→29need a look

Resolves multiple security vulnerabilities across SAML, WebAuthn, API keys, and session lifecycle management. Includes database schema migrations to support SAML replay protection.

Why it's flagged

Fixes security vulnerabilities (GHSA-2pc4-vw9j-454c, GHSA-3r7x-rhvc-fw28, GHSA-wfg2-vqfg-rqh6, GHSA-6v34-w48w-44rc, GHSA-4rf2) and enforces a breaking requirement for an acsURLs allow-list on IdP-initiated SAML clients.

What to check

Upgrade to v12.2.1, ensure database migrations are run, and configure acsURLs for clients with IdP-initiated SAML logins.

Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc

Addresses security vulnerabilities in SAML assertion handling, session race conditions, dashboard session verification, and multitenancy isolation. Requires additive database migrations for SAML replay defense.

Why it's flagged

Fixes vulnerabilities (GHSA-2pc4-vw9j-454c, GHSA-3r7x-rhvc-fw28, GHSA-wfg2-vqfg-rqh6, GHSA-6v34-w48w-44rc, GHSA-4rf2, GHSA-w9fp-wv6g-pqv8) and introduces a breaking requirement for acsURLs on IdP-initiated SAML clients.

What to check

Upgrade to v12.1.2, verify the SAML database schema updates, and add acsURLs to any clients using IdP-initiated SAML.

Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc+1 more

Patches several security issues involving SAML replay protection, tenant scoping for WebAuthn, API key permissions, dashboard session expiry, and session unlinking. Adds new tables and columns for SAML assertion tracking.

Why it's flagged

Fixes multiple security vulnerabilities (GHSA-2pc4-vw9j-454c, GHSA-3r7x-rhvc-fw28, GHSA-wfg2-vqfg-rqh6, GHSA-6v34-w48w-44rc, GHSA-4rf2, GHSA-w9fp-wv6g-pqv8) and introduces a breaking requirement for acsURLs on IdP-initiated SAML clients.

What to check

Upgrade to v12.0.11, apply database migrations, and set acsURLs for IdP-initiated SAML clients.

Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc+1 more

Implements security patches for SAML assertion replay, dashboard session verification, session race conditions, and tenant isolation. Adds database schema changes to track consumed assertions and ACS URLs.

Why it's flagged

Fixes security vulnerabilities (GHSA-4rf2, GHSA-6v34-w48w-44rc, GHSA-2pc4-vw9j-454c, GHSA-w9fp-wv6g-pqv8, GHSA-3r7x-rhvc-fw28, GHSA-wfg2-vqfg-rqh6) and adds a breaking requirement for an acsURLs allow-list on IdP-initiated SAML clients.

What to check

Upgrade to v11.4.8, verify database migrations, and configure acsURLs on IdP-initiated SAML clients.

Rules matchedGHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454cGHSA-w9fp-wv6g-pqv8GHSA-3r7x-rhvc-fw28+1 more

Applies security fixes across SAML handling, dashboard session expiry, session unlink serialization, and multitenant scoping. Includes additive database migrations for SAML assertion tracking.

Why it's flagged

Fixes security vulnerabilities (GHSA-4rf2, GHSA-6v34-w48w-44rc, GHSA-2pc4-vw9j-454c, GHSA-3r7x-rhvc-fw28, GHSA-wfg2-vqfg-rqh6, GHSA-w9fp-wv6g-pqv8) and introduces a breaking requirement for an acsURLs allow-list on IdP-initiated SAML clients.

What to check

Upgrade to v11.3.8, run the database migration scripts, and configure acsURLs for clients using IdP-initiated SAML.

Rules matchedGHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6+1 more

This release resolves multiple security issues, including app-scoped API key permission boundaries, dashboard session expiration enforcement, tenant-scoped WebAuthn sign-in, and a session race condition during account unlinking.

