Pull Request Explorer

Summary

Add audience restriction for OID4CI access tokens

Restricts OID4CI access tokens to a specific audience, tightening security and preventing misuse of tokens. This change reduces risk of token replay attacks and ensures compliance with protocol specifications.

Health Assessment

• • Fast review and approval with minimal rework; small scope and clear security improvement.

Summary

Clarify experimental support for ID-JAG in documentation

Updated the documentation to clarify the experimental support for the Identity Assertion JWT Authorization Grant, specifying the current limitations and future plans.

Health Assessment

• • Quick review and merge within 5 hours, minimal changes, low risk.

Summary

Fix spelling error in recovery code warning message

Corrects a typo in the login theme’s recovery code warning message, improving user-facing wording consistency.

Health Assessment

• • Quick fix with minimal changes, reviewed immediately by AI, merged within 8.7 hours.

Summary

Fix inaccurate LoA max age comment

Aligns the inline comment with the actual units (seconds) for the default LoA max age, preventing misinterpretation.

Health Assessment

• • Rapid review and approval with minimal changes, indicating low complexity and risk.

Summary

Add cacheless integration test

Improve test coverage for realm invalidation behavior in clustered Keycloak nodes.

Health Assessment

• • The PR had multiple review rounds and suggestions from code review, but the author was responsive and applied the changes promptly.

Summary

Update translations from Hosted Weblate

Translations for Keycloak Admin UI have been updated from Hosted Weblate to reflect the latest strings.

Health Assessment

• • The PR was reviewed quickly and had minimal comments, indicating low friction and risk.

Summary

Promote SAML step-up authentication to supported

SAML step-up authentication is now a supported feature, replacing its preview status. This change enhances security for SAML integrations by providing reliable step-up authentication out of the box.

Health Assessment

• • Long review cycle indicates potential blockers or complexity in feature promotion; however, the change is small and straightforward.

Summary

Remove unused SortOrder helper

Eliminates dead code from the Admin v2 API, improving maintainability and reducing potential bugs.

Health Assessment

• • The PR was reviewed and merged within 29 hours, with a single comment and no rework, indicating a smooth, low-risk change.

Summary

Fix interceptor usage on classloader mismatch

Prevents runtime errors caused by misapplied interceptors when configuration is built under a mismatched classloader, improving stability for deployments.

Health Assessment

• • The PR addressed a subtle classloader issue with minimal changes and received quick approvals, indicating a straightforward fix with low risk.

Summary

Filter empty/blank redirectUris and webOrigins before persistence

Ensures client configurations are validated before being stored, preventing invalid redirect URIs and origins that could lead to security issues or misconfigurations.

Health Assessment

• • Fast turnaround with minimal review, indicating a straightforward bug fix with low complexity.

Summary

Fix PathMatcher for malformed URI templates

Prevents crashes by treating malformed URI templates as non-matches, improving stability and error handling.

Health Assessment

• • The PR addressed a critical StringIndexOutOfBoundsException by adding defensive checks and tests, with AI-assisted code generation and a thorough review process.

Summary

Add lb-check endpoint for cacheless multi‑cluster

Enables load balancer health checks for cacheless deployments, improving high‑availability support.

Health Assessment

• • AI‑assisted review and minimal changes led to quick approval.

Summary

Support long values in configuration defaults

Ensures client secret rotation handles large expiration periods without overflow, restoring compatibility and preventing breaking changes.

Health Assessment

• • PR fixed a regression from a previous breaking change, received a quick review and approval, involved minimal code changes, and poses low risk to the system.

Summary

Update SECURITY.md to align with keycloak.org security policy

Adds a comprehensive security policy document to the repository, aligning with keycloak.org and GitHub's security guidelines, improving discoverability and compliance.

Health Assessment

• • Fast merge with minimal review, indicating a straightforward documentation update.

Summary

Fix root authentication session lookup validation

Corrects a production safety gap by replacing an assert‑only realm check with a runtime guard, ensuring proper authentication session handling.

Health Assessment

• • Quick resolution with minimal rework; AI assistance streamlined fixes.

Summary

Split Base2 test suite to prevent CI timeouts

Reduces CI run time by splitting a large test suite, improving reliability and reducing flaky failures.

Health Assessment

• • PR resolved CI timeout issue by splitting test suite; minimal changes, quick review, AI review contributed.

Summary

Add reverse-proxy guide for master realm isolation

Adds documentation to guide users on isolating the master realm from public internet, reducing attack surface.

Health Assessment

• • Fast cycle time of under 2 hours, minimal rework, documentation only, low risk to production.

