Keycloak 26.0 → 26.8: what bit us, and where the kit keeps it

Keycloak kit 1.x was pinned to 26.0.8, eight minor versions behind 26.8, and received none of their fixes. Had each product upgraded on its own, each would have met the same surprises in its own pipeline.

One upgrade, in the kit

On 12 October 2026 we released Keycloak kit 2.0.0 on Keycloak 26.8.0. In the kit's Dockerfile that is two lines: the FROM with its digest, and a LABEL repeating the version, which the structure suite now checks against that FROM. What bit us went into a test or the changelog.

• A test that read nothing. Keycloak 26.8 ships keycloak-themes-vendor-*.jar beside the themes JAR. Our messages suite looked for keycloak-themes-*.jar, matched both and copied neither, so all 32 Slovenian keys looked unknown. The translation was fine; the test was not. It now accepts exactly one JAR, and fails on its own when it reads fewer than 100 English keys.
• New realm defaults. Compared with 1.x, the realm the kit provisions differs only in Keycloak's own defaults for a new realm, as the diff of the golden realm exports shows. Among them: three new required actions, WebAuthn passwordless requiring a resident key and user verification, no X-XSS-Protection header, and a realm-management client that is read-only in the admin API. The provisioning did not change, and accepting the terms of use is still the default required action. An existing realm is migrated by Keycloak, not re-created, so its values can differ.
• Login themes. Since 26.7, templates run with FreeMarker 2.3.32 defaults, and since 26.5, no message renders HTML except termsText, which kit 2.1.0 can set to link the terms of use and the privacy policy. Before the release we built Reputo's theme on the new image: the login and terms pages rendered without template errors.

The changelog entry lists the rest: PostgreSQL 14 or later, single-use required-action links, the refusal of redirect URIs that carry state or code, and the upgrade steps from kit 1.x.

Reputo and Leadgener moved the same day, each in a merge request that changes only the kit pin and its comment, and both dev environments were deployed on 26.8.0 that evening.

For a team on the Keycloak kit, a Keycloak upgrade arrives as a kit version that has already passed these tests, its changes written in the changelog. Your part is a backup of the Keycloak database before the first start of the new version, the pin, a build of your login theme on the new image if you have one, and one look at the login, registration and terms pages on dev.