# quarkus Published articles for quarkus. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Keycloak 26.6.4 released DevFeed: [Keycloak 26.6.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens](), [upgrade](), [Quarkus]() Tags: [2026](), [authentication](), [authorization](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [quarkus](), [reference](), [release](), [saml](), [security](), [sso](), [upgrade](), [xss]() ### AI overview Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus ## Keycloak 26.5.7 released DevFeed: [Keycloak 26.5.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-02T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [Quarkus]() Tags: [access-control](), [authorization](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.5.7 was released on April 2, 2026. The release includes multiple security fixes, including issues involving access control, information disclosure, denial of service, unauthorized permission grants, OIDC redirect URI validation, and authorization-code privilege escalation. It also upgrades to Quarkus 3.27.3 and resolves a Host-header error. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw Enhancements #46631 Upgrade to Quarkus 3.27.3 dist/quarkus Bugs #45204 Call without Host header throws uncaught error core ## Keycloak 26.5.3 released DevFeed: [Keycloak 26.5.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JSON Web Tokens](), [Security](), [Authentication](), [upgrade](), [migration](), [Kubernetes](), [Mocha](), [Quarkus](), [ci](), [Hibernate](), [YAML]() Tags: [2025](), [authentication](), [authorization](), [ci](), [hibernate](), [idm](), [jwt](), [k8s](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [node-js](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso](), [upgrade](), [yaml]() ### AI overview Keycloak 26.5.3 is a February 10, 2026 release that includes security fixes for JWT authorization grants, invitation JWTs, identity-provider ownership checks, and other resolved issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ Enhancements #45892 Upgrade minikube for CI tests operator Bugs #44379 Node.js admin client does not refresh tokens admin/client-js #45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus #45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus #45677 Hibernate Validator is enabled by default when not used dist/quarkus #45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite #45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci #45755 Broken YAML indentation in operator rolling updates doc docs #45780 Remove fatal log messages from `ConsistentHash` ## Discover Roq, the Quarkus Way for Static Site Generation in Java DevFeed: [Discover Roq, the Quarkus Way for Static Site Generation in Java]() Original publisher: [Read original article]() Author: Andy Damevin Published: 2025-12-09T02:02:47Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [Quarkus](), [Java](), [Development](), [Tailwind CSS](), [gatsby](), [Jekyll]() Tags: [2025](), [cms](), [dev](), [github-action](), [hugo](), [java](), [javascript](), [jvm](), [quarkus](), [ssg](), [static-site-generator](), [tailwindcss](), [themes]() ### AI overview This tutorial introduces Roq, a static-site generator built as a thin layer on Quarkus for Java. It explains how Roq uses Quarkus features such as Qute templates, extensions, Dev Mode, plugins, themes, data files, and static-site export, then demonstrates setup and live reloading with a Quarkus, Roq, and Tailwind project. ### Source excerpt Did you know about Roq? A powerful new tool that combines Java and Quarkus. Ok, prep a warm drink and put on some soft music and let's find out why Roq is so cool with the comfort of Quarkus Dev Mode and all its eco-system. Bonus: a touch of TailwindCss to make it look great! The post Discover Roq, the Quarkus Way for Static Site Generation in Java appeared first on JVM Advent. ## Building a Quarkus LangChain4j Extension for Java LLM Applications DevFeed: [Building a Quarkus LangChain4j Extension for Java LLM Applications]() Original publisher: [Read original article]() Author: Martin Toshev Published: 2025-12-02T04:33:13Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [Quarkus](), [Java](), [Large Language Model](), [Framework](), [observability](), [tracing]() Tags: [2025](), [agentic](), [ai](), [frameworks](), [healthcare](), [java](), [langchain4j](), [large-language-models](), [observability](), [opentelemetry](), [quarkus](), [tracing]() ### AI overview This tutorial explains how the Quarkus LangChain4j extension simplifies integrating Java