuerEndpointTest.java, OID4VCSdJwtPreInstalledNaturalPersonTest.java to the new testsuite
wait for AppPage to load
Fix OpenAPI spec key reordering on incremental builds (Fix OpenAPI spec key reordering on incremental builds #48371)
[OID4VCI] align issuer metadata/encryption behavior, move encryption tests to base suite ([OID4VCI] align issuer metadata/encryption behavior and move encryption tests to base suite #48048)
** Migrated UserSessionLimitsTest and UserSessionLimitsUtils ( Migrated UserSessionLimitsTest and UserSessionLimitsUtils #48187)**
Cleanup OID4VCIssuerEndpointTest, OID4VCSdJwtPreInstalledNaturalPersonTest
[OID4VCI] add encrypted request/response support to OID4VC OAuth test client ([OID4VCI] add encrypted request/response support to OID4VC OAuth test client #48462)
fix: updates to create a java admin client build (fix: updates to create a java admin client build #48343)
Fix OID4VCI resource Date headers for conformance and add regression tests ([OID4VCI]: Fix OID4VCI resource Date headers for conformance and add regression tests #48277)
Enable to set mediation property for WebAuthn passwordless authentication (improve WebAuthn auth w/ auto-modal on page load #46960)
Fix testsuites as UserSessionLimitsTest was moved, but suites not updated (Fix testsuites as UserSessionLimitsTest was moved, but suites not updated #48493)
Escape expressions in JS blocks in FTL pages
Make acceptable AAGUID ckeck in WebAuthn stricter Closes [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration #48388
Check Acceptable AAGUIDs sets a attestation preference different to None in admin console Closes [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration #48388
Changes for rebase and review. Closes [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration #48388
Synchronize workflow scheduled settings using cluster events (Synchronize workflow scheduled settings using cluster events #48422)
Migration fails for organization admin roles with LazyInitializationException
Add id and description when building ResourceType representation (Add id and description when building ResourceType representation #48499)
Fix declarative UI page change with signaled data table loading
Account ResourceService user endpoint returns excessive user data in UMA-enabled realms
Block shutdown if the Infinispan cluster is not stable
fix: validate resource type consistency when adding resources to FGAP permissions
UserSessionLimitsTest added to multiSite suite (UserSessionLimitsTest added to multiSite suite #48510)
Admin console localizate realm name
Refactor builders in testsuite part 2 (Refactor builders in testsuite part 2 #48454)
Translations update from Hosted Weblate (Translations update from Hosted Weblate #48437)
Conditional modal for passkeys platform authenticator
[OID4VCI] Move CredentialBuilderTest.java, JwtCredentialBuilderTest.java, SdJwtCredentialBuilderTest.java to the new testsuite
Block shutdown if the Infinispan cluster is not stable
Inject theme descriptions and make paths dynamic (Inject theme descriptions and make paths dynamic #47771)
[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity ([OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity #48321)
[OID4VCI-FAPI2] Improved error messages in ConfidentialClientAcceptExecutor
Ensure read-only multivalued UP attribute is not editable (grayed out) in the account console (Ensure read-only multivalued UP attribute is not editable (grayed out… #48544)
add validation to description based on the validation annotations (add validation to description based on the validation annotations #47375)
Migrate the SSOTest
Show Groups tab in the account console when user is part of any group
fix: generalizing the augmentation check (fix: generalizing the augmentation check #47748)
Introduce ORGANIZATIONS resource type in Fine-Grained Admin Permissions
AuthZEN lookup subject.type=user based upon username not UUID
Generalize user search prefix lookups via UserSearchPrefix enum (Allow user search by direct lookup via username and email #26602)
Support for custom user scim extension
Start Keycloak sequentially in model tests
Skip no-op reorder in authentication flow drag-and-drop
Fix ScrollForm jump links not tracking active section on scroll
Move withStartupTimeout configuration to WaitAllStrategy
Fixing flaky test
Migrate PasswordPolicyTest to new test framework (Migrate PasswordPolicyTest to new test framework #48583)
Adding blank lines at the beginning to render content correctly (Adding blank lines at the beginning to render content correctly #48531)
[quarkus-next] Model tests fail due to ByteBuddy removal from Hibernate runtime classpath ([quarkus-next] Model tests fail due to ByteBuddy removal from Hiberna… #48560)
Propogate X-Request-ID headers in AuthZEN requests to responses
Upgrade webauthn4j to 0.30.3
Windows Service fails on slower runners due to insufficient startup timeout (Windows Service fails on slower runners due to insufficient startup t… #48630)
HttpDistTest.maxQueuedRequestsTest fails on runners with limited vCPUs (HttpDistTest.maxQueuedRequestsTest fails on runners with limited vCPUs #48599)
Quarkus UT (windows-latest) cancelled when ubuntu variant fails (Quarkus UT (windows-latest) cancelled when ubuntu variant fails #48562)
AuthZEN allow configurable subject lookup semantics
Traefik-passthrough doc file
Return 400 instead of 500 when role update has no name
Add @DefaultValue to max param used in Admin REST APIs (Add @DefaultValue to document the max param used in several Admin REST APIs #47561)
updates for quarkus:dev mode (updates for quarkus:dev mode #47848)
Rewrite AssertEvents expectLoginEvent to EventAssertion. (Rewrite AssertEvents expectLoginEvent to EventAssertion. #48467)
Enforce resource server predicates if one was given despite the IS_ADMIN flag (Enforce resource server predicates if one was given despite the IS_ADMIN flag #48385)
Remove form data from the registerNode and unregisterNode method signature (Remove form data from the registerNode and unregisterNode method signature #48633)
