Pull Request Explorer

Summary

Add lower-bound validation on SCIM count parameter

Adds validation to ensure SCIM count parameter is not below a minimum, improving API robustness and preventing erroneous pagination.

Health Assessment

• • The PR was reviewed quickly and required only a single commit, indicating a straightforward, low‑risk change.

Summary

Rollback on token verification failure in reset credentials

Prevents reuse of password-reset links by rolling back credential updates when token verification fails.

Health Assessment

• • Quick review and approval with minimal changes, indicating low complexity and high confidence.

Summary

Fix cluster-wide mode permissions

Corrects permission settings for cluster-wide mode, ensuring proper access control for Keycloak operator deployments.

Health Assessment

• • Quick fix with minimal changes, fast review and merge, indicating low complexity and high confidence in correctness.

Summary

Fix kcw script version detection

Corrects version retrieval in the kcw script, ensuring accurate Keycloak version selection from pom.xml, improving build reliability.

Health Assessment

• • Quick fix with minimal changes, approved swiftly, indicating low complexity and high confidence.

Summary

Fix CLI error for misplaced --optimized option

Improves command‑line diagnostics by correctly reporting when the --optimized flag is used before a subcommand, reducing user confusion and preventing misconfiguration.

Health Assessment

• • The PR was reviewed immediately with AI assistance, leading to a quick merge and minimal code changes.

Summary

Fix JWE request object signature bypass

Removes a security vulnerability that could allow attackers to bypass signature verification on JWE request objects, strengthening authentication integrity.

Health Assessment

• • The PR was resolved in a single commit with a quick review, indicating a straightforward, low‑risk security fix.

Summary

Fix JWE request object signature bypass

Removes a security flaw that allowed bypassing JWE request object signature verification, improving authentication integrity.

Health Assessment

• • The PR was reviewed and approved in a single round with minimal changes, indicating a straightforward security fix.

Summary

Fix NPE in client secret rotation validation

Prevents null period values from causing NPE during client secret rotation configuration validation, improving stability.

Health Assessment

• • Quick resolution with minimal rework; AI-assisted commit streamlined fix.

Summary

Revoke credential when OID4VCI refresh token is revoked

Ensures that revoking an OID4VCI refresh token also removes associated verifiable credentials, tightening security and preventing stale credentials from remaining active.

Health Assessment

• • The PR was reviewed almost immediately by Copilot, resulting in a quick merge, but the overall cycle time was long due to the initial delay before the first review.

Summary

Add refresh token support for credential offers

Enables credential re‑issuance after refresh when the original offer has been removed, improving OID4VCI flow reliability.

Health Assessment

• • The PR added refresh‑token support for OID4VCI flows but required extensive AI‑generated review comments, resulting in a slow cycle time despite a quick initial review.

Summary

Add IdP alias for federated token storage

This change ensures that tokens from multiple identity providers are correctly isolated, preventing token mix-ups during account linking, improving security and reliability for users.

Health Assessment

• • The PR had a long cycle time but a quick initial review; multiple review rounds and AI‑assisted review comments indicate complexity and potential integration challenges.

Summary

Update OIDC broker email verification

Ensures accurate email verification for OIDC brokered users, preventing security issues and improving trust.

Health Assessment

• • Security vulnerability addressed with minimal code changes; review was rapid but cycle time extended due to extensive testing.

Summary

Fix JWE request object signature bypass

Fixes a security vulnerability (CVE-2026-9793) by ensuring signed OIDC request objects are properly validated when using JWE-encrypted request objects, preventing potential authentication bypass.

Health Assessment

• • Security fix with minimal changes, quick review, no rework.

Summary

Fix cluster-wide mode permissions

Adjusts Keycloak Operator RBAC to correctly scope cluster-wide permissions, reducing duplicate roles and ensuring proper access control.

Health Assessment

• • Fast review and merge with minimal changes, indicating a straightforward fix with low complexity.

Summary

Fix Fine‑Grained Admin Permissions Bypass

Removes a security vulnerability that allowed unauthorized client‑scope disclosure and assignment, strengthening Keycloak’s admin permission controls.

Health Assessment

• • The PR received a quick initial review but required a change request after 73 hours, indicating a delayed review cycle. The use of Copilot for review shows AI assistance, and the security fix was merged after 99 hours, a relatively long cycle for a critical patch.

Summary

Add FGAP v2 child-group listing safeguards

Adds authorization safeguards to prevent child-group listing bypass, addressing CVE-2026-14615.

Health Assessment

• • Quick review and approval, minimal rework, indicates straightforward fix.

Summary

Fix user disclosure in admin UI brute-force search

Removes a vulnerability that allowed unauthorized users to discover other users via the brute-force search endpoint, enhancing security for Keycloak administrators.

Health Assessment

• • PR addressed a security issue quickly with minimal changes and a single review, indicating efficient handling of the vulnerability.

Summary

Migrate organization member package to the new testsuite

Reorganizes organization member tests to the new test framework, improving maintainability and aligning with current architecture.

Health Assessment

• • Large migration of test code completed in a single AI‑assisted review cycle, resulting in a moderate cycle time of 6.7 days.

Summary

Add Token Exchange Delegation provider

Introduces RFC 8693 token‑exchange delegation, enabling actors to delegate authentication and create transient sessions, expanding Keycloak’s flexible auth flows.

Health Assessment

• • The PR added a large feature with over 600 lines of code, but the first review was delayed by more than 3 days, indicating a bottleneck in the review process and increasing risk of integration issues.

Summary

Fix concurrency bug in organization attribute updates

Prevents 500 errors during concurrent admin updates, ensuring reliable organization management.

Health Assessment

• • The PR addressed a concurrency bug that could cause 500 errors during simultaneous admin updates. The fix was straightforward, reviewed quickly, and merged after a single round of changes, indicating a low‑risk, small‑scale change.

Summary

Add XA-aware Oracle connection timeout

Ensures Oracle XA datasources use correct timeout settings, improving reliability and preventing connection failures.

Health Assessment

• • Fast AI-assisted review led to minimal human edits and a quick merge within 31 hours.

Summary

Add LDAP request counting and latency metrics

Enables monitoring of LDAP operations by exposing counters and timing metrics, improving observability and troubleshooting.

Health Assessment

• • The PR had a long cycle time of over 13 days and multiple review rounds, indicating significant rework and complexity.

Summary

Prevent AuthZEN requests with user tokens

This change tightens authentication for AuthZen evaluation endpoints, ensuring only machine‑to‑machine tokens can query the PDP and improving security posture.

Health Assessment

• • Review was quick (4 h) but the PR remained open for over 10 days, suggesting a scheduling delay rather than technical complexity.

Summary

Stateless: use preview instead of experimental in the introduction

Updates the high‑availability guide to reflect the new preview terminology, improving clarity for users and aligning documentation with current feature naming.

Health Assessment

• • PR merged within minutes with a single line change, indicating a straightforward documentation update with minimal risk.

Summary

Update stateless feature status to preview

Clarifies that the stateless multi-cluster feature is in preview, not experimental, improving user understanding and aligning documentation with product roadmap.

Health Assessment

• • Rapid review and merge within minutes indicates low complexity and high confidence in documentation change.

Summary

Remove temporary client creation, use simple client model

Simplifies client handling by replacing temporary creation logic with a lightweight client model, improving maintainability and reducing potential bugs. This change also ensures proper event generation for client updates.

Health Assessment

• • T
• • h
• • e
• •
• • P
• • R
• •
• • h
• • a
• • d
• •
• • a
• •
• • q
• • u
• • i
• • c
• • k
• •
• • r
• • e
• • v
• • i
• • e
• • w
• •
• • b
• • u
• • t
• •
• • a
• •
• • l
• • o
• • n
• • g
• •
• • c
• • y
• • c
• • l
• • e
• •
• • t
• • i
• • m
• • e
• •
• • d
• • u
• • e
• •
• • t
• • o
• •
• • s
• • c
• • h
• • e
• • d
• • u
• • l
• • i
• • n
• • g
• • ;
• •
• • m
• • i
• • n
• • i
• • m
• • a
• • l
• •
• • r
• • e
• • w
• • o
• • r
• • k
• •
• • a
• • n
• • d
• •
• • l
• • o
• • w
• •
• • c
• • o
• • m
• • m
• • e
• • n
• • t
• • s
• •
• • i
• • n
• • d
• • i
• • c
• • a
• • t
• • e
• •
• • a
• •
• • s
• • t
• • r
• • a
• • i
• • g
• • h
• • t
• • f
• • o
• • r
• • w
• • a
• • r
• • d
• •
• • c
• • h
• • a
• • n
• • g
• • e
• • .

Summary

WebAuthn authenticator attachment policy bypass fix

Fixes a security issue where WebAuthn authenticator attachment policy could be bypassed if the client omitted the attachment field, ensuring stricter compliance and protecting against potential credential misuse.

Health Assessment

• • The PR was reviewed quickly with minimal changes, indicating a straightforward fix with low complexity and risk.