Summary

Fix device version displaying wrong one on Safari

Corrects iOS version reporting in Keycloak Device Activity for Safari browsers, ensuring accurate device version display.

Health Assessment

• • Quick review and approval after a single comment, indicating a straightforward fix.

Summary

Update Kiota to latest version

Bumps Kiota toolchain to the latest version in the Keycloak Admin Client, ensuring compatibility with the newest Kiota CLI and TypeScript packages.

Health Assessment

• • Quick approval with minimal review, indicating a straightforward dependency update.

Summary

Resolve username scope by email when configured

Enables OIDC username and delegation scopes to resolve users by email, improving authentication flexibility and user lookup accuracy.

Health Assessment

• • Quick resolution with minimal rework; AI-assisted review helped catch issues early.

Summary

Improve SAML step-up authentication robustness

Enhances SAML authentication by refining ACR↔LoA mapping, handling minimum ACR, and selecting AuthnContextClassRef, reducing errors and improving security.

Health Assessment

• • Quick review and merge within 7 hours, minimal changes, low risk.

Summary

Fix SAML LoA comparison logic

Ensures SAML step‑up authentication correctly handles higher Level of Assurance, preventing false rejections when a user’s LoA exceeds the SP’s requested LoA.

Health Assessment

• • Fast review and approval with minimal iterations; AI‑assisted code and review contributed to quick resolution.

Summary

Update 26.7 release notes and upgrade docs

Provides updated release notes and upgrade guidance for Keycloak 26.7, ensuring users have accurate documentation.

Health Assessment

• • Review took over a day, but only one review round and minimal changes, indicating a straightforward documentation update.

Summary

Add Kotlin exclusion to Quarkus OpenAPI dependency

Removes Kotlin from Quarkus server's OpenAPI dependency, reducing build size and avoiding compatibility issues.

Health Assessment

• • Fast review and merge with minimal changes to dependency configuration.

Summary

Pin Aesh versions for WildFly CLI compatibility

Ensures integration tests run reliably with WildFly CLI by pinning Aesh library versions, reducing test failures and improving CI stability.

Health Assessment

• • The PR had a long review time but minimal changes, indicating a straightforward fix that was delayed by review scheduling.

Summary

Exclude Kotlin from Quarkus SmallRye OpenAPI

Prevents Kotlin transitive dependencies from being pulled into the Quarkus server, resolving build issues and improving stability.

Health Assessment

• • Quick review and merge within 18 hours, minimal changes, low risk.

Summary

Fix login failure expiration unit mismatch

Corrects expiration threshold unit to milliseconds, ensuring accurate cleanup of stale login failures and improving system reliability.

Health Assessment

• • Fast review cycle with minimal rework; AI-assisted code generation streamlined the fix.

Summary

Migrate RPInitiatedFrontChannelLogoutTest to new test suite

Migrates legacy RPInitiatedFrontChannelLogoutTest to the newer @KeycloakIntegrationTest framework. This change reduces test flakiness and improves reliability of authentication tests.

Health Assessment

• • The PR had a slow cycle time and multiple review comments, indicating moderate complexity and some friction in the review process.

Summary

Fix missing lifespan validation in putIfAbsent

Ensures consistent input validation across SingleUseObjectProvider implementations, preventing invalid entries and improving reliability.

Health Assessment

• • Quick, single‑commit fix with minimal scope and fast review cycle indicates low risk and high confidence in stability.

Summary

Fix missing reference in HAProxy reencrypt docs

Corrects documentation to prevent client certificate header spoofing in HAProxy re-encrypt setups, improving security guidance for Keycloak users.

Health Assessment

• • Quick review and merge within 19 hours, minimal changes to documentation, low risk.

Summary

Remove HTTP preference workaround for operator admin

Ensures operator admin connections use HTTPS, improving security and compliance.

Health Assessment

• • Quick review and merge within 9.5 hours, minimal changes, low risk.

Summary

Bump uuid from 13.0.2 to 14.0.1 in /js

Updates the uuid library to the latest stable release, addressing security fixes and compatibility changes for the JavaScript components.

Health Assessment

• • Fast, single-commit dependency update with no review friction; typical automated dependabot PR.

Summary

Bump properties-file dependency to 5.0.5

Updates the properties-file library to the latest version, improving performance and compatibility.

Health Assessment

• • Quick dependency update merged within hours with no review changes.

Summary

Update @types/node to 26.1.0

Updates Node type definitions to the latest version, improving type safety and compatibility for the JavaScript codebase.

Health Assessment

• • Fast cycle time of 3.8 hours and immediate review indicate a straightforward dependency update with minimal risk.