applications with large language models. It covers build-time and native-image optimizations, CDI-based AI service discovery, type-safe configuration, Quarkus dev mode integration, and observability features before demonstrating an agentic healthcare application. ### Source excerpt LangChain4j is a top (if not the top) library in use for integrating Java applications with various LLMs (large language models). It provides a number of features such as a unified API for LLM integration, support for vector stores, prompt templates, RAG (retrievalaugmented generation) and more. While we can use it directly in popular frameworks [...] The post Quarkus LangChain4j extension from grounds up appeared first on JVM Advent. ## Lighting the Way: Java, AI, and a Season of New Ideas DevFeed: [Lighting the Way: Java, AI, and a Season of New Ideas]() Original publisher: [Read original article]() Author: Markus Eisele Published: 2025-12-01T01:00:25Z Content type: article Language: en Sources: [Java Advent Calendar]() Topics: [Java](), [Artificial Intelligence](), [Quarkus]() Tags: [2025](), [ai](), [java](), [llms](), [quarkus]() ### AI overview An introductory 2025 Java Advent Calendar article discusses how Java developers are integrating AI and LLMs into production systems. It highlights Quarkus and the Java ecosystem, then introduces a models-as-services pattern using LangChain4j and a Quarkus chat example. ### Source excerpt When December arrives, I always feel the same mix of nostalgia and excitement. The year starts to slow down, calendars fill with end-of-year meetings, and yet this is when the Java community does something uniquely joyful. We show up every day for 24 days and share what we've learned, built, discovered, and struggled with. It's [...] The post Lighting the Way: Java, AI, and a Season of New Ideas appeared first on JVM Advent. ## Keycloak 26.4.7 released DevFeed: [Keycloak 26.4.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-12-01T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [saml](), [Authorization]() Tags: [bugs](), [headers](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [permissions](), [quarkus](), [release](), [resolved](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 26.4.7 is released with documentation and Quarkus 3.27.1 upgrades, plus fixes for SAML initialization errors and persistent group permissions during concurrent membership changes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #43156 [Docs] Warn users about printing headers in HTTP access logs docs #43643 Upgrade to Quarkus 3.27.1 dist/quarkus Bugs #44438 Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients saml #44480 Wrong persistent group permissions when multiple group membership changes happen in the same request core ## Keycloak 26.4.5 released DevFeed: [Keycloak 26.4.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-12T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [changelog]() Tags: [authorization](), [bugs](), [ci](), [docs](), [download](), [email](), [idm](), [import](), [jpa](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [ordering](), [quarkus](), [release](), [saml](), [sso](), [ui]() ### AI overview Keycloak 26.4.5 was released on November 12, 2025. The release page links to downloads and a migration guide and lists resolved issues involving tests, documentation, JPA, email persistence, database migration, authorization policies, attribute ordering, Quarkus builds, URL normalization, and the Admin Console. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #42601 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP ci #43212 Document missing artifact dependency for UserStoragePrivateUtil docs #43564 Invalid liquibase check sum for jpa-changelog-2.5.0.xml core #43718 Email Not Persisted During Registration When "Email as Username" is Enabled and User Edit Permission is Disabled user-profile #43793 import does not seem to run db migration import-export #43883 Creating group policy on a client uses "manage-clients" role if FGAP V1 is disabled authorization-services #44010 Ordering attributes will unset the unmanaged attribute policy user-profile #44031 Can't build keycloak 26.4.4 with quarkus.launch.rebuild=true dist/quarkus #44056 Allow only normalized URLs in requests caused a regression in view authz permission details in Admin Consol admin/ui #44117 DockerClientTest failure testsuite ## Keycloak 26.4.4 released DevFeed: [Keycloak 26.4.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-07T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [version](), [OpenID connect (OIDC)](), [LDAP](), [Quarkus]() Tags: [changes](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [version]() ### AI overview Keycloak 26.4.4 is released with enhancements and fixes covering client-scope discovery, verification-email rate limiting, workflow authorization, fine-grained permissions, OIDC, LDAP, WebAuthn, memory usage, and other administration and infrastructure issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #10388 Allow to hide client scopes from scopes_supported in discovery endpoint #43076 Add rate limiter for sending verification emails in context of update email #43509 Role authorization for workflows. admin/api Bugs #41270 Cannot save new attribute group admin/ui #41271 Changing user profile attribute results in an error everytime admin/ui #43082 ExternalLinksTest is broken due to missing path parameters docs #43091 Duplicate Email Fields on Temporarily Locked Out Sign In With Organization Identity-First Login login/ui #43160 Regression in DEBUG_PORT handling since 26.4.0 - host binding (*:port / 0.0.0.0:port) no longer works dist/quarkus #43460 FGAP/UI: `reset-password` succeeds but UI shows 403 without Users:manage admin/fine-grained-permissions #43505 DPoP proof replay check doesn't consider clock skew oidc #43516 Deleting Client is slow and fails when a lot of client sessions exist core #43578 "admin" client role now requires server admin user admin/api #43579 403 Forbidden when assigning realm-management client roles with realm-admin despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions #43596 FGAP: user can no longer open account management page, broken by `reset-password` admin/fine-grained-permissions #43621 Version 26.4.1 breaks existing ldap users with capital letters in username ldap #43682 When syncing roles, the database layer can see deadlocks #43698 Role Mapper is updating the user every time on login identity-brokering #43723 Only add the none verifier when attestation conveyance preference is none (or default) authentication/webauthn #43734 Refresh token allowed for offline session even the related scope is removed #43736 FGAP V2: reset-password scope error when viewing users with Group permissions only core #43744 Increased memory usage due to leaking Keyc ## Building a persistent conversational AI chatbot with Temporal DevFeed: [Building a persistent conversational AI chatbot with Temporal]() Original publisher: [Read original article]() Author: Pablo González Granados Published: 2025-10-14T00:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Conversational AI](), [Orchestration](), [Chat Bot](), [Back end](), [Java](), [Quarkus]() Tags: [community](), [conversational-ai](), [history](), [java](), [quarkus](), [retries](), [stateful](), [stateless](), [workflows]() ### AI overview This tutorial explains how to build a persistent conversational AI chatbot with Temporal by modeling each conversation as a workflow. It describes maintaining conversation context across restarts, deployments, and scaling events, while supporting long-running interactions, summaries, and retrieval. ### Source excerpt Build a persistent, infinitely scalable chatbot with Temporal Workflows -- stateless apps, full conversation history across restarts, and resilient retries in Java/Quarkus. ## Keycloak 26.3.5 released DevFeed: [Keycloak 26.3.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-09-25T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [Netty](), [vulnerability](), [MariaDB](), [OpenID connect (OIDC)](), [Caching]() Tags: [2025](), [cache](), [http](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [upgrade](), [vulnerability]() ### AI overview Keycloak 26.3.5 is released with an upgrade to Quarkus 3.20.3 LTS, removal of the explicit MariaDB connector dependency, and fixes for administrative UI, organization, cache, OIDC, and security issues including two Netty vulnerabilities. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #41371 Upgrade to Quarkus 3.20.3 LTS dist/quarkus #41373 Remove explicit MariaDB connector dependency dist/quarkus Bugs #41418 Access to user details for restricted admin fails after enabling organizationin realm organizations #42405 Old hmac-generated (32bit) is recreated when order is changed in realm keys ui core #42491 CVE-2025-58057 - Netty BrotliDecoder / Data Amplification vulnerability dist/quarkus #42492 CVE-2025-58056 - Netty HTTP Request Smuggling vulnerability dist/quarkus #42736 Reset password in admin UI with 'not recently used' password policy leads to error 'Device already exists with the same name' core #42769 Missing switch "ID Token as detached signature" in the admin console client settings oidc #42922 Dynamic Client Registration invalidates the realm cache core ## Comparing Java ZGC and G1 for Tail Latency in a Quarkus Microservice DevFeed: [Comparing Java ZGC and G1 for Tail Latency in a Quarkus Microservice]() Original publisher: [Read original article]() Published: 2025-09-17T15:09:00Z Content type: article Language: en Sources: [Gunnar Morling]() Topics: [Java](), [benchmarking](), [Quarkus](), [Databases]() Tags: [benchmarking](), [gc](), [java](), [lts](), [performance](), [postgres](), [quarkus](), [sample]() ### AI overview This article compares Java's ZGC and G1 garbage collectors using default settings in a sample Quarkus microservice that reads data from a Postgres database. The benchmark applies 1,000 requests per second and measures request latencies on a four-core, 4 GB RAM instance. The supplied excerpt does not include the comparison results. ### Source excerpt Table of Contents ZGC Allocation Stalls Summary In the "Let's Take a Look at...!" blog series I am exploring interesting projects, developments and technologies in the data and streaming space. This can be KIPs and FLIPs, open-source projects, services, relevant improvements to Java and the JVM, and more. The idea is to get some hands-on experience, learn about potential use cases and applications, and understand the trade-offs involved. If you think there's a specific subject I should take a look at, let me know in the comments below. Java 25 was released earlier this week, and it is the first Java release with long-term support (LTS) which ships with Generational ZGC as the one (and only) flavor of the ZGC garbage collector. ZGC itself is a relatively new concurrent collector, originally added in Java 11. ## Keycloak 26.3.4 released DevFeed: [Keycloak 26.3.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-09-12T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [Database](), [LDAP](), [OpenID connect (OIDC)]() Tags: [database](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.3.4 is a release that includes an enhancement, an upgrade to Quarkus 3.20.2.2, and fixes covering session timeouts, database errors, login flows, LDAP group synchronization, configuration, documentation, user-profile validation, and the admin UI. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #40630 Double check when working with multithreading. SAST #42245 Upgrade to Quarkus 3.20.2.2 Bugs #35825 Per client session idle time capped by realm level client idle timeout core #40374 Random but frequent duplicate key value violates unique constraint \"constraint_offl_us_ses_pk2\" errors authentication #40463 Login to Account Console produces two consecutive LOGIN events account/ui #40857 Unbounded login_hint Parameter Can Corrupt KC_RESTART Cookie and Break Login Flow oidc #41427 Parallel token exchange fails if client session is expired token-exchange #41801 Lack of coordination in database creation in 26.3.0 causes deployment failures (Reopen) core #41942 Uncaught server error: org.keycloak.models.ModelException: Database operation failed : Sync LDAP Groups to Keycloak (Custom Provider) core #42012 Client session timestamp not updated in the database if running multiple nodes infinispan #42046 KeycloakRealmImport placeholder replacement provides access to sensitive environment variables. operator #42158 Bug in configuration keycoak via keycloak.conf dist/quarkus #42164 [Keycloak CI - Docs] Broken links core #42178 Integer validation error not shown for user profile fields user-profile #42182 Validation errors for required actions don't show translated messages admin/ui #42270 Missing double-dash in the events documentation core #42339 Allowed Client Scopes add openid scope in scope list oidc #42369 Missing client session offline settings on realm level in the admin UI admin/ui ## Keycloak 26.3.3 released DevFeed: [Keycloak 26.3.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-08-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [Caching](), [LDAP](), [OpenID connect (OIDC)]() Tags: [2025](), [caching](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 26.3.3 is released with enhancements, dependency upgrades, and fixes across caching, Quarkus, LDAP, OIDC, documentation, clustering, administration, and security. The release includes a fix for CVE-2025-7962 in Jakarta Mail. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #41558 Ensure cache configuration has correct number of owners #41934 Infinispan 15.0.19.Final #41963 Upgrade to Quarkus 3.20.2.1 dist/quarkus Bugs #39562 Breaking template change: Unknown `locale` input field added to user-profile registration page user-profile #40984 Backchannel logout token with an unexpected signature algorithm key oidc #41023 Can't send e-mails to international e-mail addresses: bad UTF-8 syntax core #41098 Locked out after upgrade to 26.3.1 due to missing sub in lightweight access token core #41268 `--optimized` flag and providers jar are incompatible when used with tools changing `last-modify-date` dist/quarkus #41290 Concurrent starts with JDBC_PING lead to a split cluster infinispan #41390 JDBC_PING2 doesn't merge split clusters after a while infinispan #41421 Broken link securing-cache-communication in caching docs docs #41423 Duplicate IDs in generated all configuration docs docs #41469 Uncaught exception cases unclosed spans in tracing dist/quarkus #41488 Synchronize Maven surefire plugin with Quarkus dist/quarkus #41491 ExternalLinks are broken in documentation docs #41520 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and KERBEROS_PRINCIPAL was null on creation ldap #41532 LDAP Sync all users takes unexpectedly long in 26.3 (> 30 min) ldap #41537 Getting error 405 "Method Not Allowed" when calling the "certs" endpoint with HEAD method oidc #41643 Test SMTP connection fails when no port is specified admin/api #41663 Typo in the caching doc docs #41677 Provider default regression dist/quarkus #41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core #41842 memberOf attribute empty or values with a DN that does not match the role base DN fet ## Keycloak 26.3.1 released DevFeed: [Keycloak 26.3.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-07-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [upgrade](), [version]() Tags: [docs](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [openid-connect](), [operator](), [quarkus](), [releases](), [saml](), [sso](), [tls](), [upgrade](), [version]() ### AI overview Keycloak 26.3.1 is released. The release includes an upgrade to Infinispan 15.0.16.Final, updated limitations for preview rolling updates, and fixes for realm imports, concurrent storage deletion, TLS reloading, datasource options, the Keycloak Operator, documentation, and WebAuthn login regression issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #40851 Upgrade to Infinispan 15.0.16.Final #40962 Update limitations of the preview feature rolling updates for patch releases infinispan Bugs #35932 Importing a realm takes more than 1 minute when multiple others exist. dist/quarkus #40368 NPE during loading user groups with concurrent deletion storage #40713 Unable to configure TLS reloading in Keycloak version 26.2.0 or later account/api #40838 Mark options for additional datasources as preview dist/quarkus #40890 Keycloak Operator 26.3.0 fails to update to 26.3.0 operator #40930 Docs: server_development/topics/themes.adoc docs #40954 Keycloak 26.3.0 Regression: Failed to login if web-authn is disabled core ## Keycloak 26.1.5 released DevFeed: [Keycloak 26.1.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-04-11T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [tracing](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA](), [WebAuthn]() Tags: [bugs](), [docs](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [recaptcha](), [release](), [saml](), [sso](), [tests](), [tracing](), [upgrade]() ### AI overview Keycloak 26.1.5 is a release containing an upgrade to Quarkus 3.15.4, OpenTelemetry-related changes, and fixes across administration, authentication, account UI, documentation, CI, and other components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #38409 Upgrade to Quarkus 3.15.4 dist/quarkus #38764 OTel: Unable to disable sampling at runtime; tracing-sampler-ratio validation prevents setting 0.0 dist/quarkus Bugs #36482 The root cause of error is suppressed in KC 26 at building dependencies #37792 Save Button Not Enabled When Switching OTP Type from "Time Based" to "Counter Based" admin/ui #37869 ConditionalOtpFormAuthenticator fails to set CONFIGURE_TOTP required action for LDAP read-only users #38041 [Keycloak CI] - WebAuthn tests ci #38063 Issue in clearing offline sessions internally using ClearExpiredUserSessions Scheduled task #38152 Broken guides link on reverseproxy page docs #38353 Keycloak email message ID contains the local host name or IP address core #38454 Keycloak account console is missing the Keycloak logo account/ui #38576 Define a max expiration window for Signed JWT client authentication oidc #38607 Recaptcha secret key configuration lost