chore: bump netbird to 0.81.3 and keycloak to 26.8.1

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## Unreleased
 
+### Changed
+
+- **netbird**: Bump appVersion from 0.78.2 to 0.81.3, covering upstream
+  0.79.x–0.81.x. Notable additions: certificate posture checks (require
+  management and clients ≥ 0.81.0), nblink, path-based reverse-proxy
+  access control, and management reading `X-Real-IP` for peer connection
+  IPs behind reverse proxies. The combined-server config contract gained
+  one purely additive optional key (`reverseProxy.trustedPeers`); the
+  dashboard env contract is unchanged. No ports, protocols, or `NB_*`
+  env vars changed, and no manual database migration is required.
+  See [v0.81.3 release notes](https://github.com/netbirdio/netbird/releases/tag/v0.81.3)
+  (#144, #146, #148, #149).
+- **netbird**: Bump dashboard image from v2.92.0 to v2.95.0, the
+  dashboard release paired with the server 0.81.x cycle (certificate
+  posture and per-target access-control UI). Env contract unchanged.
+
+### Deprecated
+
+- **netbird**: Upstream deprecated the MySQL store in 0.81.0 and plans
+  to remove it (a `netbird-mysql-migrate` tool is provided). The chart's
+  `database.type: mysql` continues to work and remains tested, but new
+  deployments should prefer `postgresql` or `sqlite`; plan a migration
+  before upstream removes MySQL support.
+
 ## [0.7.1] — 2026-09-17
 
 ### Changed

charts/keycloak/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to the Keycloak Helm chart will be documented in this file.
 
 ## Unreleased
 
+### Security
+
+- Bump Keycloak appVersion from 26.7.4 to 26.8.1 (#145, #147)
+  - 26.8.1 fixes ~20 CVEs, notably CVE-2026-94000 (`manage-users` to
+    realm-admin privilege escalation), CVE-2026-94218 (2FA bypass),
+    CVE-2026-96446 (PAR single-use bypass), CVE-2026-97846
+    (token-exchange mTLS binding bypass), and a SAML broker signature
+    bypass
+
+### Changed
+
+- Upstream 26.8.0 notes relevant to this chart:
+  - Login failures are now persisted in the database by default (the old
+    in-memory behavior is the deprecated `login-failures:v1` feature).
+    The first startup after the upgrade runs a schema migration and
+    creates indexes on large tables in a non-blocking background job —
+    expect some extra load on first boot against an existing database.
+  - None of the `KC_*` options this chart sets were removed or renamed;
+    the `jdbc-ping` cache stack received an upstream bug fix. Ports,
+    health endpoints, and the container entrypoint are unchanged.
+  - See upstream release notes for
+    [26.8.0](https://github.com/keycloak/keycloak/releases/tag/26.8.0) and
+    [26.8.1](https://github.com/keycloak/keycloak/releases/tag/26.8.1)
+
 ## [26.7.4] — 2026-09-17
 
 ### Security

charts/keycloak/Chart.yaml

@@ -3,7 +3,7 @@ name: keycloak
 description: A Helm chart for deploying Keycloak IAM using the upstream quay.io/keycloak/keycloak image on Kubernetes
 type: application
 version: 26.7.4
-appVersion: "26.7.4"
+appVersion: "26.8.1"
 keywords:
   - keycloak
   - iam

charts/keycloak/tests/deployment_test.yaml

@@ -13,7 +13,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "quay.io/keycloak/keycloak:26.7.4"
+          value: "quay.io/keycloak/keycloak:26.8.1"
 
   - it: should use custom image tag when set
     set:
@@ -29,7 +29,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "my-registry/keycloak:26.7.4"
+          value: "my-registry/keycloak:26.8.1"
 
   - it: should set replica count
     set:
@@ -262,7 +262,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].image
-          value: "quay.io/keycloak/keycloak:26.7.4"
+          value: "quay.io/keycloak/keycloak:26.8.1"
 
   - it: should set hardened securityContext on build init container
     set:

charts/keycloak/tests/serviceaccount_test.yaml

@@ -54,4 +54,4 @@ tests:
           content:
             helm.sh/chart: keycloak-26.7.4
             app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/version: "26.7.4"
+            app.kubernetes.io/version: "26.8.1"

charts/netbird/Chart.yaml

@@ -3,7 +3,7 @@ name: netbird
 description: A Helm chart for deploying NetBird VPN management, signal, dashboard, and relay services on Kubernetes
 type: application
 version: 0.7.1
-appVersion: "0.78.2"
+appVersion: "0.81.3"
 keywords:
   - netbird
   - vpn

charts/netbird/README.md

@@ -881,7 +881,7 @@ terminated at the referenced Gateway's listeners, not in these values.
 | ---------------------------- | ------ | ----------------------- | ---------------------------- |
 | `dashboard.replicaCount`     | int    | `1`                     | Number of dashboard replicas |
 | `dashboard.image.repository` | string | `"netbirdio/dashboard"` | Dashboard image              |
-| `dashboard.image.tag`        | string | `"v2.92.0"`             | Dashboard image tag          |
+| `dashboard.image.tag`        | string | `"v2.95.0"`             | Dashboard image tag          |
 | `dashboard.image.pullPolicy` | string | `"IfNotPresent"`        | Image pull policy            |
 | `dashboard.imagePullSecrets` | list   | `[]`                    | Component-level pull secrets |
 

charts/netbird/tests/dashboard-deployment_test.yaml

@@ -13,7 +13,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "netbirdio/dashboard:v2.92.0"
+          value: "netbirdio/dashboard:v2.95.0"
 
   - it: should set replica count
     set:

charts/netbird/tests/server-deployment_test.yaml

@@ -13,7 +13,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "netbirdio/netbird-server:0.78.2"
+          value: "netbirdio/netbird-server:0.81.3"
 
   - it: should use custom image tag when set
     set:

charts/netbird/tests/serviceaccount_test.yaml

@@ -64,4 +64,4 @@ tests:
           content:
             helm.sh/chart: netbird-0.7.1
             app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/version: "0.78.2"
+            app.kubernetes.io/version: "0.81.3"

charts/netbird/values.yaml

@@ -663,7 +663,7 @@ dashboard:
 
   image:
     repository: netbirdio/dashboard
-    tag: "v2.92.0"
+    tag: "v2.95.0"
     pullPolicy: IfNotPresent
 
   imagePullSecrets: []