Pull Request Explorer

Summary

Add support for FAPI2 refresh token conformance

Enables Keycloak to meet FAPI2 security profile by binding refresh tokens to client attestation and adding confirmation metadata, improving token security and compliance.

Health Assessment

• • The PR had a long cycle time but quick initial review, with AI‑assisted review comments. The change adds significant security features for FAPI2 compliance.

Summary

Fix workflow state removeAll() deleting records

Corrects a bug where removing workflow states deleted records across all realms, ensuring realm isolation and data integrity.

Health Assessment

• • Quick fix with minimal changes, resolved in under 24 hours, indicating efficient review and low complexity.

Summary

Release notes for ID-JAG

Adds documentation for experimental support of Identity Assertion JWT Authorization Grant, informing users of the new feature.

Health Assessment

• • Merged within 30 minutes with a single AI review comment, indicating minimal complexity and high confidence.

Summary

Add initial ID-JAG guide

Provides a new guide for securing applications using the Identity Assertion JWT Authorization Grant, enabling developers to configure Keycloak for cross‑app access.

Health Assessment

• • PR was reviewed quickly and approved after a single round of comments, indicating a straightforward documentation update with minimal risk.

Summary

Restrict Java Keystore Files to Realm Folder

Mitigates CVE-2026-9083 by confining keystore files to a realm-scoped directory, enhancing security and preventing unauthorized access.

Health Assessment

• • Fast review and merge with minimal changes; the PR addressed a critical security issue with a straightforward implementation.

Summary

Migrate SamlClientTest to new test framework

Replaces legacy Arquillian-based SamlClientTest with the new Keycloak test framework, improving test stability and aligning with current testing infrastructure.

Health Assessment

• • The PR required over 11 days to merge, involved AI‑assisted code generation and review, and added more than 1,200 lines of test code, indicating high effort and potential risk.

Summary

Optimize composite-role expansion to reduce N+1 queries

Improves CPU and database performance for user role resolution during token issuance and permission checks, enhancing overall system responsiveness.

Health Assessment

• • The PR required multiple iterations after the initial review, indicating some friction, but the review was quick and the final merge took almost four days, reflecting a moderate risk for a performance optimization.

Summary

Fix broken link to other guide pages for rolling updates

Corrects cross-guide references in the Operator rolling updates guide, ensuring users can navigate documentation accurately.

Health Assessment

• • Documentation fix completed quickly with minimal changes and a single review round, indicating a smooth process.

Summary

Bump actions/cache from 5.0.5 to 6.1.0

Updates the GitHub Actions cache action to a newer version, improving cache reliability and performance for CI pipelines.

Health Assessment

• • Quick merge with no review needed, typical dependency bump.

Summary

Bump actions/cache from 5.0.5 to 6.1.0 in /.github/actions/corepack-setup

Updates the actions/cache dependency to the latest version, improving cache handling and security for CI workflows.

Health Assessment

• • Fast merge with minimal changes; no review required; typical Dependabot dependency update.

Summary

Bump actions/cache/restore from 5.0.5 to 6.1.0

Updates the cache action to the latest version, improving cache reliability and build speed for CI pipelines.

Health Assessment

• • The PR was merged quickly with a single commit and no significant review feedback, indicating a straightforward dependency update.

Summary

Update actions/cache to v6.1.0

Updates the cache action to the latest version, improving cache reliability and security for CI workflows.

Health Assessment

• • Merged quickly with a single commit and no review comments, indicating a straightforward dependency update with minimal risk.

Summary

Update actions/cache dependency to v6.1.0

Updates the cache action to the latest version, improving cache reliability and security.

Health Assessment

• • Quick dependency bump with immediate merge, minimal review needed.

Summary

Bump actions/cache from 5.0.5 to 6.1.0 in /.github/actions/pnpm-store-cache

Updates the GitHub Actions cache dependency to the latest version, improving cache reliability and security.

Health Assessment

• • Quick dependency update with immediate merge, minimal review friction.

Summary

Update actions/cache to v6.1.0

Updates the cache action to the latest version, improving reliability and security.

Health Assessment

• • Quick merge with no rework; minimal impact.

Summary

Bump actions/cache/restore from 5.0.5 to 6.1.0

Updates the cache action to the latest version, improving reliability and security.

Health Assessment

• • Fast merge with minimal changes, no blockers.

Summary

Switch session cookie hashing to SHA-384

Enhances security of session cookies by using a stronger hash algorithm, ensuring consistency between server and browser logic.

Health Assessment

• • The PR was reviewed quickly and required no additional commits, but the overall cycle time was long due to scheduling; the change is a small, low‑risk security improvement.

Summary

Fix realm isolation bug in workflow cleanup

Prevents accidental deletion of workflow state records when removing a realm, ensuring data integrity across realms.

Health Assessment

• • Quick review and single commit indicate a straightforward bug fix with minimal risk.

Summary

Deprecate the Twitter Identity Broker

Deprecates the built‑in Twitter broker, gating it behind a disabled‑by‑default feature flag to reduce exposure to an unmaintained library and legacy OAuth endpoints.

Health Assessment

• • The PR required multiple review cycles and merges, indicating careful handling of the deprecation, but the overall scope was moderate and the cycle time was within a week.

Summary

Fix token post-processor ordering

Ensures token post-processors are invoked in correct priority order, improving OIDC token handling reliability.

Health Assessment

• • Fast review and minimal changes led to quick approval, but long cycle time indicates scheduling delays.

Summary

Increased AES default from 128 to 256

Upgrades Keycloak's default AES key size to 256 bits for improved post‑quantum security, adding tests to ensure backward compatibility.

Health Assessment

• • The PR had a long cycle time but a quick initial review, with multiple iterations driven by copilot suggestions and flaky test concerns.

Summary

Reject redirect URIs with pre-loaded OIDC parameters

This change blocks redirect URIs that contain pre-loaded OIDC response parameters, preventing potential security vulnerabilities by ensuring redirect URIs are not tampered with.

Health Assessment

• • The PR was merged after a single review and a moderate cycle time, indicating a straightforward security fix with minimal friction.

Summary

Improvements for webauthn registration and validation

Enhances WebAuthn registration and validation to improve security and user experience for authentication flows.

Health Assessment

• • Quick review and minimal changes led to a smooth merge, but the long cycle time reflects the backport to a release branch rather than development effort.

Summary

Stop cookie-based SSO re-auth from resetting brute-force counter

Prevents malicious actors from bypassing brute-force protection by resetting counters during SSO re-auth, enhancing security for logged-in users.

Health Assessment

• • The PR addressed a critical security issue with minimal changes and received a single approval after a moderate review time, resulting in a slow overall cycle due to the long lead time before review.

Summary

Fix admin console session error on federated user deletion

Prevents admin console crashes when a federated user is removed while an active session remains, improving stability and user experience.

Health Assessment

• • Quick resolution with minimal changes, indicating a straightforward bug fix.

Summary

Upgrade Infinispan to 16.0.12

Updates the Infinispan cache library to version 16.0.12, ensuring compatibility with the latest features and security patches, and updates configuration examples accordingly.

Health Assessment

• • The PR was reviewed quickly but took a long time to merge, likely due to scheduling or other dependencies.

Summary

Reject redirect URIs with pre-loaded OIDC parameters

Prevents malicious redirect URIs that include OIDC response parameters, enhancing security by ensuring redirect URIs are clean and not pre-populated.

Health Assessment

• • The PR took over 10 days to merge, but the review was quick and the change was relatively small, indicating a straightforward security fix with minimal friction.

Summary

Add warning about slow migration to 26.6

Adds a warning to the upgrade documentation to alert users about the slow migration process for version 26.6, helping teams plan and avoid downtime.

Health Assessment

• • Documentation update completed with minimal review, indicating a straightforward change with no significant risk to production.

Summary

Reuse pooled LDAP admin connection instead of re-binding per operation

Optimizes LDAP admin operations by reusing a single connection, reducing latency and resource usage for authentication services.

Health Assessment

• • The PR had a moderate cycle time due to extensive LDAP testing, but the review was quick and the changes were straightforward.

Summary

Fix StackOverflowError with FGAP and Organizations

Resolves a StackOverflowError when using FGAP with Organizations on user lookup, improving system stability.

Health Assessment

• • Quick review and merge indicate a straightforward fix for a critical issue.

Summary

Fix admin UI crash on missing GroupsResourceContext

This fix prevents the admin UI from crashing when the GroupsResourceContext is missing, ensuring uninterrupted management of user groups.

Health Assessment

• • The PR was reviewed quickly and merged after a single commit, indicating a straightforward bug fix with minimal impact.

Summary

Backport fix for NPE in migration

Fixes a null pointer exception that could occur during migration to version 26.6.2, improving stability for users upgrading Keycloak.

Health Assessment

• • The PR took almost six days to merge, indicating a slow review process, but the change was small and straightforward, suggesting low technical risk.

Summary

Add explicit client reference to RAR scope parsing

Ensures correct handling of client references in RAR scope parsing, improving security and correctness for 26.6 releases.

Health Assessment

• • PR fixed critical dynamic scope bugs; review was quick but long cycle time suggests backlog and moderate risk due to medium scope and extended time to merge.

Summary

Enforce path containment in FolderTheme templates

Improves security by ensuring template paths are normalized and confined to allowed directories, preventing path traversal attacks.

Health Assessment

• • The PR took 5 days to merge with a single review after 2 days, indicating moderate review friction but minimal code changes.

Summary

Initialize FreeMarker with versioned defaults

Updates FreeMarker configuration to use newer defaults, improving security and correctness.

Health Assessment

• • The PR was a small backport that required a single review after a few days, indicating a straightforward change with minimal risk.

Summary

TimeSelector clears input and switches units

Fixes UI behavior in admin console, ensuring zero values reset input and unit selection, improving user experience.

Health Assessment

• • PR had a quick review but a long overall cycle, likely due to scheduling; minimal changes and low risk to production.

Summary

Fix client secret rotation docs labeling

The documentation now correctly labels client secret rotation as preview instead of experimental. This reduces confusion for administrators and ensures accurate communication of feature readiness.

Health Assessment

• • Documentation update with minimal changes; long review time likely due to scheduling rather than complexity.

Summary

Clarify unsupported operator version mix in cluster

This update warns users that deploying multiple Keycloak Operator versions on a single Kubernetes/OpenShift cluster is unsupported, preventing potential conflicts and ensuring stability.

Health Assessment

• • The PR was reviewed quickly with AI assistance, and the documentation change is minimal, indicating a low-risk, low-effort update.

Summary

Add connection options to CLI help

Enhances the Admin CLI v2 help output to display global connection options for leaf commands, improving usability for administrators.

Health Assessment

• • The PR had a long cycle time due to a lengthy review process, but the review was quick and the change was small and straightforward.

Summary

Add cacheless feature documentation

Initial documentation for cacheless feature in Keycloak high availability guides

Health Assessment

• • The PR had a fast review time and low number of comments, indicating a smooth review process

Summary

Centralize constants in ClientTest

Improves test maintainability by moving magic strings to constants, simplifying lambda expressions, and removing unused imports, enhancing readability.

Health Assessment

• • Quick review and approval after bot flagged flaky test; minimal changes; low risk refactor.

Summary

Improve ImpersonationTest reliability

Enhances test stability and readability for admin impersonation integration, reducing flaky test failures.

Health Assessment

• • Fast review and merge with minimal rework, indicating a straightforward test cleanup.

Summary

Generate queryable fields documentation from code

Updates the Admin API v2 documentation pipeline to generate queryable fields tables from Java mapper/schema sources, reducing manual effort and ensuring docs stay in sync with code.

Health Assessment

• • The PR was reviewed quickly by AI and human reviewers, but the overall cycle time was long, indicating a scheduling delay or backlog.

Summary

Check if client is enabled when RAT is used

Prevents disabled clients from being managed via Registration Access Tokens, addressing CVE-2026-9705 and improving security.

Health Assessment

• • Quick review and approval with minimal changes; security fix resolved promptly.

Summary

Enforce single-use request_uri per FAPI2 spec

Aligns Keycloak’s PAR handling with the FAPI2 Security Profile, ensuring request_uri is only consumed after authentication completes, improving security compliance.

Health Assessment

• • The PR required extensive review with multiple AI-generated comments, resulting in a slow cycle time despite a quick first review.

Summary

Remove support for symmetric algorithms in JWT public key validators

This PR removes support for symmetric algorithms in JWT public key validators to mitigate CVE-2026-11800, ensuring only asymmetric algorithms are accepted and strengthening security for JWT flows.

Health Assessment

• • Security fix with minimal review iterations, quick approval, moderate scope, and no major blockers.