From cb7a3288d27313a5a798aac74d161cbcc0b422c4 Mon Sep 17 00:00:00 2001 From: mikkeldamsgaard Date: Tue, 20 Oct 2026 20:10:19 +0200 Subject: [PATCH] chore: bump netbird to 0.81.3 and keycloak to 26.8.1 netbird: - appVersion 0.78.2 -> 0.81.3 (covers upstream 0.79.x-0.81.x). Notable: certificate posture checks, nblink, path-based reverse-proxy access control, X-Real-IP peer connection IPs behind reverse proxies. The combined-server config contract gained one purely additive optional key (reverseProxy.trustedPeers); dashboard env contract unchanged. No ports, protocols, or NB_* env vars changed; no manual DB migration. - Dashboard image v2.92.0 -> v2.95.0, paired with the 0.81.x cycle. - Upstream deprecated the MySQL store in 0.81.0 (removal planned); database.type=mysql keeps working and stays tested, documented as deprecated in the changelog. keycloak: - appVersion 26.7.4 -> 26.8.1 (upstream minor + security patch). 26.8.1 fixes ~20 CVEs incl. CVE-2026-94000 (manage-users -> realm-admin escalation), CVE-2026-94218 (2FA bypass), CVE-2026-96446 (PAR single-use bypass), CVE-2026-97846 (token-exchange mTLS bypass). None of the KC_* options this chart sets were removed or renamed; 26.8.0 persists login failures in the DB (schema migration plus non-blocking background index creation on first boot), noted in the chart changelog. Chart version fields are untouched; they are bumped by the release flow. Closes #144, #145, #146, #147, #148, #149 Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 24 +++++++++++++++++++ charts/keycloak/CHANGELOG.md | 24 +++++++++++++++++++ charts/keycloak/Chart.yaml | 2 +- charts/keycloak/tests/deployment_test.yaml | 6 ++--- .../keycloak/tests/serviceaccount_test.yaml | 2 +- charts/netbird/Chart.yaml | 2 +- charts/netbird/README.md | 2 +- .../tests/dashboard-deployment_test.yaml | 2 +- .../netbird/tests/server-deployment_test.yaml | 2 +- charts/netbird/tests/serviceaccount_test.yaml | 2 +- charts/netbird/values.yaml | 2 +- 11 files changed, 59 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dd73f10..ecfa1a9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/). ## Unreleased +### Changed + +- **netbird**: Bump appVersion from 0.78.2 to 0.81.3, covering upstream + 0.79.x–0.81.x. Notable additions: certificate posture checks (require + management and clients ≥ 0.81.0), nblink, path-based reverse-proxy + access control, and management reading `X-Real-IP` for peer connection + IPs behind reverse proxies. The combined-server config contract gained + one purely additive optional key (`reverseProxy.trustedPeers`); the + dashboard env contract is unchanged. No ports, protocols, or `NB_*` + env vars changed, and no manual database migration is required. + See [v0.81.3 release notes](https://github.com/netbirdio/netbird/releases/tag/v0.81.3) + (#144, #146, #148, #149). +- **netbird**: Bump dashboard image from v2.92.0 to v2.95.0, the + dashboard release paired with the server 0.81.x cycle (certificate + posture and per-target access-control UI). Env contract unchanged. + +### Deprecated + +- **netbird**: Upstream deprecated the MySQL store in 0.81.0 and plans + to remove it (a `netbird-mysql-migrate` tool is provided). The chart's + `database.type: mysql` continues to work and remains tested, but new + deployments should prefer `postgresql` or `sqlite`; plan a migration + before upstream removes MySQL support. + ## [0.7.1] — 2026-09-17 ### Changed diff --git a/charts/keycloak/CHANGELOG.md b/charts/keycloak/CHANGELOG.md index bb27465..520cf10 100644 --- a/charts/keycloak/CHANGELOG.md +++ b/charts/keycloak/CHANGELOG.md @@ -4,6 +4,30 @@ All notable changes to the Keycloak Helm chart will be documented in this file. ## Unreleased +### Security + +- Bump Keycloak appVersion from 26.7.4 to 26.8.1 (#145, #147) + - 26.8.1 fixes ~20 CVEs, notably CVE-2026-94000 (`manage-users` to + realm-admin privilege escalation), CVE-2026-94218 (2FA bypass), + CVE-2026-96446 (PAR single-use bypass), CVE-2026-97846 + (token-exchange mTLS binding bypass), and a SAML broker signature + bypass + +### Changed + +- Upstream 26.8.0 notes relevant to this chart: + - Login failures are now persisted in the database by default (the old + in-memory behavior is the deprecated `login-failures:v1` feature). + The first startup after the upgrade runs a schema migration and + creates indexes on large tables in a non-blocking background job — + expect some extra load on first boot against an existing database. + - None of the `KC_*` options this chart sets were removed or renamed; + the `jdbc-ping` cache stack received an upstream bug fix. Ports, + health endpoints, and the container entrypoint are unchanged. + - See upstream release notes for + [26.8.0](https://github.com/keycloak/keycloak/releases/tag/26.8.0) and + [26.8.1](https://github.com/keycloak/keycloak/releases/tag/26.8.1) + ## [26.7.4] — 2026-09-17 ### Security diff --git a/charts/keycloak/Chart.yaml b/charts/keycloak/Chart.yaml index 33832b0..77e6b2d 100644 --- a/charts/keycloak/Chart.yaml +++ b/charts/keycloak/Chart.yaml @@ -3,7 +3,7 @@ name: keycloak description: A Helm chart for deploying Keycloak IAM using the upstream quay.io/keycloak/keycloak image on Kubernetes type: application version: 26.7.4 -appVersion: "26.7.4" +appVersion: "26.8.1" keywords: - keycloak - iam diff --git a/charts/keycloak/tests/deployment_test.yaml b/charts/keycloak/tests/deployment_test.yaml index 9ec19cc..840d950 100644 --- a/charts/keycloak/tests/deployment_test.yaml +++ b/charts/keycloak/tests/deployment_test.yaml @@ -13,7 +13,7 @@ tests: asserts: - equal: path: spec.template.spec.containers[0].image - value: "quay.io/keycloak/keycloak:26.7.4" + value: "quay.io/keycloak/keycloak:26.8.1" - it: should use custom image tag when set set: @@ -29,7 +29,7 @@ tests: asserts: - equal: path: spec.template.spec.containers[0].image - value: "my-registry/keycloak:26.7.4" + value: "my-registry/keycloak:26.8.1" - it: should set replica count set: @@ -262,7 +262,7 @@ tests: asserts: - equal: path: spec.template.spec.initContainers[0].image - value: "quay.io/keycloak/keycloak:26.7.4" + value: "quay.io/keycloak/keycloak:26.8.1" - it: should set hardened securityContext on build init container set: diff --git a/charts/keycloak/tests/serviceaccount_test.yaml b/charts/keycloak/tests/serviceaccount_test.yaml index 5366824..69bea7f 100644 --- a/charts/keycloak/tests/serviceaccount_test.yaml +++ b/charts/keycloak/tests/serviceaccount_test.yaml @@ -54,4 +54,4 @@ tests: content: helm.sh/chart: keycloak-26.7.4 app.kubernetes.io/managed-by: Helm - app.kubernetes.io/version: "26.7.4" + app.kubernetes.io/version: "26.8.1" diff --git a/charts/netbird/Chart.yaml b/charts/netbird/Chart.yaml index 0a3eada..7be04ce 100644 --- a/charts/netbird/Chart.yaml +++ b/charts/netbird/Chart.yaml @@ -3,7 +3,7 @@ name: netbird description: A Helm chart for deploying NetBird VPN management, signal, dashboard, and relay services on Kubernetes type: application version: 0.7.1 -appVersion: "0.78.2" +appVersion: "0.81.3" keywords: - netbird - vpn diff --git a/charts/netbird/README.md b/charts/netbird/README.md index 6c61e9a..83bf4c5 100644 --- a/charts/netbird/README.md +++ b/charts/netbird/README.md @@ -881,7 +881,7 @@ terminated at the referenced Gateway's listeners, not in these values. | ---------------------------- | ------ | ----------------------- | ---------------------------- | | `dashboard.replicaCount` | int | `1` | Number of dashboard replicas | | `dashboard.image.repository` | string | `"netbirdio/dashboard"` | Dashboard image | -| `dashboard.image.tag` | string | `"v2.92.0"` | Dashboard image tag | +| `dashboard.image.tag` | string | `"v2.95.0"` | Dashboard image tag | | `dashboard.image.pullPolicy` | string | `"IfNotPresent"` | Image pull policy | | `dashboard.imagePullSecrets` | list | `[]` | Component-level pull secrets | diff --git a/charts/netbird/tests/dashboard-deployment_test.yaml b/charts/netbird/tests/dashboard-deployment_test.yaml index 9697532..2bb02a9 100644 --- a/charts/netbird/tests/dashboard-deployment_test.yaml +++ b/charts/netbird/tests/dashboard-deployment_test.yaml @@ -13,7 +13,7 @@ tests: asserts: - equal: path: spec.template.spec.containers[0].image - value: "netbirdio/dashboard:v2.92.0" + value: "netbirdio/dashboard:v2.95.0" - it: should set replica count set: diff --git a/charts/netbird/tests/server-deployment_test.yaml b/charts/netbird/tests/server-deployment_test.yaml index f2dc0a5..c9ee1b1 100644 --- a/charts/netbird/tests/server-deployment_test.yaml +++ b/charts/netbird/tests/server-deployment_test.yaml @@ -13,7 +13,7 @@ tests: asserts: - equal: path: spec.template.spec.containers[0].image - value: "netbirdio/netbird-server:0.78.2" + value: "netbirdio/netbird-server:0.81.3" - it: should use custom image tag when set set: diff --git a/charts/netbird/tests/serviceaccount_test.yaml b/charts/netbird/tests/serviceaccount_test.yaml index 6d404a2..81c88ff 100644 --- a/charts/netbird/tests/serviceaccount_test.yaml +++ b/charts/netbird/tests/serviceaccount_test.yaml @@ -64,4 +64,4 @@ tests: content: helm.sh/chart: netbird-0.7.1 app.kubernetes.io/managed-by: Helm - app.kubernetes.io/version: "0.78.2" + app.kubernetes.io/version: "0.81.3" diff --git a/charts/netbird/values.yaml b/charts/netbird/values.yaml index 54b4fb6..f78bb01 100644 --- a/charts/netbird/values.yaml +++ b/charts/netbird/values.yaml @@ -663,7 +663,7 @@ dashboard: image: repository: netbirdio/dashboard - tag: "v2.92.0" + tag: "v2.95.0" pullPolicy: IfNotPresent imagePullSecrets: []