Prevent ASCII control characters in query parameters
fix: trigger INVITE_ORG and REGISTER event when a new user is invited
Refactor SSSD tests to use JUnit5 Assertions. (Refactor SSSD tests to use JUnit5 Assertions. #48673)
Make OrganizationGroupMembershipMapper claim name configurable (Make OrganizationGroupMembershipMapper claim name configurable #47852)
DPoP for implicit flow
Changes to address Org subdomain matching (Add Wildcard Subdomain Matching Support for Organization Domains #45190)
is-45364 migrate Client Api V2 tests to utilize adminClient (is-45364 migrate Client Api V2 tests to utilize adminClient #47789)
Translations update from Hosted Weblate (Translations update from Hosted Weblate #48567)
move phishing check (move phishing check #48495)
Upgrade to Quarkus 3.33.1.1 (Upgrade to Quarkus 3.33.1.1 #48688)
*Block .js.map files in production. (Block *.js.map files in production. #48301)
[OID4VCI] Support for credentials CRUD (DB and admin REST endpoints) closes [OID4VCI] Support for credentials CRUD (DB and admin REST endpoints) #48546
Duplicated flows can have illegal characters in step name
Adding event details for better runtime analysis
[quarkus-next] Aurora CI fails with missing quarkus-bom:999-SNAPSHOT on remote EC2 VM ([quarkus-next] Aurora CI fails with missing quarkus-bom:999-SNAPSHOT … #48595)
Refactor runonserver APIs for easier test migration (Refactor and unify RunOnServer modules #48363)
Rewrite AssertEvents expectLogout and expectLogoutError into EventAssertion methods. (Rewrite AssertEvents expectLogout and expectLogoutError into EventAssertion methods. #48638)
Stop using jboss-parent (Stop using jboss-parent #46241)
Remove unused TestingResource methods (Remove unused TestingResource methods #48711)
fix: initial projection implementation (Admin API v2 Projection #48460)
Ensure MSSQL sever deployments have the IDX_IDP_FOR_LOGIN index created
Enforce non-empty role and group names
Resolve SA before resolving users from username or email
New maintainer - Ricardo Martin (New maintainer - Ricardo Martin #48672)
Reject CORS requests with invalid Origin before endpoint logic runs
Allow mapping user attributes to SCIM attributes via User Profile UI
Add startup check for missing database indexes
Ignore oasis-open.org in ExternalLinksTest (Ignore oasis-open.org in ExternalLinksTest #48682)
Align the format of the annotation kc.scim.schema.attribute to how SCIM defines custom schema attributes
Identity Provider detail settings allow saving without changes
Simplifying session context handling, ensuring an always started transaction
[CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled
pre-compute password denylist Bloom filter to speed up server startup
Fix MSSQL queries to work with case sensitive collations
Need area/ssf on area selection dropdown when creating an issue
AuthZen Evaluations API
Test update-compatibility without building or starting Quarkus (Test update-compatibility without building or starting Quarkus to save little time #48662)
Document how to check MSSQL transaction isolation level
fix: services module must use context, not inject
Fix virtual thread check
Rename blacklist to denylist in password policy
chore(tests): migrate ssl package to new test framework (Migrate ssl package to new test framework #48407)
rest credential offer experimental feature
fix: simplifying the management of the raw distribution (fix: updating the test extension logic #48759)
Document provided ProtocolMapper implementations (Document provided ProtocolMapper implementations #47331)
Improve documentation for cases when migrating from FGAP:V1 to V2
Refactor test class - OID4VCJWTIssuerEndpointTest (Refactor test class - OID4VCJWTIssuerEndpointTest #48644)
Prevent setting different than default decisionStrategy for FGAP
Add OAuth 2.0 compliant redirect URI validation
Allow Token Exchange of sender constrained tokens issued for the original client
Unify mail in old and new testsuites (Unify mail in old and new testsuites #48785)
Update WebAuthn Metadata service and show icons (Update WebAuthn Metadata service and show icons #48551)
chore(gh ci): drop Quarkus IT container runs (Drop Quakrus container integration test runs #48664)
Fix save button not enabled when name is pasted on "Create organization" page (Fix save button not enabled when name is pasted on "Create organization" page #48883)
Typo in ClientAdapter.isFrontchannelLogout()
Resolve realm display name localization placeholders in TOTP issuer name (Resolve realm display name localization placeholders in TOTP issuer name #48700)
Enable @typescript-eslint/no-unnecessary-condition ESLint rule (fix(admin-ui): enable no-unnecessary-condition ESLint rule #48218)
Do not allow wildcards in the hostname for Valid Redirect Address (Do not allow wildcards in the hostname for Valid Redirect Address #48793)
Unhandled NPE with alg:none JWT in Bearer Authentication (Unhandled NPE with alg:none JWT in Bearer Authentication #48798)
Export/import support for credentials closes [OID4VCI] Export/import support for credentials #48679
SAML WildFly adapter, impact of the WildFly catalog Signed-off-by: Jean-Francois Denise jdenise@redhat.com
Upgrade to WildFly 39.0.1.Final, allow for usage of Galleon family Signed-off-by: Jean-Francois Denise jfdenise@gmail.com
verifiable credential tab in admin ui
Update Ukrainian translations and add language maintainers (Update Ukrainian translations and add language maintainers #48884)
Upgrade dbus-java to 5.2.0 Closes Use SecureRandom instead of Random for D-Bus cookie generation in SSSD federation #47294
Add dbus-java as a common dependency Closes Use SecureRandom instead of Random for D-Bus cookie generation in SSSD federation #47294
remove oid4vc protocol from create client form
Documents the operator's support for TLS re-encryption. (Documents the operator's support for TLS re-encryption. #47565)
refactor(quarkus it): skip realm bootstrap for faster Quarkus ITs (Quarkus IT execution time savings: skip realm bootstrap when not required #48809)
Add social button support to test framework page objects
Add Shared Signals Framework Transmitter capability (Deliver the baseline to enable Keycloak as an SSF Transmitter #48901)
Migrate JwtCredentialSignerTest, SdJwtCredentialSignerTest
Migrate OID4VCJWTIssuerEndpointDisabledTest and OID4VCSdJwtIssuingEndpointDisabledTest
Migrate OrganizationTest
Missing locale keys in Organization Membership protocol mapper
Ignore dynamic scopes when feature is not enabled
Fix test framework server startup not configurable
Refactor legacy test suite's TimeOffset (Refactor legacy test suite's TimeOffset #48756)
Mention SHA1 is deprecated in the documentation
Fix lint issues in the admin console (Fix lint issues in the admin console #48950)
[OID4VCI] Test in OID4VCActionTest for the correct client scenarios. Handle scenarios for invalid or disabled clients closes [OID4VCI] Test in OID4VCActionTest for the correct client scenarios #48886
verifiable credential in account console (verifiable credential in account console #48940)
'Not username' and 'Not email' options when creating/changing a password, should ignore letter case when comparing password to email or to username ('Not username' and 'Not email' options when creating/changing a password, should ignore letter case when comparing password to email or to username #22804)
fix: refining startup, and adding a log on async start error (fix: refining startup, and adding a log on async start error #48733)
Dynamic scopes: requested scopes get mixed up between token requests (Dynamic scopes: requested scopes get mixed up between token requests #48955)
fix: adding aot compiliation to quarkus tests (fix: adding aot compiliation to quarkus tests #48891)
chore(quarkus): avoid transitive kotlinx-metadata-jvm deployment-only dep (Exclude transitive Quarkus deployment module dependency kotlinx-metadata-jvm #48953)
Override org.postgresql:postgresql version (Override org.postgresql:postgresql version #48991)
Fix NPE in OrganizationGroupMembershipMapper when no organization scope is requested
Allow using the parameter in the consent text for dynamic scopes Closes Make the consent screen text for dynamic scopes customizable with a reference to the dynamic scope parameter #9915
[OID4VCI] Add a client policy to require a credential offer ([OID4VCI] Add a client policy to require a credential offer #47286)
chore(quarkus): only show OTel Metrics in community build (Show OpenTelemetry Metrics feature in community build, but allow downstream projects to hide it #49002)
Return invalid_client for introspection client auth failures
chore(quarkus): remove reactive routes extension (Remove Quarkus Reactive Routes extension #49024)
Test Migration tool - adding AssertEvents Rewrite (Test Migration tool - adding AssertEvents Rewrite #48957)
Test Migration tool - fixing MailServerRewrite (Test Migration tool - fixing MailServerRewrite #48959)
Test migration util - Migrate timeoffset (Test migration util - Migrate timeoffset #48972)
RAR scope parsing should explicitly accept client reference (RAR scope parsing should explicitly accept client reference #48981)
UI should prevent admins from defining a dynamic client scope with type Default (UI should prevent admins from defining a dynamic client scope with type Default #48973)
Fix Keycloak Connection Timeout Issue to Prevent Hanging Connections
Enable Enter key to trigger search in SearchInputComponent (Enable Enter key to trigger search in SearchInputComponent #49029)
HAProxy re-encrypt documentation
Translations update from Hosted Weblate (Translations update from Hosted Weblate #48714)
fix: further rationalizing how we are creating temporary files (fix: temp directory refinements #48608)
Add suggestions when features are incorrectly specified (Add suggestions when features are incorrectly specified #48963)
Read sid claim from ID token to support IdP backchannel logout (IdP backchannel logout: read sid claim from ID token to support backchannel logout #48674)
fix: making the embedded resteasy server work again
task: removing the approval test workaround (task: removing the approval test workaround #49071)
chore(mvn): drop unknown parameter 'createChecksum' (Drop unknown maven-install-plugin parameter createChecksum #49079)
migrated RequiredActionUpdateProfileTest. Closes Migrate the RequiredActionUpdateProfileTest #48149 (migration test RequiredActionUpdateProfileTest #48648)
Revert "chore(quarkus): only show OTel Metrics in community build (Show OpenTelemetry Metrics feature in community build, but allow downstream projects to hide it #49002)" (Revert "Show OpenTelemetry Metrics feature in community build, but allow downstream projects to hide it" #49072)
Document AuthZEN experimental support
Fix parsing SAML11 incorrect requests. (fixes #609) (Fix parsing SAML11 incorrect requests. (#609) #49119)
set only redirect_uri from client_data during restart
fix not before validation
fix: updating the auto logic if the pod cannot be found (fix: updating the auto logic if the pod cannot be found #49030)
Make all required actions one time action by default
Filtering out headers from external IP addresses
Better check for authSessionCookie in SessionCodeChecks (Fix adding social link in mongo. Fixed export/import of federationProvid... #603) (Better check for authSessionCookie in SessionCodeChecks #49134)
Enforce owner checks when calling the resource set service (Enforce owner checks when calling the resource set service #49121)
Refactor AssertEvents expect() and related methods to use EventAssertion equivalents. (Refactor AssertEvents expect() and related methods to use EventAssertion equivalents. #48752)
Wildcards should not be allowed if authority cannot be parsed (change logout behavior #607) (Wildcards should not be allowed if authority cannot be parsed #49130)
Prevent access to user info if not the owner or requested of a resource (Prevent access to user info if not the owner or requested of a resource #49122)