Why it's flagged

Fixes multiple security vulnerabilities tracked by GHSA-4rf2, GHSA-w9fp-wv6g-pqv8, GHSA-6v34-w48w-44rc, and GHSA-2pc4-vw9j-454c.

What to check

Upgrade to v11.2.4 and verify dashboard sessions, WebAuthn sign-in scoping, and app-scoped API key permissions.

Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c

This release fixes security vulnerabilities regarding app-scoped API key updates, dashboard session expiry enforcement, WebAuthn tenant scoping, and session creation race conditions during account unlinking.

Why it's flagged

Fixes multiple security vulnerabilities tracked by GHSA-4rf2, GHSA-w9fp-wv6g-pqv8, GHSA-6v34-w48w-44rc, and GHSA-2pc4-vw9j-454c.

What to check

Upgrade to v11.1.4 and verify dashboard sessions, WebAuthn sign-in scoping, and app-scoped API key permissions.

Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c

This release patches multiple security issues involving API key scoping, dashboard session expiry checks, WebAuthn tenant scoping, and session creation race conditions during account unlinking.

Why it's flagged

Fixes security vulnerabilities tracked by GHSA-4rf2, GHSA-w9fp-wv6g-pqv8, GHSA-6v34-w48w-44rc, and GHSA-2pc4-vw9j-454c.

What to check

Upgrade to v11.0.9 and verify dashboard sessions, WebAuthn sign-in scoping, and app-scoped API key permissions.

Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c

This release prevents an app-scoped API key from modifying its parent connectionUriDomain.

Why it's flagged

Resolves a security vulnerability tracked by GHSA-4rf2-xqvf-8rcx.

What to check

Upgrade to v10.1.9 and ensure app-scoped API keys cannot update parent connectionUriDomain settings.

Rules matchedGHSA-4rf2-xqvf-8rcx

This release fixes a vulnerability that allowed app-scoped API keys to update their parent connectionUriDomain.

Why it's flagged

Resolves a security vulnerability tracked by GHSA-4rf2-xqvf-8rcx.

What to check

Upgrade to v10.0.8 and verify app-scoped API key permissions around connectionUriDomain updates.

Rules matchedGHSA-4rf2-xqvf-8rcx

This release restricts app-scoped API keys from modifying their parent connectionUriDomain.

Why it's flagged

Resolves a security vulnerability tracked by GHSA-4rf2-xqvf-8rcx.

What to check

Upgrade to v9.3.5 and verify app-scoped API key restrictions.

Rules matchedGHSA-4rf2-xqvf-8rcx

This release addresses a vulnerability by preventing app-scoped API keys from updating their parent connectionUriDomain.

Why it's flagged

Resolves a security vulnerability tracked by GHSA-4rf2-xqvf-8rcx.

What to check

Upgrade to v9.2.7 and ensure app-scoped API keys cannot modify parent connectionUriDomain configuration.

Rules matchedGHSA-4rf2-xqvf-8rcx

This release blocks app-scoped API keys from updating their parent connectionUriDomain.

Why it's flagged

Resolves a security vulnerability tracked by GHSA-4rf2-xqvf-8rcx.

What to check

Upgrade to v9.1.6 and verify app-scoped API key permission boundaries.

Rules matchedGHSA-4rf2-xqvf-8rcx

Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.

Why it's flagged

Addresses security advisory GHSA-4rf2-xqvf-8rcx to prevent unauthorized updates from app-scoped API keys.

What to check

Upgrade to v9.0.6 to ensure app-scoped API key restrictions are enforced.

Rules matchedGHSA-4rf2-xqvf-8rcx

Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.

Why it's flagged

Addresses security advisory GHSA-4rf2-xqvf-8rcx to prevent unauthorized updates from app-scoped API keys.

What to check

Upgrade to v8.0.7 to ensure app-scoped API key restrictions are enforced.

Rules matchedGHSA-4rf2-xqvf-8rcx

Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.

Why it's flagged

Addresses security advisory GHSA-4rf2-xqvf-8rcx to prevent unauthorized updates from app-scoped API keys.

