Keycloak 26.8

Apply these rules to Keycloak 26.8 servers, extensions and application integrations. Keycloak patches its newest minor; after a new major, its predecessor's last minor gets six months of patches. Plan upgrades at each minor retirement. The included Java 21 baseline matches the JDK in the official server image. A custom server can run any supported OpenJDK 17, 21 or 25, and upstream suggests the newest for production; on 17 or 25, also apply the Java prompt for that runtime and follow its runtime-update rules instead of the JDK 21 ones. Client libraries have their own release lines and configuration.

Server and transport boundaries

• Run production servers with start and a production database; keep start-dev, development credentials and debug endpoints out of deployed configurations. Enable only the features and providers the deployment needs; keep experimental and preview features out of production authentication paths. 26.8 makes SCIM, Standard Token Exchange, JWT Authorization Grant, DPoP, client secret rotation, federated client authentication, Kubernetes service-account authentication and impersonation available by default; server availability does not configure individual realms or clients. List unused features in features-disabled, including client-auth-federated and kubernetes-service-accounts when not needed.
• Set a full HTTPS hostname with the intended context path, and don't run with hostname-strict=false, which builds URLs from request Host headers. Configure hostname-admin separately when needed, and block administration APIs and the