Improve handling for backchannel logout requests (Improve robustness of backchannel logout with client sessions #34104) (Improve handling for backchannel logout requests #34105)
Add bottom padding on Authorization Evaluate results page
fix: simplifying quarkus integration test annotations (fix: simplifying quarkus integration test annotations #48977)
Use EventAssertion in some remaining tests. Closes Compilation error because of EventAssertion #49142
Downgrade java version to 21 for the FIPS jobs Closes FIPS jobs fail in CI because java-25-openjdk-devel package is missing #49151
[OID4VCI-HAIP] Treat attestation-based clients as confidential ([OID4VCI-HAIP] Treat attestation-based clients as confidential #49155)
Disable single thread sender in JGroups
Enable JGroups message stats
[OID4VCI] Integration of user verifiable-credentials with credentials-endpoint and credential-offers closes [OID4VCI] Integration with credentials-endpoint and credential-offers #48547
Missing and incorrect permission checks on organization invitation endpoints
Add SPI option to disable FD_SOCK2 failure detection
Token introspection now validates audience claim. UserInfo endpoint rejects lightweight access tokens.
docs(workflows): fix offboarding example revoke-role role list format
Move the rest of TestingResource methods to a utils-shared helper class (1/2) (Move the rest of TestingResource methods to a utils-shared helper class (1/2) #48722)
Enforce access check when resolving users during client scope evaluation (Enforce access check when resolving users during client scope evaluation #49124)
fix for service account role management in admin v2 (fix for service account role management in admin v2 #48166)
Support for user attributes and updating them (Issues/48578 support for user attributes and updating them #49066)
[OID4VCI-HAIP] Revisit ABCA in connection with fapi-2-dpop-security-profile
Use runOnServerMaster on LightWeightAccessTokenTest Closes Compilation error because of setSystemPropertyOnServer #49192
Test migration util - Migrate runOnServer (Test migration util - Migrate runOnServer #49170)
Add area/admin/api-v2 to cloud-native team (Add area/admin/api-v2 to cloud-native team #48639)
[OID4VCI] Simplify JpaUserProvider.updateVerifiableCredential . Make sure OID4VCExportImportTest asserts equality of imported credentials closes [OID4VCI] Simplify JpaUserProvider.updateVerifiableCredential . Make sure OID4VCExportImportTest asserts equality of imported credentials #49199
Refactor legacy test suite's ExportImportResource (Refactor legacy test suite's ExportImportResource #48967)
Traefik reencrypt documentation based on the quickstart
adds missing tests to TokenIntrospectionTest
Account resource sharing resolves recipient by username before email, granting access to wrong user
Account API: Resource sharing endpoints ignore userManagedAccessAllowed realm setting
Reorder X509 validation to check revocation after trust
fix: extract 12 unsafe expression(s) to env vars
Prevent access to the Admin API from external IP addresses for HAProxy
Remove explicit --shutdown-timeouts configuration from proxy example configurations
Tighten UNSAFE_PATH_PATTERN against encoded path-traversal terminators (Tighten UNSAFE_PATH_PATTERN against encoded path-traversal terminators #49000)
Fix Themes cross-reference
show/update credential attributes in admin/account ui (show/update credential user attributes in admin console and account console #49218)
fix: allowing the general use of synthetic wildcards (fix: allowing the general use of synthetic wildcards #48223)
fix: prevent service account name from being set in multi-namespace mode (fix: prevent service account name from being set in multi-namespace mode #49036)
task: using a beanparam for client listing options (task: using a beanparam for client listing options #49074)
Upgrade playwright to avoid hangs on CI
Introduce mechanism for different trust material sources (Introduce mechanism for different trust material sources #48869)
Issued credentials: Update db schema and admin rest api (Issues/46204 update db schema and admin rest api #49201)
feat(admin api v2): stricter Client v2 contracts (Admin API v2: add stricter validation constrains for Client resource #48935)
Fix broken SAML 2.0 specification links in documentation
Disable the Account UI when the ACCOUNT feature is disabled (Disable the Account UI when the ACCOUNT feature is disabled #48807)
add revoke endpoint to issued credentials APIs
[OID4VCI] Self-Signed x5c Bypasses Key Attestation Validation
fix quick theme export to contain variables for both light and dark mode ([quick-theme] Quick Theme exports only the last selected theme mode (light or dark) #49125) (fix quick theme export to contain variables for both modes (#49125) #49322)
Revert back to use Java 25 in FIPS CI scripts (Revert back to use Java 25 in FIPS CI scripts #49290)
Fix location of SCIM resources so IDs don't appear twice in the URL
upgrade pnpm version (upgrade pnpm version #48975)
Use datatracker.ietf.org instead of www.rfc-editor.org for specs
moved AdminEnvironment to seperate file (moved AdminEnvironment to seperate file #48039)
Enable configurable client_id parameter validation for federated client assertions (Enable configurable client_id parameter validation for federated client assertions #48026)
Fix temporary password not persisting UPDATE_PASSWORD for AD federated users
fix: handle missing realm gracefully in UserStorageEventListener on realm deletion - Fixes Consistent 500 on DELETE of realms via non-browser clients calling REST API #48904
SSF: Move push timeout settings to the SSF Receiver tab (SSF: Move Push timeout settings to SSF Receiver tab #49235)
SSF: handle read-only user stores when toggling ssf.notify attributes
Ensure workflows can't be managed through the Component API.
Avoid log-and-throw for Hibernate's SQL exceptions
Use appropriate cross-reference syntax in the UI Customization guide
Update HaProxySslClientCertificateLookup to load Base64 encoded DER Chain
Move the rest of TestingResource methods to a utils-shared helper class (2/2) (Move the rest of TestingResource methods to a utils-shared helper class (2/2) #49241)
Add a "briefRepresentation" query param to the "/applications/{clientId}/consent" endpoint (defaults to true). If set to "false", the endpoint will provide an enhanced ConsentScopeRepresentation.
Adding client_id as prefix in client roles mapper Closes Adding client_id as prefix in client roles mapper #24823
Filtering out headers from external IP addresses in Traefik
Fix POST /admin/realms/{realm}/clients-initial-access returning HTTP 200 instead of 201 (Fix POST /admin/realms/{realm}/clients-initial-access returning HTTP 200 instead of 201 #49232)
Warn when running in a container without being PID 1 (Warn when running in a container without being PID 1 #48479)
Migrate Standard token exchange tests (Migrate Standard token exchange tests #47516)
Admin support for sending credential offer by email closes [OID4VCI] Admin-issued credential: Sending credential offer by email #46198
Client streaming for admin api v2 (Client streaming for admin api v2 #47611)
Add parameter column to consent tables for dynamic scopes
Login page title should use full width when locale selector is hidden (Login page title should use full width when locale selector is hidden #49381)
Unify buttons in horizontal layout for Login UI
Test migration util - Fixing WebAuthn Page rewrite message. (Test migration util - Fixing WebAuthn Page rewrite message. #49371)
Translations update from Hosted Weblate (Translations update from Hosted Weblate #49135)
Format Terms and Conditions accepted timestamp (Format Terms and Conditions accepted timestamp #49031)
Update commit-migration script (Update commit-migration script #49367)
admin ui for issued credential
add clickable client
Clarify documentation of OS-level dependencies for Kerberos (Clarify documentation of OS-level dependencies for Kerberos #45764)
Add client libraries repository to README
Make JWT client validators extensible (Make JWT client validators extensible #49046)
feat: migrate OID4VC metadata discovery test to new framework
manage-identity-providers role should be able to list realm roles
Avoid logging full PostgreSQL SQL statements with values in the logs
Support mapping existing Realm and Client roles to Organization Groups (Support mapping existing Realm and Client roles to Organization Groups #48670)
fix for issue 49249
[OID4VCI] Polishing of consents for OID4VCI client scopes closes [OID4VCI] Doublecheck and test that "Consent required" works as expected when OID4VCI scope is requested #46195
feat: migrate OID4VCCredentialOfferCorsTest test to new framework
feat: migrate OID4VCAuthorizationCodeFlowWithPARTest test to new framework
Clear thread local variable before returning from async response
[OID4VCI] [ABCA] Implemented the Default Trust IDP polish ([OID4VCI] [ABCA] Implemented the Default Trust IDP polish #49398)
[OID4VCI] Make sure that expiresAt is set for the issued credentials closes [OID4VCI] Make sure that "expiresAt" is set for the issued credentials #49408
Cleanup issued vcs when related entities are deleted
Include subject in email template attributes (feat: Include subject in email template attributes #49418)
Add form revert logic for tab providers (Add form revert logic for tab providers #49331)
[OID4VCI]: Migrate OID4VCSdJwtIssuingEndpointTest test to new framework ([OID4VCI]: Migrate OID4VCSdJwtIssuingEndpointTest test to new framework #49419)
feat: migrate JWTVCIssuerWellKnownProviderTest test to new framework
Correct option name for truststore type in mTLS guide (Correct option name for truststore type in mTLS guide #49443)
Remove persistent sessions worker code
Upgrade to Quarkus 3.33.2 (Upgrade to Quarkus 3.33.2 #49401)
fix: changing the error log to work with an unoptimized image (fix: changing the error log to work with an unoptimized image #49384)
Adding updateClientWithCleanup for ManagedRealm, removing attachTo from ManagedClient. (Adding updateClientWithCleanup for ManagedRealm, removing attachTo from ManagedClient. #49379)
Add Account REST API for issued verifiable credentials
Store credential offer state as single cache entry
[CVE-2026-8830] Missing server-side WebAuthn validations during credential registration ([CVE-2026-8830] Missing server-side WebAuthn validations during credential registration #49344)
Initial commit for ID-JAG assertion receiver, which receives ID-JAG assertion and send back access token working as as a part of token endpoint (Customization for JWTAuthorizationGrantType to support ID-JAG #46048)
Fix Themes cross-reference
Bump the actions-dependencies group across 1 directory with 4 updates (Bump the actions-dependencies group across 1 directory with 4 updates #49277)
Initial contributors guide lines around features (Initial contributors guide lines around features #48928)
Change TokenManager.isValidScope to always consider dynamic scopes Closes Dynamic scopes do not work with CIBA #49388
Add new method variants for isValidScope without the parameter user Closes Dynamic scopes do not work with CIBA #49388
[OID4VCI]: Migrate LDCredentialSignerTest test to new framework and cleanup legacy test helpers ([OID4VCI]: Migrate LDCredentialSignerTest test to new framework and cleanup legacy test helpers #49476)
Better handling of token parameters sent to the token endpoint closes [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange #49435
Include internal readonly attributes if not provided in ADMIN_API context
Remove oid4vc/test-credential-mappers.json from the arquillian testsuite closes [OID4VCI] Remove file oid4vc/test-credential-mappers.json #49484
refactor: remove obsolete PreAuthorizedGrantTest integration test
Bump simple-git from 3.32.3 to 3.36.0 in /js (Bump simple-git from 3.32.3 to 3.36.0 in /js #48747)
Migrated ExportImportTest and associated files
Update to uuid >=13.0.1

Closes #48288 Signed-off-by: Ryan Emerson <remerson@ibm.com>

Closes #48128 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com> Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>

When updating a role via PUT /admin/realms/{realm}/roles/{role-name} or PUT /admin/realms/{realm}/roles-by-id/{role-id} with a request body that omits the name field, the shared protected updateRole method passed null to RoleModel.setName, leading to a NullPointerException in RoleUpdatedEvent and a 500 Internal Server Error. Validate the name up-front in the shared helper and throw BadRequestException ("role has no name"), matching the validation already performed by createRole. Both endpoints share the helper, so a single change covers both paths. Also documents the new 400 response in the OpenAPI annotations for both endpoints, and adds tests in RealmRolesCRUDTest and RoleByIdResourceTest covering the missing-name case. Closes #48459 Signed-off-by: chon3806 <93464148+chon3806@users.noreply.github.com>

This is used to generate Keycloak Admin REST API. Without this a 'null' value is used, which suggests that returning a paginated list is optional. Closes #47560 Signed-off-by: Iestyn <33298011+IestynGage@users.noreply.github.com>

* fix: ensuring dev mode can fully reload the application closes: #47077 Signed-off-by: Steve Hawkins <shawkins@redhat.com> * also removing test launch mode Signed-off-by: Steve Hawkins <shawkins@redhat.com> * refining embedded mode cleanup Signed-off-by: Steve Hawkins <shawkins@redhat.com> # Conflicts: # quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java * restoring test launch mode Signed-off-by: Steve Hawkins <shawkins@redhat.com> --------- Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

…MIN flag (#48385) Closes #48324 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

…ature (#48633) Closes #48628 Signed-off-by: rmartinc <rmartinc@redhat.com>

Closes #46740 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

…ited Signed-off-by: Tomohiko Ozawa <kota65535@gmail.com>

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

* Make OrganizationGroupMembershipMapper claim name configurable The OrganizationGroupMembershipMapper introduced in 26.6.0 hardcoded the token claim name to "organization", unlike OrganizationMembershipMapper which already exposes the claim name as a configurable property. - Add TOKEN_CLAIM_NAME config property to OrganizationGroupMembershipMapper via OIDCAttributeMapperHelper.addTokenClaimNameConfig() - Override getEffectiveModel() to default the claim name to OAuth2Constants.ORGANIZATION when not set, preserving backward compatibility for existing mapper configurations - Set TOKEN_CLAIM_NAME default in the static create() factory method - Refactor OIDCAttributeMapperHelper.getOrInitializeOrganizationClaimAsMap() to accept a ProtocolMapperModel instead of a raw String, delegating to mapClaim() for correct claim placement (including nested path support) Closes #47851 Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de> * Fix nested claim path read and add custom claim name tests The read side of getOrInitializeOrganizationClaimAsMap was doing a flat Map.get() on the dotted claim name, while the write side (mapClaim) already creates a nested structure by splitting on dots. This caused the group mapper to find nothing when the claim name contained a dot, overwriting the membership data written by OrganizationMembershipMapper. Fix by splitting the claim path via splitClaimPath() and traversing the nested map with a new private getNestedClaimValue() helper in OIDCAttributeMapperHelper. The helper belongs there rather than in JsonUtils because it operates on Map<String,Object>, not JsonNode. Also add integration tests covering: - Custom flat claim name ("my_orgs") for both OrganizationMembershipMapper and OrganizationGroupMembershipMapper, verifying the claim appears at the configured name and not at "organization" - Dotted claim name ("custom.org") for OrganizationGroupMembershipMapper, verifying the token contains nested otherClaims["custom"]["org"] and that group composition is preserved Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de> --------- Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de>

