recipe-maintainers/keycloak
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: keycloak upgrade to 26.8.2 #14

Closed
autonomic-bot wants to merge 0 commits from upgrade-26.8.2 into main
pull from: upgrade-26.8.2
merge into: :main
Conversation 3 Commits - Files Changed -
+1 -1
autonomic-bot commented 2026-11-06 03:56:08 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade: keycloak 26.8.1 → 26.8.2

App-only patch bump. mariadb stays at 13.0 (last week's bump is already in upstream main, 10.9.7+26.8.1).

Image tag table

service image current new
app keycloak/keycloak 26.8.1 26.8.2
db mariadb 13.0 13.0 (unchanged)

What changed

  • compose.yml: keycloak/keycloak:26.8.1 → keycloak/keycloak:26.8.2
  • No compose/config/env/volume/secret changes required.
  • Recipe version label intentionally untouched (10.9.7+26.8.1); the release bump is the operator's
    final publish step (see below).

Upstream release notes

Upstream release notes: keycloak 26.8.1→26.8.2: https://github.com/keycloak/keycloak/releases/tag/26.8.2
Migration guide: https://www.keycloak.org/docs/latest/upgrading/#migration-changes
Upstream release notes: mariadb 13.0 (unchanged): https://mariadb.com/docs/release-notes/community-server/13.0/

26.8.2 is a security-patch release: it fixes 36 unique CVEs (deterministic advisory scan, adjudicated
COUNTED) plus upgrades the bundled Quarkus to 3.40.1.1. Representative fixes include stored XSS on the
login page, SAML endpoint DoS/OOM, DCR/account-takeover issues, and an OIDC offline-token revocation
bypass. No documented breaking config changes; Liquibase applies any schema updates automatically at
startup.

Verification (live on cc-ci, before CI)

Deployed the published 26.8.1 + mariadb:13.0 on a fresh dev-keycloak stack, seeded a realm +
client through the Admin API, then redeployed this WIP head (26.8.2) over the same data volume:

  • app converged 1/1 on keycloak/keycloak:26.8.2 (Quarkus 3.40.1.1), Bootstrap completed;
  • master-realm OIDC discovery → HTTP 200; seeded upgradeprobe realm discovery → HTTP 200;
  • the seeded probe-client survived the upgrade;
  • dev stack + volumes torn down afterwards (0 leaked stacks/volumes).

abra recipe lint keycloak -C -n → exit 0 (only the pre-existing R002 healthcheck / R015 secret-name
warnings). Existing cc-ci tests used unchanged.

Recommended release (operator, after merge; do NOT run here)

This is a patch/security bump, so the release is a patch bump:

abra recipe release keycloak -z

Advisory scan

36 CVEs fixed by this upgrade (see the run log in /srv/cc-ci/.cc-ci-logs/upgrades/keycloak-upgrade-2026-11-06.md).

Tested on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for
operator review.

cc @trav @notplants

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Recipe upgrade: keycloak 26.8.1 → 26.8.2 App-only patch bump. `mariadb` stays at `13.0` (last week's bump is already in upstream main, `10.9.7+26.8.1`). ### Image tag table | service | image | current | new | |---------|-------|---------|-----| | app | keycloak/keycloak | 26.8.1 | **26.8.2** | | db | mariadb | 13.0 | 13.0 (unchanged) | ### What changed - `compose.yml`: `keycloak/keycloak:26.8.1` → `keycloak/keycloak:26.8.2` - No compose/config/env/volume/secret changes required. - **Recipe version label intentionally untouched** (`10.9.7+26.8.1`); the release bump is the operator's final publish step (see below). ### Upstream release notes **Upstream release notes:** keycloak 26.8.1→26.8.2: https://github.com/keycloak/keycloak/releases/tag/26.8.2 **Migration guide:** https://www.keycloak.org/docs/latest/upgrading/#migration-changes **Upstream release notes:** mariadb 13.0 (unchanged): https://mariadb.com/docs/release-notes/community-server/13.0/ 26.8.2 is a security-patch release: it fixes 36 unique CVEs (deterministic advisory scan, adjudicated COUNTED) plus upgrades the bundled Quarkus to 3.40.1.1. Representative fixes include stored XSS on the login page, SAML endpoint DoS/OOM, DCR/account-takeover issues, and an OIDC offline-token revocation bypass. No documented breaking config changes; Liquibase applies any schema updates automatically at startup. ### Verification (live on cc-ci, before CI) Deployed the published `26.8.1` + `mariadb:13.0` on a fresh `dev-keycloak` stack, seeded a realm + client through the Admin API, then redeployed this WIP head (`26.8.2`) over the same data volume: - app converged `1/1` on `keycloak/keycloak:26.8.2` (Quarkus 3.40.1.1), `Bootstrap completed`; - master-realm OIDC discovery → HTTP 200; seeded `upgradeprobe` realm discovery → HTTP 200; - the seeded `probe-client` survived the upgrade; - dev stack + volumes torn down afterwards (0 leaked stacks/volumes). `abra recipe lint keycloak -C -n` → exit 0 (only the pre-existing R002 healthcheck / R015 secret-name warnings). Existing cc-ci tests used unchanged. ### Recommended release (operator, after merge; do NOT run here) This is a patch/security bump, so the release is a **patch** bump: ``` abra recipe release keycloak -z ``` ### Advisory scan 36 CVEs fixed by this upgrade (see the run log in `/srv/cc-ci/.cc-ci-logs/upgrades/keycloak-upgrade-2026-11-06.md`). Tested on the cc-ci recipe CI server (full suite, cold, against this PR head). **NOT merged** — for operator review. cc @trav @notplants Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-11-06 03:56:08 +00:00
chore: keycloak upgrade to 26.8.2
cc-ci/testme cc-ci: success
Details
1ad160b4fb
autonomic-bot requested review from trav 2026-11-06 03:56:09 +00:00
autonomic-bot requested review from notplants 2026-11-06 03:56:09 +00:00
autonomic-bot commented 2026-11-06 03:56:17 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-06 03:56:26 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ 1ad160b4 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `keycloak` @ `1ad160b4` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/133/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/133) [![level](https://ci.autonomic.zone/runs/133/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/133) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/133) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot commented 2026-11-09 20:02:15 +00:00
Author
Owner
Copy Link
Copy Source

Upstreamed to git.coopcloud.tech/coop-cloud/keycloak and released as 10.9.8+26.8.2: https://git.coopcloud.tech/coop-cloud/keycloak/src/tag/10.9.8+26.8.2 — closing.

Upstreamed to git.coopcloud.tech/coop-cloud/keycloak and released as `10.9.8+26.8.2`: https://git.coopcloud.tech/coop-cloud/keycloak/src/tag/10.9.8+26.8.2 — closing.
autonomic-bot closed this pull request 2026-11-09 20:02:16 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/keycloak#14