Pull Request Explorer

Summary

Update protostream lock references

Ensures correct protostream lock dependencies, improving build stability and security.

Health Assessment

• • Fast review and merge with minimal changes to pom.xml, indicating low risk and high confidence.

Summary

Close SimpleHttpResponse and HttpResponse on all code paths

Fixes resource leaks in identity broker HTTP connections, improving stability and preventing connection exhaustion.

Health Assessment

• • PR closed quickly with minimal changes, indicating a straightforward bug fix with low review friction.

Summary

Fix RoleSelect undefined guard crash

Prevents page crashes when RoleSelect mounts before roles are set, improving stability for permission configuration.

Health Assessment

• • Minimal changes, quick review, no rework, merged swiftly.

Summary

Add missing selectRoles message key

Adds a missing translation key for the Roles resource type in the admin UI, ensuring help popover displays correct text.

Health Assessment

• • Quick fix with minimal changes, AI-assisted review, no rework.

Summary

Prevent reverse tabnabbing for account console client links

Adds security fix to prevent reverse tabnabbing by adding noopener and noreferrer to client‑controlled links in the account console, with regression tests to ensure coverage.

Health Assessment

• • Security fix required multiple review rounds and regression tests, leading to a long cycle time of 218 hours despite an immediate first review.

Summary

Use correct role for editing organization route

Updates the admin UI to enforce the appropriate permission, ensuring users only need the query-organizations role to edit an organization, improving security and user experience.

Health Assessment

• • Fast review and merge with minimal changes, indicating low complexity and risk.

Summary

Add accessible names to FGAP remove buttons

Improves screen reader accessibility by labeling remove buttons in fine‑grained admin permission selects, enhancing usability for users with disabilities.

Health Assessment

• • The PR was reviewed and merged within 7 hours, with minimal rework and no significant blockers. AI assistance accelerated the implementation and testing of the accessibility fix.

Summary

Filter groups by view permission in getGroupsInRole

Adds permission-based filtering to group retrieval, ensuring users only see groups they are authorized to view and tightening security.

Health Assessment

• • Fast cycle time and single review round indicate a straightforward, low-risk fix with minimal rework.

Summary

Avoid logging SPNEGO credentials in log

Prevents sensitive SPNEGO credentials from being exposed in logs, enhancing security and compliance.

Health Assessment

• • Quick resolution with minimal changes and AI assistance, indicating efficient handling of a security fix.

Summary

Inherit dependency versions via Keycloak parent

This change ensures the test‑stability module uses the same dependency versions as the main Keycloak project, improving consistency and reducing version conflicts.

Health Assessment

• • Quick, single‑commit refactor with minimal review, indicating low complexity and high confidence in the change.

Summary

Update jackson-databind dependency

Bumps jackson-databind to the latest version, improving stability and compatibility for the admin client.

Health Assessment

• • Rapid review and merge with minimal changes indicate low risk and efficient process.

Summary

Close SimpleHttpResponse and HttpResponse on all code paths

Fixes HTTP connection leaks in identity brokering by ensuring all responses are properly closed, improving reliability and resource usage.

Health Assessment

• • The PR addressed a critical resource leak with extensive code changes across multiple identity provider modules, requiring a single review cycle but generating many comments, indicating complexity but efficient resolution.

Summary

Add Kerberos service-ticket round trip

Enables a full service-ticket round trip for Kerberos username/password authentication, improving authentication reliability and allowing configuration to skip round-trip if needed.

Health Assessment

• • The PR had a slow cycle time of 73.5 hours and multiple review comments, indicating moderate complexity and potential risk.

Summary

Use Keycloak parent in misc/test-stability to inherit dependency versions

Ensures test stability module inherits dependency versions from the Keycloak parent pom, reducing version drift and simplifying maintenance.

Health Assessment

• • Quick merge with minimal changes indicates low complexity and high confidence in the change.

Summary

Upgrade to Quarkus 3.27.6

Keycloak is upgraded to Quarkus 3.27.6, providing improved performance, security, and compatibility with the latest Java ecosystem.

Health Assessment

• • Quick review and merge, minimal changes, no blockers.

Summary

Backport secure client node executor to 26.6

Adds SSRF protection for legacy client node registration, enhancing security for Keycloak deployments. The change is opt‑in and requires configuration of hostname regex patterns.

Health Assessment

• • The PR introduced a new SSRF protection executor, required multiple review rounds but was merged within a day, indicating efficient collaboration.

Summary

Update tools.jackson.core:jackson-databind

Bumps the Jackson databind library to a newer version, ensuring Keycloak’s admin client remains compatible and secure.

Health Assessment

• • Quick dependency bump with minimal review, indicating low risk and high confidence.

Summary

Upgrade to Quarkus 3.33.4

Upgrading Keycloak to Quarkus 3.33.4 brings performance improvements, bug fixes, and security patches, ensuring a more stable and secure authentication platform for users.

Health Assessment

• • Quick review and merge indicate low complexity and minimal risk.

Summary

Use Keycloak parent in misc/test-stability to inherit dependency versions

Updates the test-stability module to inherit dependency versions from the Keycloak parent POM, ensuring consistent and secure dependency management across the project.

Health Assessment

• • Quick review and merge with minimal changes, indicating low complexity and high confidence in the update.

Summary

Add OpenJDK 27 to test matrix

Expands CI test coverage to include Java 27, ensuring early detection of compatibility issues and maintaining stability for future releases.

Health Assessment

• • Fast review and minimal changes indicate low complexity and quick integration.

Summary

Migrate testsuite to commons-configuration2

Update test suite to use newer configuration library, improving stability and compatibility.

Health Assessment

• • Fast review and merge with minimal changes indicate a low‑risk refactor of test code.

Summary

Remove external webpage from ClientRedirectTest

This change removes dependency on an external webpage in the ClientRedirectTest, reducing test flakiness and improving CI stability.

Health Assessment

• • Quick review and merge with minimal changes, indicating low complexity and high confidence.

Summary

Fix broken documentation links

Corrects broken links in Keycloak documentation, improving user experience and reducing support tickets.

Health Assessment

• • Merged within 20 minutes with no review, indicating a straightforward, low‑risk change.

Summary

Fix broken documentation links

Corrects broken links in release notes and threat validation docs, improving documentation reliability.

Health Assessment

• • Quick fix with minimal changes, merged within minutes.

Summary

Update ClientRedirectTest to not use an external webpage

Fixes flaky client redirect test by removing dependency on an external webpage, improving test stability and reliability.

Health Assessment

• • Quick approval with minimal changes; test improvement reduces flakiness and improves CI reliability.

Summary

Instruct labeller to assign the 27.0.0 release label

Adds a rule to the CI workflow to automatically tag the 27.0.0 release, ensuring consistent release labeling.

Health Assessment

• • Fast review and merge with minimal changes to CI workflow, indicating low complexity and risk.

Summary

Fix user endpoint bypass of reset-password permission

Prevents unauthorized password resets by enforcing authorization before user mutations, addressing a CVE.

Health Assessment

• • Fast turnaround with AI-assisted review; minimal rework; critical security fix.

Summary

Fix number control stepping with string values

Ensures numeric steppers correctly handle string values, preventing incorrect increments/decrements and improving user experience and data integrity.

Health Assessment

• • The PR required a single review cycle and moderate code changes, but the overall cycle time was extended due to a review backlog, indicating a straightforward bug fix with low risk.

Summary

Filter authentication flow usage by client and IdP permissions

This change limits the visibility of clients and identity providers in the admin UI to only those the admin can view. It prevents unauthorized admins from seeing sensitive configuration details.

Health Assessment

• • Fast review and merge within 20 hours, minimal rework, indicating a straightforward security fix. AI assistance was used to generate and review the code.

Summary

Document PgBouncer failover behavior in the DB guide

Adds documentation clarifying PgBouncer’s stale in_hot_standby reporting after failover, linking to upstream issue, improving operational visibility.

Health Assessment

• • Quick documentation update with AI assistance, approved within 1.2h, minimal review friction.

Summary

Prevent privilege escalation via group membership

Adds security checks to stop users from gaining admin rights through group membership, enhancing IAM integrity.

Health Assessment

• • Fast review cycle with AI assistance, minimal rework, quick merge.

Summary

Truncate certificate CN to 64 characters per RFC 5280

Ensures certificate common names comply with RFC 5280 by truncating to 64 characters, preventing validation errors and enhancing security compliance.

Health Assessment

• • Fast turnaround with minimal rework, indicating straightforward bugfix with clear scope.

Summary

Update UI translations via Hosted Weblate

Adds updated translations for multiple languages, improving internationalization for Keycloak Admin UI.

Health Assessment

• • The PR involved a large batch of translation updates, reviewed quickly but required multiple iterations of AI‑assisted review comments, indicating a high‑volume but low‑complexity change.