Closes #48428 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>

Signed-off-by: sar <sar.haidar@gmail.com>

* is-45364 migrate Client Api V2 tests to utilize adminClient Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com> * Migrate getRealmAdmin() to use @InjectAdminClient and remove redundant AdminClientFactory setup Signed-off-by: Peter Zaoral <pzaoral@redhat.com> is-45364 fix PR comments Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com> --------- Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com> Co-authored-by: Peter Zaoral <pzaoral@redhat.com>

* Updated translation for Catalan Language: ca Updated translation for Catalan Language: ca Updated translation for Catalan Language: ca Updated translation for Catalan Language: ca Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Co-authored-by: Ecron <ecron_89@hotmail.com> Co-authored-by: Hosted Weblate <hosted@weblate.org> Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net> Signed-off-by: Ecron <ecron_89@hotmail.com> Signed-off-by: Hosted Weblate <hosted@weblate.org> * Updated translation for Czech Language: cs Co-authored-by: Hosted Weblate <hosted@weblate.org> Co-authored-by: Peter Schiffer <peter@pschiffer.eu> Signed-off-by: Hosted Weblate <hosted@weblate.org> Signed-off-by: Peter Schiffer <peter@pschiffer.eu> * Updated translation for French Language: fr Co-authored-by: Hosted Weblate <hosted@weblate.org> Co-authored-by: Sylvain Pichon <service@spichon.fr> Signed-off-by: Hosted Weblate <hosted@weblate.org> Signed-off-by: Sylvain Pichon <service@spichon.fr> * Updated translation for Swedish Language: sv Updated translation for Swedish Language: sv Updated translation for Swedish Language: sv Co-authored-by: Daniel Nylander <daniel@danielnylander.se> Co-authored-by: Hosted Weblate <hosted@weblate.org> Signed-off-by: Daniel Nylander <daniel@danielnylander.se> Signed-off-by: Hosted Weblate <hosted@weblate.org> --------- Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net> Signed-off-by: Ecron <ecron_89@hotmail.com> Signed-off-by: Hosted Weblate <hosted@weblate.org> Signed-off-by: Peter Schiffer <peter@pschiffer.eu> Signed-off-by: Sylvain Pichon <service@spichon.fr> Signed-off-by: Daniel Nylander <daniel@danielnylander.se> Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Co-authored-by: Ecron <ecron_89@hotmail.com> Co-authored-by: Peter Schiffer <peter@pschiffer.eu> Co-authored-by: Sylvain Pichon <service@spichon.fr> Co-authored-by: Daniel Nylander <daniel@danielnylander.se>

@shawkins

* move phishing check fixes: #48010 Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Apply suggestion from @shawkins Signed-off-by: Steven Hawkins <shawkins@redhat.com> --------- Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> Signed-off-by: Steven Hawkins <shawkins@redhat.com> Co-authored-by: Steven Hawkins <shawkins@redhat.com>

Closes #48687 Closes #48275 Closes #48570 Closes #47485 Closes #47486 Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Block *.js.map files in production. *.js.map files will still be allowed in dev mode for debugging purposes. Fixes #47545 Signed-off-by: Stan Silvert <ssilvert@redhat.com> * Minor changes from PR review. Signed-off-by: Stan Silvert <ssilvert@redhat.com> * Conditionally install the filter at build time. Signed-off-by: Stan Silvert <ssilvert@redhat.com> * Restore openapi.yaml, which was changed accidentally. Signed-off-by: Stan Silvert <ssilvert@redhat.com> --------- Signed-off-by: Stan Silvert <ssilvert@redhat.com>

closes #48546 Signed-off-by: mposolda <mposolda@gmail.com>

Closes #47061 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Closes #48450 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

…on remote EC2 VM (#48595) Closes: #48594 Signed-off-by: Peter Zaoral <pzaoral@redhat.com>

Signed-off-by: Simon Vacek <simonvacky@email.cz>

…ertion methods. (#48638) Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

* Stop using jboss-parent Closes: #40125 Signed-off-by: Peter Zaoral <pzaoral@redhat.com> * Add Maven plugins version from jboss-parent Should match the versions from jboss-parent to prevent conflicting versions. Signed-off-by: Badiuzzaman Iskhandar <badiskhand@ibm.com> --------- Signed-off-by: Peter Zaoral <pzaoral@redhat.com> Signed-off-by: Badiuzzaman Iskhandar <badiskhand@ibm.com> Co-authored-by: Badiuzzaman Iskhandar <badiskhand@ibm.com>

Closes: #48710 Signed-off-by: Simon Vacek <simonvacky@email.cz>

closes: #48734 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Closes #48716 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Closes #48459 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

* Initial contributors guide lines around features Signed-off-by: stianst <stianst@gmail.com> * Apply suggestions from code review Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Signed-off-by: Stian Thorgersen <stianst@gmail.com> * Update docs/features.md Co-authored-by: Sebastian Schuster <sebastian.schuster@bosch.com> Signed-off-by: Stian Thorgersen <stianst@gmail.com> --------- Signed-off-by: stianst <stianst@gmail.com> Signed-off-by: Stian Thorgersen <stianst@gmail.com> Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Co-authored-by: Sebastian Schuster <sebastian.schuster@bosch.com>