What to check

Upgrade to v7.0.23 to ensure app-scoped API key restrictions are enforced.

Rules matchedGHSA-4rf2-xqvf-8rcx

Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.

Why it's flagged

Addresses security advisory GHSA-4rf2-xqvf-8rcx to prevent unauthorized updates from app-scoped API keys.

What to check

Upgrade to v6.0.24 to ensure app-scoped API key restrictions are enforced.

Rules matchedGHSA-4rf2-xqvf-8rcx

This release resolves multiple authentication and session issues, including stale cookies persisting after session expiration or revocation, and password reset handling during session revocation failures. It also introduces features to manage and link OAuth clients and protected resources.

Why it's flagged

Fixes stale cookies persisting after customSession sessions expire or are revoked, which could leave expired or revoked sessions active.

What to check

Upgrade to v1.7.8 and verify that session cookies are properly cleared when sessions expire or are revoked.

Rules matchedsecurity

This release fixes an open redirect vulnerability in createRouteUrl and resolves bugs related to cookie attribute preservation and token refresh error status codes.

Why it's flagged

Addresses an open redirect vulnerability in createRouteUrl via a cross-origin origin check.

What to check

Upgrade to v4.32.0 and check URL redirection behaviors.

Rules matchedGHSA-5vvp-h2v6-59j6Securityadvisories

Addresses numerous security vulnerabilities and CVEs across identity brokering, authentication, admin permissions, and third-party dependencies.

Why it's flagged

Fixes multiple CVEs including CVE-2026-15943, CVE-2026-18569, and CVE-2026-94001.

What to check

Consult the migration guide and upgrade to 26.8.1 to remediate reported vulnerabilities.

Rules matchedCVE-2026-15943CVE-2026-18569CVE-2026-82968CVE-2026-94001+8 more

Security release addressing security advisory GHSA-389g-gv7q-r4x8, along with several performance improvements and bug fixes.

Why it's flagged

Fixes security advisory GHSA-389g-gv7q-r4x8.

What to check

Upgrade to 5.12.6 and review the GHSA-389g-gv7q-r4x8 advisory for impact.

Rules matchedGHSA-389g-gv7q-r4x8Securityadvisories

Updates dependencies to address CVEs and bumps the default CLI to 1.9.1. It also includes validation and configuration updates for internal callback namespace checks and conditional task garbage collection.

Why it's flagged

Dependencies were bumped to address CVE vulnerabilities.

What to check

Upgrade to v1.31.4 to apply dependency vulnerability fixes.

Keycloak 26.8.0 promotes Verifiable Credential Issuance (OID4VCI) to preview, introduces experimental OID4VP credential verification, and resolves several security vulnerabilities across components.

Why it's flagged

Fixes multiple vulnerabilities including CVE-2026-12388, CVE-2026-14781, and CVE-2026-19608.

What to check

Upgrade to 26.8.0 and review security configurations following the upgrade guide.

Rules matchedCVE-2026-12388CVE-2026-14781CVE-2026-19608CVE-2026-54515+5 more

Fixes a critical Magic Link account-takeover vulnerability (GHSA-965c-763c-88jm) and an issue where OAuth Proxy accepted sign-in state as a provider profile. Also adds optional OAuth redirect URI validation and fixes several adapter and header issues.

Why it's flagged

Fixes a critical Magic Link account-takeover security advisory vulnerability (GHSA-965c-763c-88jm).

What to check

Upgrade to v1.7.7, upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins.

Rules matchedGHSA-965c-763c-88jmsecurityvulnerabilityadvisory+1 more

Keycloak 26.7.5 is a maintenance release that addresses multiple security fixes across OIDC, SAML, and token exchange, alongside bug fixes and an upgrade to Quarkus 3.33.4.

Why it's flagged

Addresses multiple CVEs including CVE-2026-16103, CVE-2026-18206, CVE-2026-18203, and CVE-2026-89298.

What to check

Upgrade to 26.7.5 and review the migration guide for any required changes.

Rules matchedCVE-2026-16103CVE-2026-9798CVE-2026-18206CVE-2026-18203+8 more

Fixes a security vulnerability (GHSA-5r4p-p66f-jhc7) where `serveStatic` double-decoded request paths, potentially bypassing middleware. Request paths containing `%` after decoding are now rejected by default unless configured otherwise.

Why it's flagged

Fixes a path double-decoding vulnerability leading to middleware bypass (GHSA-5r4p-p66f-jhc7) and rejects request paths containing `%` by default.

What to check

Upgrade to v4.13.11 and verify static file serving routes, enabling `allowPercentInPath: true` if serving files with literal percent signs.

Rules matchedGHSA-5r4p-p66f-jhc7Security

This maintenance release applies security fixes and bumps Go to 1.26.8 for a security patch. It also includes matching performance improvements and a toggle for Nexus callback source header inspection.

Why it's flagged

The release incorporates security fixes and updates the Go runtime for a security patch.

What to check

Upgrade to v1.31.3 to apply the security fixes.

Rules matchedsecurity

This patch release resolves CVEs and updates Go to 1.25.14 for a security patch. It also adds a Nexus callback header inspection toggle and matching performance improvements.

Why it's flagged

The release addresses CVE vulnerabilities and applies a Go security patch.

What to check

Upgrade to v1.30.7 to apply the CVE fixes.

Rules matchedsecurity

This release provides a security fix and performance improvements when reading request parts and parsing content types. It also updates documentation and adds a sponsor.

Why it's flagged

Resolves security advisory GHSA-4mh8-r7rc-xpvc.

What to check

Upgrade to v6.0.0-alpha.4 and verify advisory GHSA-4mh8-r7rc-xpvc remediation.

Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisoriesmajor version bump: v5.12.5 → v6.0.0-alpha.4

This patch release addresses several CVE vulnerabilities including denial of service, privilege escalation, and account lockout issues. It also upgrades Quarkus to 3.33.3.2 and resolves several bug fixes.

Why it's flagged

Fixes multiple vulnerabilities including CVE-2026-90997, CVE-2026-79651, and CVE-2026-17526.

What to check

Upgrade to 26.7.4 and follow the migration guide.

Rules matchedCVE-2026-90997CVE-2026-79651CVE-2026-74909CVE-2026-19607+3 more

This release patches a security advisory and backports performance improvements for content-type parsing and request-part validation.

Why it's flagged

Resolves security advisory GHSA-4mh8-r7rc-xpvc.

What to check

Upgrade to v5.12.5 and review the impact of GHSA-4mh8-r7rc-xpvc.

Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisories

Resolves security issues around inherited request configuration properties and ReDoS in proxy bypass hostname processing. Also breaks compatibility by disallowing Promises/functions/objects in header types and enabling CIDR ranges in NO_PROXY.

Why it's flagged

Fixes security vulnerabilities in request configuration prototype inheritance and ReDoS backtracking during proxy bypass hostname normalization, alongside breaking changes to header types and NO_PROXY CIDR parsing.

What to check

Upgrade to v0.34.0, ensure request config options are own properties rather than inherited, review NO_PROXY CIDR entries, and verify that header values are not Promises or functions.

Rules matchedSecurityBreaking Change⚠️ Breaking

Temporal v1.32.0 promotes Standalone Activities to GA, introduces Standalone Nexus Operations pre-release, and enables the unified query converter by default with strict type validation. It also alters VisibilityRow Go types and callback URL behavior for security reasons.

Why it's flagged

Changes callback URL behavior specifically for security reasons, alongside breaking changes in the default unified query converter and VisibilityRow types.

What to check

Upgrade to v1.32.0, verify visibility search queries against strict type validation, and check custom VisibilityStore implementations for VisibilityRow changes.

Rules matchedsecuritybreaking change