Summary

Control repeatability of parameterized client scopes

Adds a repeatable flag to parameterized client scopes, enabling Keycloak to reject non‑repeatable authorization requests and improving security and admin control.

Health Assessment

• • PR was reviewed quickly with minimal rework, indicating a smooth process.

Summary

Add guardrails against DoS in SCIM and Workflows

This PR reduces DoS risk by limiting filter complexity and adds admin event emission for workflow endpoints, improving security and auditability.

Health Assessment

• • Fast review cycle with AI-generated comments led to a quick merge; scope is moderate with 228 added lines across 5 files.

Summary

Deprecate ClientModel.getDynamicClientScope method

This PR removes the legacy getDynamicClientScope method and introduces getParameterizedClientScope, streamlining client scope handling and improving API clarity for developers. It ensures backward compatibility while guiding developers toward the new, more expressive API.

Health Assessment

• • Fast cycle time with minimal changes; review involved multiple comments but no major rework.

Summary

Add missing requireMapClientScope enforcement

Fixes CVE-2026-9795 by tightening FGAPv2 enforcement, preventing limited admins from mapping client scopes.

Health Assessment

• • The PR was reviewed and approved within 0.1 hours, merged 25 hours after opening, indicating a smooth, low‑friction process with minimal rework.

Summary

Add MANAGE permission check to GroupResource.addChild

Prevents authorization bypass in the admin API by enforcing MANAGE permission on child groups, enhancing security.

Health Assessment

• • Quick fix with minimal changes, AI-assisted review, fast turnaround.

Summary

Prevent owner-managed resource leaks in permissive mode

Ensures that resources managed by owners are not automatically granted when enforcement mode is permissive, reducing authorization leaks and improving security.

Health Assessment

• • Fast review and merge with minimal changes, indicating low complexity and high confidence.

Summary

Fix Admin UI bug: clear custom attribute value

Corrects a regression where selecting a custom attribute clears the previously entered key, improving admin UI reliability.

Health Assessment

• • Rapid resolution with minimal changes, indicating a straightforward bug fix with low risk.

Summary

Fix URI validation case-sensitivity for security

Addresses CVE-2026-9086 by hardening client URI validation against case‑insensitive javascript: and data: scheme bypasses across client URL fields, reducing security risk.

Health Assessment

• • Fast review and merge with minimal changes indicates efficient handling of a critical security fix.

Summary

Update bug triage documentation for clarity

Improves correctness and clarity of bug triage actions and labeling workflow, reducing confusion for contributors.

Health Assessment

• • PR was reviewed quickly with a single comment and merged without further changes, indicating a straightforward documentation update with minimal risk.

Summary

Retarget quarkus-next to Quarkus 3.x

Update quarkus-next automation to track Quarkus 3.x development branch after main switched to 4.0.

Health Assessment

• • Quick review and approval process, indicating a straightforward change.

Summary

Bump log4j-core dependency

Updates log4j-core to the latest patch to address security or bug fixes, ensuring compatibility and stability.

Health Assessment

• • The PR had a long cycle time but was reviewed and approved immediately, indicating low complexity and risk.

Summary

Confine authority-attached wildcards in SSF push URL allow-list

Fixes a security bypass by enforcing host boundary in SSF push URL validation, preventing malicious URLs from being accepted.

Health Assessment

• • Quick review and merge within 3 hours, minimal rework, indicating a straightforward security fix.

Summary

Update Kiota to address security advisory

Bumps Keycloak Admin Client to Kiota 1.0.0-preview.102, resolving the GHSA-396q-4vc8-28x9 vulnerability and ensuring secure dependencies. This update mitigates the identified security risk and maintains compatibility with the existing client.

Health Assessment

• • Rapid resolution of a security advisory with minimal changes and quick review indicates efficient process.

Summary

SCIM API as a technology preview feature

Promotes the SCIM API from experimental to technology preview, enabling broader adoption and clearer feature visibility for customers.

Health Assessment

• • AI‑reviewer provided quick feedback, and the minimal code change led to a fast, single‑round review and merge.

Summary

Clarify unsupported operator version coexistence

Clarifies that running different operator versions on the same cluster is not supported, preventing configuration errors and ensuring stability.

Health Assessment

• • Fast cycle time and single review indicate a straightforward documentation update.

Summary

Adjust HA multi-cluster v2 documentation wording

Clarifies that the multi-cluster v2 setup is a requirement, not a guaranteed supported configuration, improving accuracy of documentation.

Health Assessment

• • Quick review and merge, minimal changes, low risk.