Closes #49388 Signed-off-by: rmartinc <rmartinc@redhat.com>

…leanup legacy test helpers (#49476) Closes #49470 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

closes #49435 Signed-off-by: mposolda <mposolda@gmail.com>

…text Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com> Closes #49272

closes #49484 Signed-off-by: mposolda <mposolda@gmail.com>

Closes #49482 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Bumps [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) from 3.32.3 to 3.36.0. - [Release notes](https://github.com/steveukx/git-js/releases) - [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md) - [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git) --- updated-dependencies: - dependency-name: simple-git dependency-version: 3.36.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Closes #48152 Signed-off-by: Marie Daly <marie.daly1@ibm.com> Signed-off-by: Ricardo Martin <rmartinc@redhat.com> Co-authored-by: Ricardo Martin <rmartinc@redhat.com>

Closes #49530 Signed-off-by: stianst <stianst@gmail.com>

ryanemerson and others added 30 commits April 30, 2026 14:30

AuthZEN allow configurable subject lookup semantics

4d142ea

Closes #48288 Signed-off-by: Ryan Emerson <remerson@ibm.com>

Traefik-passthrough doc file

168da57

Closes #48128 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com> Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>

Rewrite AssertEvents expectLoginEvent to EventAssertion. (#48467)

4f47022

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

Enforce resource server predicates if one was given despite the IS_AD…

fd47bda

…MIN flag (#48385) Closes #48324 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

Remove form data from the registerNode and unregisterNode method sign…

b134dc2

…ature (#48633) Closes #48628 Signed-off-by: rmartinc <rmartinc@redhat.com>

Prevent ASCII control characters in query parameters

c045765

Closes #46740 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

fix: trigger INVITE_ORG and REGISTER event when a new user is inv…

d55a25a

…ited Signed-off-by: Tomohiko Ozawa <kota65535@gmail.com>

Refactor SSSD tests to use JUnit5 Assertions. (#48673)

8cfd971

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

DPoP for implicit flow

7691ba4

Closes #48428 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>

Changes to address Org subdomain matching (#45190)

263d44b

Signed-off-by: sar <sar.haidar@gmail.com>

Upgrade to Quarkus 3.33.1.1 (#48688)

5ef7e07

Closes #48687 Closes #48275 Closes #48570 Closes #47485 Closes #47486 Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

[OID4VCI] Support for credentials CRUD (DB and admin REST endpoints)

f66ae8a

closes #48546 Signed-off-by: mposolda <mposolda@gmail.com>

Duplicated flows can have illegal characters in step name

39198c2

Closes #47061 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Adding event details for better runtime analysis

56c6a1d

Closes #48450 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

[quarkus-next] Aurora CI fails with missing quarkus-bom:999-SNAPSHOT …

18fec3e

…on remote EC2 VM (#48595) Closes: #48594 Signed-off-by: Peter Zaoral <pzaoral@redhat.com>

Refactor runonserver APIs for easier test migration (#48363)

ccdf982

Signed-off-by: Simon Vacek <simonvacky@email.cz>

Rewrite AssertEvents expectLogout and expectLogoutError into EventAss…

ba108b0

…ertion methods. (#48638) Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

Remove unused TestingResource methods (#48711)

c5eacd4

Closes: #48710 Signed-off-by: Simon Vacek <simonvacky@email.cz>

fix: initial projection implementation (#48460)

a3e3feb

closes: #48734 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Ensure MSSQL sever deployments have the IDX_IDP_FOR_LOGIN index created

b314a81

Closes #48716 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Enforce non-empty role and group names

8add9b0

Closes #48459 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

stianst and others added 11 commits May 29, 2026 11:14

Change TokenManager.isValidScope to always consider dynamic scopes

53e3237

Closes #49388 Signed-off-by: rmartinc <rmartinc@redhat.com>

Add new method variants for isValidScope without the parameter user

b883851

Closes #49388 Signed-off-by: rmartinc <rmartinc@redhat.com>

[OID4VCI]: Migrate LDCredentialSignerTest test to new framework and c…

e2109d5

…leanup legacy test helpers (#49476) Closes #49470 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Better handling of token parameters sent to the token endpoint

f1e5b77

closes #49435 Signed-off-by: mposolda <mposolda@gmail.com>

Include internal readonly attributes if not provided in ADMIN_API con…

a5d2f5b

…text Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com> Closes #49272

Remove oid4vc/test-credential-mappers.json from the arquillian testsuite

581a08c

closes #49484 Signed-off-by: mposolda <mposolda@gmail.com>

refactor: remove obsolete PreAuthorizedGrantTest integration test

242b96c

Closes #49482 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Migrated ExportImportTest and associated files

5a86ac9

Closes #48152 Signed-off-by: Marie Daly <marie.daly1@ibm.com> Signed-off-by: Ricardo Martin <rmartinc@redhat.com> Co-authored-by: Ricardo Martin <rmartinc@redhat.com>

Update to uuid >=13.0.1

3641103

Closes #49530 Signed-off-by: stianst <stianst@gmail.com>

stianst requested review from a team as code owners June 1, 2026 10:12

stianst closed this Jun 1, 2026

keycloak-github-bot Bot added team/cloud-native team/continuous-delivery team/core-authn team/core-clients team/core-iam team/core-protocols team/core-shared team/production-readiness team/rh-iam team/security labels Jun 1, 2026

stianst deleted the js-deps-uuid-26.6 branch June 1, 2026 10:16

Navigation Menu

Repository navigation

js deps uuid 26.6 - #49539

js deps uuid 26.6#49539
stianst wants to merge 481 commits into
release/26.6from
js-deps-uuid-26.6

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants