fix(deps): update all non-major dependencies #59
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
6bff3cf to
cfc8963
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
cfc8963 to
e8a1cc2
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
a6b83d8 to
2b725d6
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
2b725d6 to
1dc1c5e
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
1d7b24a to
fee4e7a
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
fee4e7a to
649f8c3
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
649f8c3 to
5cf2a48
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.0.5->4.0.83.13.0->3.14.03.5.1->3.6.01.20.4->1.20.63.27.2->3.27.35.11.4->5.12.01.49.0->1.50.04.0.5->4.0.826.0.3->26.0.426.0.7->26.1.326.0.7->26.1.326.0.7->26.1.326.0.7->26.1.3Release Notes
smallrye/smallrye-open-api (io.smallrye:smallrye-open-api-maven-plugin)
v4.0.8Compare Source
v4.0.7Compare Source
v4.0.6Compare Source
Flowas a wrapper typedasniko/testcontainers-keycloak (com.github.dasniko:testcontainers-keycloak)
v3.6.0Compare Source
What's Changed
New Contributors
Full Changelog: dasniko/testcontainers-keycloak@3.5.1...3.6.0
testcontainers/testcontainers-java (org.testcontainers:junit-jupiter)
v1.20.6Compare Source
What's Changed
v1.20.5Compare Source
What's Changed
ServiceBusEmulatorContainerto Azure module (#9795) @nagyestaEventHubsEmulatorContainerto Azure module (#9665) @nagyestaAzuriteContainerto Azure module (#9661) @nagyestaldapmodule (#9987) @eddumelendezscylladbmodule (#8002) @mkorolyovpineconemodule (#9911) @eddumelendez🚀 Features & Enhancements
RABBITMQ_DEFAULT_USERenv var withwithAdminUser(#9571) @eddumelendezgetPortmethod (#9623) @edeandrea🐛 Bug Fixes
CouchbaseContainer(#9957) @albihnfSolrContainerstart parameters for version >= 9.7.0 (#9926) @mkrConfluentKafkaContainerandKafkaContainer(#9910) @eddumelendez📖 Documentation
🧹 Housekeeping
vectorized/redpandaimage (#9624) @eddumelendez📦 Dependency updates
microsoft/playwright-java (com.microsoft.playwright:playwright)
v1.50.0Compare Source
Miscellaneous
UI updates
canvascontent in traces is error-prone. Display is now disabled by default, and can be enabled via theDisplay canvas contentUI setting.CallandNetworkpanels now display additional time information.Breaking
<input>,<select>, or a number of other editable elements.Browser Versions
This version was also tested against the following stable channels:
keycloak/keycloak (org.keycloak:keycloak-model-jpa)
v26.1.3Compare Source
Highlights
Send Reset Email force login again for federated users after reset credentials
In version 26.1.1 a new configuration option was added to the
reset-credential-email(Send Reset Email) authenticator to allow changing the default behavior after the reset credentials flow. Now the optionforce-login(Force login after reset) is adding a third configuration valueonly-federated, which means that the force login is true for federated users and false for the internal database users. The new behavior is now the default. This way all users managed by user federation providers, whose implementation can be not so tightly integrated with Keycloak, are forced to login again after the reset credentials flow to avoid any issue. This change in behavior is due to the secure by default policy.For more information, see Enable forgot password.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Bugs
coreaccount/uiadmin/uiadmin/uiadmin/uiadmin/uiadmin/uidist/quarkusadmin/uiciauthenticationstorageorganizationsauthenticationlogin/uiadmin/uiauthenticationdocssamlv26.1.2Compare Source
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Deprecated features
Enhancements
dependenciesBugs
infinispancoreoidcinfinispanv26.1.1Compare Source
Highlights
New option in X.509 authenticator to abort authentication if CRL is outdated
The X.509 authenticator has a new option
x509-cert-auth-crl-abort-if-non-updated(CRL abort if non updated in the Admin Console) to abort the login if a CRL is configured to validate the certificate and the CRL is not updated in the time specified in the next update field. The new option defaults totruein the Admin Console. For more details about the CRL next update field, see RFC5280, Section-5.1.2.5.The value
falseis maintained for compatibility with the previous behavior. Note that existing configurations will not have the new option and will act as if this option was set tofalse, but the Admin Console will add the default valuetrueon edit.New option in Send Reset Email to force a login after reset credentials
The
reset-credential-email(Send Reset Email) is the authenticator used in the reset credentials flow (forgot password feature) for sending the email to the user with the reset credentials token link. This authenticator now has a new optionforce-login(Force login after reset). When this option is set totrue, the authenticator terminates the session and forces a new login.For more details about this new option, see Enable forgot password.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
organizationsadmin/client-javadocsBugs
translationsldapadmin/uidist/quarkusdocsorganizationslogin/uilogin/uilogin/uiorganizationscoredocscoreoperatorciciauthenticationdocscilogin/uitranslationsadmin/uiv26.1.0Compare Source
Highlights
Transport stack
jdbc-pingas new defaultKeycloak now uses by default its database to discover other nodes of the same cluster, which removes the need of additional network related configurations especially for cloud providers. It is also a default that will work out-of-the-box in cloud environments.
Previous versions of Keycloak used as a default UDP multicast to discover other nodes to form a cluster and to synchronize the replicated caches of Keycloak. This required multicast to be available and to be configured correctly, which is usually not the case in cloud environments.
Starting with this version, the default changes to the
jdbc-pingconfiguration which uses Keycloak’s database to discover other nodes. As this removes the need for multicast network capabilities and UDP and no longer using dynamic ports for the TCP-based failure detection, this is a simplification and a drop-in replacement for environments which used the previous default. To enable the previous behavior, choose the transport stackudpwhich is now deprecated.The Keycloak Operator will continue to configure
kubernetesas a transport stack.See the Configuring distributed caches guide for more information.
Virtual Threads enabled for Infinispan and JGroups thread pools
Starting from this release, Keycloak automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21. This removes the need to configure the JGroups thread pool, the need to align the JGroups thread pool with the HTTP worker thread pool, and reduces the overall memory footprint.
OpenTelemetry Tracing supported
In the previous release, the OpenTelemetry Tracing feature was preview and is fully supported now. It means the
opentelemetryfeature is enabled by default.There were made multiple improvements to the tracing capabilities in Keycloak such as:
Configuration via Keycloak CR in Keycloak Operator
Custom spans for:
Incoming/outgoing HTTP requests including Identity Providers brokerage
Database operations and connections
LDAP requests
Time-consuming operations (passwords hashing, persistent sessions operations, …​)
For more information, see the Enabling Tracing guide.
Infinispan default XML configuration location
Previous releases ignored any change to
conf/cache-ispn.xmlif the--cache-config-fileoption was not provided.Starting from this release, when
--cache-config-fileis not set, the default Infinispan XML configuration file isconf/cache-ispn.xmlas this is both the expected behavior and the implied behavior given the docs of the current and previous releases.Individual options for category-specific log levels
It is now possible to set category-specific log levels as individual
log-level-categoryoptions.For more details, see the Logging guide.
OpenID for Verifiable Credential Issuance
The OpenID for Verifiable Credential Issuance (OID4VCI) remains an experimental feature in Keycloak, but it has great improvements in this release. This feature benefits from much polishing of the existing configuration and making the feature more dynamic and customizable.
You will find significant development and discussions in the Keycloak OAuth SIG. Anyone from the Keycloak community is welcome to join.
Many thanks to all members of the OAuth SIG group for the participation in the development and discussions about this feature. Especially thanks to Francis Pouatcha, Ingrid Kamga, Pascal Knüppel, Thomas Darimont, Ogen Bertrand, Awambeng Rodrick and Takashi Norimatsu.
Minimum ACR Value for the client
The option Minimum ACR value is added as a configuration option on the realm OIDC clients. This addition is an enhancement related to step-up authentication, which makes it possible to enforce minimum ACR level when logging in to the particular client.
Many thanks to Simon Levermann for the contribution.
Support for prompt=create
Support now exists for the Initiating user registration standard, which allows OIDC clients to initiate the login request with the parameter
prompt=createto notify Keycloak that a new user should be registered rather than an existing user authenticated. Initiating user registration was already supported in Keycloak with the use of dedicated endpoint/realms/<realm>/protocol/openid-connect/registrations. However, this endpoint is now deprecated in favor of the standard way as it was a proprietary solution specific to Keycloak.Many thanks to Thomas Darimont for the contribution.
Option to create certificates for generated EC keys
A new option, Generate certificate, exists for EC-DSA and Ed-DSA key providers. When the generated key is created by a realm administrator, a certificate might be generated for this key. The certificate information is available in the Admin Console and in the JWK representation of this key, which is available from JWKS endpoint with the realm keys.
Many thanks to Pascal Knüppel for the contribution.
Authorization Code Binding to a DPoP Key
Support now exists for Authorization Code Binding to a DPoP Key including support for the DPoP with Pushed Authorization Requests.
Many thanks to Takashi Norimatsu for the contribution.
Maximum count and length for additional parameters sent to OIDC authentication request
The OIDC authentication request supports a limited number of additional custom parameters of maximum length. The additional parameters can be used for custom purposes (for example, adding the claims into the token with the use of the protocol mappers). In the previous versions, the maximum count of the parameters was hardcoded to 5 and the maximum length of the parameters was hardcoded to 2000. Now both values are configurable. Additionally it can be possible to configure if additional parameters cause a request to fail or if parameters are ignored.
Many thanks to Manuel Schallar and Patrick Weiner for the contribution.
Network Policy support added to the Keycloak Operator
To improve the security of your Kubernetes deployment, Network Policies can be specified in your Keycloak CR. The Keycloak Operator accepts the ingress rules, which define from where the traffic is allowed to come from, and automatically creates the necessary Network Policies.
LDAP users are created as enabled by default when using Microsoft Active Directory
If you are using Microsoft AD and creating users through the administrative interfaces, the user will be created as enabled by default.
In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user. This behavior was not consistent with other built-in user storages as well as not consistent with other LDAP vendors supported by the LDAP provider.
New conditional authenticators
Condition - sub-flow executedandCondition - client scopeThe Condition - sub-flow executed and Condition - client scope are new conditional authenticators in Keycloak. The condition Condition - sub-flow executed checks if a previous sub-flow was executed (or not executed) successfully during the authentication flow execution. The condition Condition - client scope checks if a configured client scope is present as a client scope of the client requesting authentication. For more details, see Conditions in conditional flows.
Defining dependencies between provider factories
When developing extensions for Keycloak, developers can now specify dependencies between provider factories classes by implementing the method
dependsOn()in theProviderFactoryinterface. See the Javadoc for a detailed description.Dark mode enabled for the welcome theme
We’ve now enabled dark mode support for all the
keycloakthemes. This feature was previously present in the admin console, account console and login, and is now also available on the welcome page. If a user indicates their preference through an operating system setting (e.g. light or dark mode) or a user agent setting, the theme will automatically follow these preferences.If you are using a custom theme that extends any of the
keycloakthemes and are not yet ready to support dark mode, or have styling conflicts that prevent you from implementing dark mode, you can disable support by adding the following property to your theme:Alternatively, you can disable dark mode support for the built-in Keycloak themes on a per-realm basis by turning off the Dark mode setting under the Theme tab in the realm settings.
Metrics on password hashing
There is a new metric available counting how many password validations were performed by Keycloak. This allows you to better assess where CPU resources are used, and can feed into your sizing calculations.
See Keycloak metrics and Concepts for sizing CPU and memory resources for more details.
Sign out all active sessions in admin console now effectively removes all sessions
In previous versions, clicking on Sign out all active sessions in the admin console resulted in the removal of regular sessions only. Offline sessions would still be displayed despite being effectively invalidated.
This has been changed. Now all sessions, regular and offline, are removed when signing out of all active sessions.
Dedicated release cycle for the Node.js adapter and JavaScript adapter
From this release onwards, the Keycloak JavaScript adapter and Keycloak Node.js adapter will have a release cycle independent of the Keycloak server release cycle. The 26.1.0 release may be the last one where these adapters are released together with the Keycloak server, but from now on, these adapters may be released at a different time than the Keycloak server.
Updates in quickstarts
The Keycloak quickstarts are now using
mainas the base branch. Thelatestbranch, used previously, is removed. Themainbranch depends on the last released version of the Keycloak server, Keycloak client libraries, and adapters. As a result, contributions to the quickstarts are immediately visible to quickstart consumers with no need to wait for the next Keycloak server release.Updated format of KEYCLOAK_SESSION cookie and AUTH_SESSION_ID cookie
The format of
KEYCLOAK_SESSIONcookie was slightly updated to not contain any private data in plain text. Until now, the format of the cookie wasrealmName/userId/userSessionId. Now the cookie contains user session ID, which is hashed by SHA-256 and URL encoded.The format of
AUTH_SESSION_IDcookie was updated to include a signature of the auth session id to ensure its integrity through signature verification. The new format isbase64(auth_session_id.auth_session_id_signature). With this update, the old format will no longer be accepted, meaning that old auth sessions will no longer be valid. This change has no impact on user sessions.These changes can affect you just in case when implementing your own providers and relying on the format of internal Keycloak cookies.
Removal of robots.txt file
This PR was generated by Mend Renovate. View the repository job log.