when migrating from 24.0.5 to 26.1.4 authentication #38740 OTelHttpClientFactory not configured properly when tracing enabled dist/quarkus ## Simplifying JVM App Development with Heroku's Buildpack Magic DevFeed: [Simplifying JVM App Development with Heroku's Buildpack Magic]() Original publisher: [Read original article]() Author: Andrew Fawcett Published: 2025-03-24T15:00:00Z Content type: tutorial Language: en Sources: [Heroku]() Topics: [Buildpacks](), [Heroku](), [Java](), [Spring Boot](), [Micronaut](), [Quarkus](), [Development]() Tags: [build-tools](), [buildpacks](), [deployment](), [developer-tools](), [engineering](), [gradle](), [heroku](), [heroku-key-value-store](), [heroku-postgres](), [java](), [languages](), [maven](), [micronaut](), [procfile](), [quarkus](), [spring-boot]() ### AI overview Heroku's Java buildpack automates much of the process of deploying JVM applications. It detects languages and frameworks, obtains build tools, configures the runtime, and can provide framework-specific settings for Spring Boot, Quarkus, and Micronaut applications. ### Source excerpt Heroku's commitment to developer productivity shines through in its powerful buildpack system. They handle the heavy lifting of building your app, letting you focus on what matters most: writing code. A prime example is the Heroku Java buildpack, a versatile tool that simplifies deploying Java applications, especially those built with popular frameworks like Spring Boot, [...] The post Simplifying JVM App Development with Heroku's Buildpack Magic appeared first on Heroku. ## Keycloak 26.1.1 released DevFeed: [Keycloak 26.1.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-02-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [passwords](), [LDAP](), [Node.js](), [Quarkus]() Tags: [authentication](), [idm](), [ipv6](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [node](), [openid-connect](), [password](), [quarkus](), [release](), [release-notes](), [saml](), [sso](), [x509]() ### AI overview Keycloak 26.1.1 adds an X.509 authenticator option to abort authentication when a configured CRL is outdated, and a reset-credential-email option to force a new login after credentials are reset. The release also lists resolved enhancements and bugs. ### Source excerpt To download the release go to Keycloak downloads. Highlights New option in X.509 authenticator to abort authentication if CRL is outdated The X.509 authenticator has a new option x509-cert-auth-crl-abort-if-non-updated (CRL abort if non updated in the Admin Console) to abort the login if a CRL is configured to validate the certificate and the CRL is not updated in the time specified in the next update field. The new option defaults to true in the Admin Console. For more details about the CRL next update field, see RFC5280, Section-5.1.2.5. The value false is maintained for compatibility with the previous behavior. Note that existing configurations will not have the new option and will act as if this option was set to false, but the Admin Console will add the default value true on edit. New option in Send Reset Email to force a login after reset credentials The reset-credential-email (Send Reset Email) is the authenticator used in the reset credentials flow (forgot password feature) for sending the email to the user with the reset credentials token link. This authenticator now has a new option force-login (Force login after reset). When this option is set to true, the authenticator terminates the session and forces a new login. For more details about this new option, see Enable forgot password. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #552 Clean up old release code from Node.js adapter repo nodejs-connect #34275 Organizations: Allow Organization Selection organizations #34343 CreatedResponseUtil.getCreatedId should expose the actual error message from the server admin/client-java #36440 Remove Node.js adapter documentation from main repo docs #36456 Clarify IPv6 JGroups requirements in Keycloak documenation #36798 Add detail on dependencyManagement section for POM files Bugs #558 The draft nightly untagged release is created by "Release nightly" GH action nodejs-connect #562 Incorrectly r ## Keycloak 26.0.2 released DevFeed: [Keycloak 26.0.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-10-24T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JavaScript](), [OpenID connect (OIDC)](), [OpenAPI Specification](), [OpenTelemetry](), [Passkeys](), [WebAuthn](), [Security]() Tags: [ci](), [idm](), [javascript](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openapi](), [openid-connect](), [opentelemetry](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.0.2 is a maintenance release published on October 24, 2024. It includes an enhancement for trusted certificate configuration and resolves bugs affecting JavaScript adapters, GUI validation, the Organization API documentation, passkeys, OpenTelemetry initialization, organization features, imports, password validation, CLI handling, and other areas. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #32110 [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus Bugs #15635 oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript #19101 Uncaught (in promise): QuotaExceededError adapter/javascript #20287 When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript #28978 some GUI validation check missing admin/ui #30832 Organization API not available from OpenAPI documentation admin/api #31724 Logout not working after removing Identity Provider of user identity-brokering #33072 Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn #33844 Wrong documentation link in keycloak-js readme docs #33902 Not persisted config settings prevent server start dist/quarkus #33948 [PERF] OpenTelemetry is initialized even when disabled #33968 Not possible to close dialog boxes when clicking buttons or the close icon admin/ui #33991 Doc CI - broken links error docs #34009 grammatical error in "Managing Organizations" documentation docs #34015 Home URL for security-admin-console is broken admin/ui #34028 Custom keycloak login theme styles.css return error 404 login/ui #34049 Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations #34063 Respect the locale set to a user when redering verify email pages user-profile #34069 Do not show domain match message in the identity-first login when no login hint is provided organizations #34075 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci #34095 Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export #34151 JS passw ## Keycloak 26.0.1 released DevFeed: [Keycloak 26.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-10-17T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [migration](), [Authentication]() Tags: [admin](), [authentication](), [cypress](), [firefox](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [login](), [migration](), [migration-guide](), [openid-connect](), [quarkus](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.0.1 is released with enhancements and resolved bugs across the Operator, storage, authentication, LDAP, Admin Console, login UI, documentation, and other components. The article directs readers to the Keycloak downloads page and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #32152 Clarify the behaviour of multiple Operator versions installed in the same cluster operator #33275 Better logging when error happens during transaction commit storage Bugs #8935 keycloak.js example from the documentation leads to error path adapter/javascript #19358 Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy authorization-services #31848 Repeated email verifications while logging in through IDP caused by email case sensitivity authentication #32266 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists ldap #32617 Nightly Cypress tests for the Admin Console are failing on Firefox admin/ui #32844 Login V2: Missing "dir" attributes login/ui #32847 Admin UI defaults to master realm even without permissions to it admin/ui #32962 Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm oidc #33513 Can get authorization code on a non verified user with some specific kc_action (AIA) oidc #33539 Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided docs #33549 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci #33557 Unable to submit forms in Safari account/ui #33576 Broken links / anchors after KC26 release docs #33578 In imported realms, the ability to use environment variables has disappeared import-export #33585 Fix runaway asterisk formatting in TLS documentation docs #33638 Non-optimized start command gives erroneous warnings for runtime spi options dist/quarkus #33642 RTL not working on keycloak.v2 login template login/ui #33645 keycloak-js register broken: createRegisterUrl not awaited adapter/javascript #33699 Failure to red ## Keycloak 25.0.4 released DevFeed: [Keycloak 25.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [version](), [upgrade]() Tags: [ci](), [help](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [npm](), [openid-connect](), [quarkus](), [release](), [saml](), [sql](), [sso](), [upgrade](), [version]() ### AI overview Keycloak 25.0.4 is released. The release includes an upgrade to Infinispan 15.0.7.Final and resolves bugs affecting the account and admin UIs, authorization, CI, SAML, sessions, storage, and documentation. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #31963 Upgrade to Infinispan 15.0.7.Final Bugs #31299 NPM library of account-ui is unusable (@keycloak/keycloak-account-ui version 25.0.1) account/ui #31304 Hide save / update buttons in account console for READ_ONLY federated accounts account/ui #31340 Hidden options shown in help all dist/quarkus #31386 Joining group for user doesn't list correct number of groups admin/ui #31466 Duplicate Key "validatingX509CertsHelp" in admin-ui messages admin/ui #31519 Admin API extremely slow with service account and fine-grained authorization `view-users` admin/fine-grained-permissions #31545 Event tables have broken aria-labels admin/ui #31558 MSSQL test container can't start ci #31598 CURL commands in build don't check the response code ci #31633 localization not work with user attribute display name in users add admin/ui #31687 "Use metadata descriptor URL" switch is always set to "On" admin/ui #31718 Documentation for `Delete Credential` action and related changes authentication #31781 Keycloak 25 SAML IdP has made Single Logout URL mandatory. saml #31835 Windows builds fail too often due to problems with the download of Node ci #31918 Network error attempting to view events without permissions admin/ui #31929 Network error attempting to view user registeration without permissions admin/ui #32059 Look around window cannot be set to 0 admin/ui #32127 Offline session bug on 25.0.2 core #32150 Session list doesn't handle non-existing client gracefully core #32178 Table names for persistent sessions upgrading guide is wrong docs #32180 Session list not appearing: SQL Error "The incoming request has too many parameters" #32195 Migration to persistent sessions fails from Keycloak version <22 storage ## Keycloak 24.0.4 released DevFeed: [Keycloak 24.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-05-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [upgrade](), [Quarkus](), [LDAP](), [container](), [like](), [OpenID connect (OIDC)](), [saml]() Tags: [api](), [container](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [vault]() ### AI overview Keycloak 24.0.4 is released. The update removes support for partial user-attribute updates through the Admin User API, upgrades Quarkus to 3.8.4, and includes enhancements and bug fixes across administration, import/export, LDAP, OIDC, SAML, and related components. ### Source excerpt To download the release go to Keycloak downloads. Highlights Partial update to user attributes when updating users through the Admin User API is no longer supported When updating user attributes through the Admin User API, you cannot execute partial updates when updating the user attributes, including the root attributes like username, email, firstName, and lastName. For more details, see the Upgrading Guide. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #27508 Use new remote-store options in HA guides #28429 Add details to error messages, especially around refresh tokens #28729 Emphasize the need for setting container limit docs #28880 Upgrade to Quarkus 3.8.4 dist/quarkus #29183 Minor corrections to High Availability Guide docs Bugs #16345 Unable to delete realm names with invalid URL characters admin/api #22617 kc export fails when using User Federation (LDAP) with file-based Vault enabled import-export #24568 iframe for frontend logout gets blocked if a custom CSP header is used core #24878 NoClassDefFoundError for Apache XML and EAP8 adapter/jee-saml #27021 Workflow failure: Fuse adapter tests ci #27080 Workflow failure: Operator CI - KeycloakTruststoresTests#testTrustroreExists ci #27514 Uncaught server error: java.lang.IllegalArgumentException: Path parameter not provided oidc #28079 Group search does not work in user view admin/ui #28187 Admin UI drag & drop in flow config seems to delete actions admin/ui #28220 Admin API: User PUT operation clears firstname, lastname email fields admin/api #28303 WARN - Event object wasn't available in remote cache after event was received infinispan #28377 Broken lists in import/export server guide docs #28431 Dedicated client scopes always show up when searching admin/ui #28514 Message for searchClientRegistration is missing admin/ui #28666 Accessing a transient (lightweight) user through client session fails in admin-api/-ui admin/ui #28684 "Exten [Next page]()