recipe-maintainers/keycloak
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade keycloak to 26.8.1 #12

Merged
trav merged 1 commits from upgrade-84ef44b into main 2026-10-19 16:30:58 +00:00
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-10-16 02:42:13 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade — keycloak app 26.8.0 → 26.8.1

Bumps the Keycloak app image only. Base is the true current upstream main (ecea1381, label 10.9.5+26.8.0).

service image current new
app keycloak/keycloak 26.8.0 26.8.1
db mariadb 12.3 12.3 (held — see below)

Operator Action Required

  • None for the app bump. 26.8.1 is a patch release (security + bug fixes); no config / env / volume / migration changes. The KEYCLOAK_ADMIN* → KC_BOOTSTRAP_ADMIN_* deprecation and the Hostname-v1 warning are pre-existing (present on 26.8.0 / 26.7.x) and unchanged here.
  • MariaDB deliberately held at 12.3. 13.0 is a rolling (non-LTS) release and a major step off the 12.3 LTS line. A 12 → 13 in-place upgrade of a populated data volume is not something that can be validated safely in a throwaway chaos deploy, so per the minimal-safe-window principle only the app is upgraded. Revisit as a dedicated dump/restore migration when 13.x reaches LTS.
  • No version label change in this PR. The operator's final abra recipe release computes/publishes the label.

Upstream release notes

Upstream release notes: app keycloak/keycloak 26.8.0→26.8.1: https://github.com/keycloak/keycloak/releases/tag/26.8.1
Upgrading guide: https://www.keycloak.org/docs/latest/upgrading/index.html
db mariadb unchanged (held at 12.3); 13.0 rationale: https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements

Security

26.8.1 is a security patch. Deterministic advisory scan counted 22 CVEs fixed by this window (by patched-version ranges), including CVE-2026-96446 (PAR single-use bypass via prompt=none), CVE-2026-96445 (conditional-OTP header trust), CVE-2026-94218 (2FA enforcement bypass), CVE-2026-94000/CVE-2026-94001 (FGAP privilege escalation), CVE-2026-97311, CVE-2026-103884, CVE-2026-107121, plus jackson-databind / owasp-java-html-sanitizer dependency fixes. The release notes' Security-fixes section names these same CVEs; the deterministic 22 is a floor.

Live deploy evidence (step 2b, cc-ci, --chaos)

  • Deployed WIP head 84ef44b as dev-keycloak.ci.commoninternet.net (local swarm), then torn down.
  • app keycloak/keycloak:26.8.1@sha256:79c623a22abacf3fe6c00a5fb30f5b7843d717b234033b80995891c06116d244, db mariadb:12.3; services 1/1.
  • logs: Keycloak 26.8.1 on JVM (powered by Quarkus 3.40.1) started in 6.594s; Bootstrap completed.
  • /realms/master → HTTP 200.
  • teardown verified: 0 stacks / 0 dev-keycloak* volumes left.
  • abra recipe lint keycloak -C: no new errors (pre-existing warns R002/R015 only).

Release

Recommended publish command (after this PR merges upstream) — patch bump, app 26.8.0→26.8.1:

abra recipe release keycloak -z

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Recipe upgrade — keycloak app `26.8.0` → `26.8.1` Bumps the Keycloak **app image only**. Base is the true current upstream main (`ecea1381`, label `10.9.5+26.8.0`). | service | image | current | new | |---------|-------|---------|-----| | app | `keycloak/keycloak` | `26.8.0` | `26.8.1` | | db | `mariadb` | `12.3` | `12.3` (**held** — see below) | ### Operator Action Required - **None for the app bump.** `26.8.1` is a patch release (security + bug fixes); no config / env / volume / migration changes. The `KEYCLOAK_ADMIN*` → `KC_BOOTSTRAP_ADMIN_*` deprecation and the Hostname-v1 warning are **pre-existing** (present on 26.8.0 / 26.7.x) and unchanged here. - **MariaDB deliberately held at `12.3`.** `13.0` is a *rolling* (non-LTS) release and a **major** step off the `12.3` LTS line. A `12 → 13` in-place upgrade of a populated data volume is not something that can be validated safely in a throwaway chaos deploy, so per the minimal-safe-window principle only the app is upgraded. Revisit as a dedicated dump/restore migration when `13.x` reaches LTS. - **No version label change in this PR.** The operator's final `abra recipe release` computes/publishes the label. ### Upstream release notes **Upstream release notes:** app `keycloak/keycloak` `26.8.0`→`26.8.1`: https://github.com/keycloak/keycloak/releases/tag/26.8.1 Upgrading guide: https://www.keycloak.org/docs/latest/upgrading/index.html db `mariadb` unchanged (held at `12.3`); 13.0 rationale: https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements ### Security `26.8.1` is a security patch. Deterministic advisory scan counted **22 CVEs fixed by this window** (by patched-version ranges), including `CVE-2026-96446` (PAR single-use bypass via `prompt=none`), `CVE-2026-96445` (conditional-OTP header trust), `CVE-2026-94218` (2FA enforcement bypass), `CVE-2026-94000`/`CVE-2026-94001` (FGAP privilege escalation), `CVE-2026-97311`, `CVE-2026-103884`, `CVE-2026-107121`, plus `jackson-databind` / `owasp-java-html-sanitizer` dependency fixes. The release notes' Security-fixes section names these same CVEs; the deterministic 22 is a floor. ### Live deploy evidence (step 2b, cc-ci, `--chaos`) - Deployed WIP head `84ef44b` as `dev-keycloak.ci.commoninternet.net` (local swarm), then torn down. - app `keycloak/keycloak:26.8.1@sha256:79c623a22abacf3fe6c00a5fb30f5b7843d717b234033b80995891c06116d244`, db `mariadb:12.3`; services 1/1. - logs: `Keycloak 26.8.1 on JVM (powered by Quarkus 3.40.1) started in 6.594s`; `Bootstrap completed`. - `/realms/master` → **HTTP 200**. - teardown verified: 0 stacks / 0 `dev-keycloak*` volumes left. - `abra recipe lint keycloak -C`: no new errors (pre-existing warns R002/R015 only). ### Release Recommended publish command (after this PR merges upstream) — **patch** bump, app `26.8.0`→`26.8.1`: ``` abra recipe release keycloak -z ``` Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-10-16 02:42:13 +00:00
chore: upgrade keycloak to 26.8.1
cc-ci/testme cc-ci: success
Details
84ef44b9e5
autonomic-bot requested review from trav 2026-10-16 02:42:13 +00:00
autonomic-bot requested review from notplants 2026-10-16 02:42:13 +00:00
autonomic-bot commented 2026-10-16 02:42:47 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-16 02:42:56 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ 84ef44b9 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `keycloak` @ `84ef44b9` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/58/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/58) [![level](https://ci.autonomic.zone/runs/58/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/58) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/58) · [dashboard](https://ci.autonomic.zone/)
trav merged commit b6b015d8ac into main 2026-10-19 16:30:58 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/keycloak#12