Summary

Upgrade Quarkus to 3.40.1

Update Keycloak's underlying framework to the latest Quarkus version, improving performance and security.

Health Assessment

• • Fast review and merge, minimal changes, low risk.

Summary

Promote Client v2 to preview

Enables preview mode for Client v2, updating guides and enabling reconciliation, improving feature rollout control.

Health Assessment

• • The PR required multiple iterations after a review request, indicating moderate complexity and a need for careful validation before merging.

Summary

Handle missing Single Logout Service URL during SAML IdP-initiated logout

Fixes SAML logout errors when an IdP has no Single Logout Service URL, preventing 500 errors and ensuring consumer user sessions are cleaned up.

Health Assessment

• • Quick fix with minimal code changes, reviewed and approved by an AI-assisted reviewer, resolving a critical logout error with fast turnaround.

Summary

Ignore audience for disabled and removed clients

This change prevents authentication failures by ignoring audience claims for disabled or removed clients, improving reliability for clients that are no longer active. It also updates documentation and adds tests to cover the new behavior.

Health Assessment

• • The PR took about two days to merge with a single review after a long review time, indicating moderate review friction but a straightforward change.

Summary

Add CI test suite and documentation for HTTP_CLIENT_V2

Adds a comprehensive CI test suite and documentation for the HTTP_CLIENT_V2 feature, enabling automated validation of outgoing HTTP paths and improving reliability.

Health Assessment

• • The PR had a long cycle time and review time, but required minimal rework and was straightforward, indicating a bottleneck in the review process rather than complexity.

Summary

Update ClientRedirectTest to not use an external webpage

This change removes external webpage dependencies from the client redirect test, improving reliability and speed.

Health Assessment

• • Quick review and merge within 2 hours, minimal changes to test code, no risk to production.

Summary

Exclude self-signed roots from signed issuer metadata

Removes self-signed trust anchors from signed issuer metadata, improving security and ensuring proper certificate chain validation for Keycloak issuers.

Health Assessment

• • Quick review and merge with minimal changes, indicating low complexity and high confidence in the fix.

Summary

Ensure user lookup uses cached adapter

Fixes cache bypass for user lookup, improving performance and consistency.

Health Assessment

• • Quick fix with minimal changes, approved after a single review, indicating low complexity.

Summary

Update ClientRedirectTest to not use an external webpage

This change removes dependency on an external webpage in the client redirect integration test, improving test reliability and speed.

Health Assessment

• • Quick review and merge indicate minimal impact and straightforward change.

Summary

Re-enabling caching of user sessions by default

Restores default caching for persistent user sessions, improving performance and reducing database load.

Health Assessment

• • The PR was reviewed and merged within 2.3 hours, with only one additional commit after the first review and two review rounds, indicating a smooth, low‑risk change.

Summary

Fix broken documentation links

Corrects broken links in the 25.0.0 release notes, ensuring accurate documentation for users.

Health Assessment

• • Quick fix with minimal changes, no rework needed.

Summary

Add issuer_info support to OID4VCI metadata

Enables credential issuers to publish additional issuer information required for EUDI registration certificates, improving compliance and interoperability.

Health Assessment

• • Fast cycle time and minimal rework; AI-assisted review helped identify validation issues early, resulting in a smooth merge.

Summary

Fix broken documentation links

Corrects broken links in release notes and threat validation docs, improving user experience and reducing confusion.

Health Assessment

• • PR was merged within minutes with no review friction, indicating a straightforward documentation fix.

Summary

Increase test coverage for domain without IdP routing

Adds comprehensive tests for organization broker membership scenarios in Keycloak, ensuring robust behavior when IdP routing is disabled.

Health Assessment

• • Long review cycle likely due to backlog; minimal changes and no rework.

Summary

Fix group representation leaking role metadata

Removes unauthorized admin access to client/realm role metadata, enhancing security for Keycloak users.

Health Assessment

• • Rapid review and merge within 24 hours, minimal rework, indicating an efficient process for addressing security issues.

Summary

Upgrade to Quarkus 3.33.4

Upgrade Keycloak to Quarkus 3.33.4, enhancing performance and security.

Health Assessment

• • Rapid review and merge with minimal code changes, indicating low risk.

Summary

Filter organization links when caller cannot view the org

Prevents unauthorized users from seeing organization links, tightening security and compliance for Keycloak users.

Health Assessment

• • The PR was reviewed and merged within 6 hours, with a single review round and minimal comments, indicating a smooth, low-friction process.