From f5da8ac3ff845333c620a00c1a97e5deae1a18bd Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Fri, 5 Jun 2026 02:27:00 +0000
Subject: [PATCH] upstream(keycloak): release-notes sources

---
 cc-ci-plan/upstream/keycloak.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 cc-ci-plan/upstream/keycloak.md

diff --git a/cc-ci-plan/upstream/keycloak.md b/cc-ci-plan/upstream/keycloak.md
new file mode 100644
index 0000000..7ab4fc9
--- /dev/null
+++ b/cc-ci-plan/upstream/keycloak.md
@@ -0,0 +1,13 @@
+# Upstream sources — keycloak
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app | keycloak/keycloak | https://github.com/keycloak/keycloak | https://github.com/keycloak/keycloak/releases |
+| db | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/ |
+
+## Standing notes
+- keycloak/keycloak uses `KC_DB=mariadb` backend; mariadb minor version bumps (12.x→12.y) are low-risk for Keycloak but test transaction isolation behavior.
+- mariadb 12.3 changes `innodb_snapshot_isolation` default to ON (was OFF in 12.2); no Keycloak-specific incompatibility known.
+- MariaDB removed deprecated vars `big_tables`, `large_page_size`, `storage_engine` in 12.x — not used by Keycloak's compose config.
+- Keycloak patch releases (26.x.y) are security/bug fixes only; no config changes expected between 26.6.2 → 26.6.3.
+- Recipe version label scheme: `<recipe-semver>+<keycloak-version>` (e.g. `10.7.2+26.6.2`).