Skip to content

build(deps): bump keycloak-js from 26.2.1 to 26.2.5 - #2469

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/keycloak-js-26.2.4
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/keycloak-js-26.2.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Bumps keycloak-js from 26.2.1 to 26.2.5.

Release notes

Sourced from keycloak-js's releases.

26.2.5

Highlights

Features

DPoP support for Keycloak-JS

DPoP is a mechanism that prevents token theft and replay attacks by generating sender-constrained access and refresh tokens. It allows a client to cryptographically prove possession of the private key bound to a token, provided the resource server supports the DPoP standard.

[!NOTE] See the documentation for more information.

Bug Fixes

Cordova/cordova-native adapters skip OAuth state validation on login callback

The cordova and cordova-native adapter login callback paths in keycloak-js process OAuth callback data without consistently validating the stored state parameter before applying token-derived authentication state.

keycloak/keycloak-js#306

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

26.2.4

... (truncated)

Commits
  • 931caa7 Set version to 26.2.5
  • be42d6a Bump @​keycloak/keycloak-admin-client from 26.8.0 to 26.8.1 (#369)
  • 69cec6d Remove ts-standard from the project (#358)
  • f53a656 Bump actions/checkout from 6 to 7 (#316)
  • 2ee3f72 Bump @​playwright/test from 1.62.1 to 1.64.0 (#354)
  • 6a55cb7 Bump express from 5.2.1 to 5.3.0 (#356)
  • 5ac4e09 Bump jszip from 3.10.1 to 3.10.2 (#344)
  • 2994182 Bump @​keycloak/keycloak-admin-client from 26.7.0 to 26.8.0 (#352)
  • dfb74a2 Bump @​types/node from 26.1.2 to 26.6.5 (#357)
  • 8803e6b Add DPoP support to keycloak-js (#253)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 30, 2026
@github-actions
github-actions Bot enabled auto-merge October 30, 2026 01:43
@martastn martastn self-assigned this Nov 1, 2026
Bumps [keycloak-js](https://github.com/keycloak/keycloak-js) from 26.2.1 to 26.2.5.
- [Release notes](https://github.com/keycloak/keycloak-js/releases)
- [Changelog](https://github.com/keycloak/keycloak-js/blob/main/RELEASE-CHECKLIST.md)
- [Commits](keycloak/keycloak-js@26.2.1...26.2.5)

---
updated-dependencies:
- dependency-name: keycloak-js
  dependency-version: 26.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot changed the title build(deps): bump keycloak-js from 26.2.1 to 26.2.4 build(deps): bump keycloak-js from 26.2.1 to 26.2.5 Nov 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/keycloak-js-26.2.4 branch from 49c0fff to ee417de Compare November 1, 2026 11:31

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant