all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-jammy:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe05:686c
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 3a00228b-769b-4211-a13c-8230981a57ca
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe05:686c
        label: ubuntu-jammy
        node_properties: {}
        private_ipv4: 10.128.0.107
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.76
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe05:686c
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: YAKEcloud/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: YAKEcloud/yake-ansible/.zuul.yaml@main#82>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 97be0756d4aa4e419bcdbbe2cedd6b83
      build_refs:
      - branch: main
        change: '582'
        change_message: "chore(deps): update dependency keycloak/keycloak to v26.6.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [keycloak/keycloak](https://redirect.github.com/keycloak/keycloak)
          | minor | `26.5.7` \u2192 `26.6.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>keycloak/keycloak
          (keycloak/keycloak)</summary>\n\n### [`v26.6.0`](https://redirect.github.com/keycloak/keycloak/releases/tag/26.6.0)\n\n[Compare
          Source](https://redirect.github.com/keycloak/keycloak/compare/26.5.7...26.6.0)\n\n<div>\n
          \   <h2>Highlights</h2>\n<div class=\"paragraph\">\n<p>This release features
          new capabilities for users and administrators of Keycloak. The highlights
          of this release are:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><strong>JWT
          Authorization Grant</strong>, enabling external-to-internal token exchange
          using externally signed JWT assertions.</p>\n</li>\n<li>\n<p><strong>Federated
          client authentication</strong>, eliminating the need to manage individual
          client secrets in Keycloak.</p>\n</li>\n<li>\n<p><strong>Workflows</strong>,
          enabling administrators to automate realm administrative tasks such as user
          and client lifecycle management.</p>\n</li>\n<li>\n<p><strong>Zero-downtime
          patch releases</strong>, allowing rolling updates within a minor release
          stream without service downtime.</p>\n</li>\n<li>\n<p>The <strong>Keycloak
          Test Framework</strong>, replacing the previous Arquillian-based solution.</p>\n</li>\n</ul>\n</div>\n<div
          class=\"paragraph\">\n<p>All of these features are now fully supported and
          no longer in preview.\nRead on to learn more about each new feature.\nIf
          you are upgrading from a previous release, <a href=\"https://www.keycloak.org/docs/latest/upgrading/index.html\">also
          review the changes listed in the upgrading guide</a>.</p>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_security_and_standards\">Security and Standards</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_jwt_authorization_grant_supported\">JWT Authorization
          Grant (supported)</h4>\n<div class=\"paragraph\">\n<p>JWT Authorization
          Grant (<a href=\"https://datatracker.ietf.org/doc/html/rfc7523\">RFC 7523</a>)
          is designed to implement external-to-internal token exchange use cases.
          This grant allows using externally signed JWT assertions to request OAuth
          2.0 access tokens.</p>\n</div>\n<div class=\"paragraph\">\n<p>In this release,
          JWT Authorization Grant is promoted from preview to supported. See the <a
          href=\"https://www.keycloak.org/securing-apps/jwt-authorization-grant\">JWT
          Authorization Grant guide</a> for additional details.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_federated_client_authentication_supported\">Federated
          client authentication (supported)</h4>\n<div class=\"paragraph\">\n<p>Federated
          client authentication allows clients to leverage existing credentials once
          a trust relationship with another issuer exists. It eliminates the need
          to assign and manage individual secrets for each client in Keycloak.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Federated client authentication is now promoted
          to supported, including support for client assertions issued by external
          OpenID Connect identity providers and Kubernetes Service Accounts.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Since the OAuth SPIFFE Client Authentication specification
          is still in draft status, this feature remains a preview feature in Keycloak.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_guide_about_demonstrating_proof_of_possession_dpop\">New
          guide about Demonstrating Proof-of-Possession (DPoP)</h4>\n<div class=\"paragraph\">\n<p>A
          new guide for OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) in the
          Securing applications Guides provides information on how to mitigate the
          risk of stolen tokens by making tokens sender-constrained.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/nightly/securing-apps/dpop\">Securing
          applications with DPoP</a> for more details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_identity_brokering_apis_v2_preview\">Identity Brokering APIs V2 (preview)</h4>\n<div
          class=\"paragraph\">\n<p>A new preview version 2 for the Identity Brokering
          APIs is introduced in this release. When brokering is used during the authentication
          process, Keycloak allows you to store tokens and responses issued by the
          external Identity Provider. Applications can call a specific endpoint to
          retrieve those tokens, which, in turn, can be used to get extra user information
          or invoke endpoints in the external trust domain. The new version improves
          the token retrieval endpoint to substitute the internal to external Token
          Exchange (use case for the <a href=\"https://www.keycloak.org/securing-apps/token-exchange#_legacy-token-exchange\">legacy
          Token Exchange V1</a>).</p>\n</div>\n<div class=\"paragraph\">\n<p>For more
          information, see the chapter <a href=\"https://www.keycloak.org/docs/26.6.0/server_development/#_identity-brokering-apis\">Identity
          Brokering APIs</a> in the Server Developer Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_step_up_authentication_for_saml_preview\">Step-up
          authentication for SAML (preview)</h4>\n<div class=\"paragraph\">\n<p>The
          feature <code>step-up-authentication-saml</code> extends the step-up authentication
          to include the SAML protocol and clients. This feature is in preview mode.
          Additional information is available in the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_step-up-authentication-saml\">Server
          Administration Guide</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_oauth_client_id_metadata_document_experimental\">OAuth Client ID Metadata
          Document (experimental)</h4>\n<div class=\"paragraph\">\n<p><a href=\"https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-01.html\">OAuth
          Client ID Metadata Document (CIMD)</a> is an emerging standard that defines
          a JSON document format for describing OAuth 2.0 client metadata. Since version
          2025-11-25, the Model Context Protocol (MCP) requires an authorization server
          to comply with CIMD. Keycloak now includes experimental support for CIMD,
          allowing it to serve as an authorization server for MCP version 2025-11-25
          or later.</p>\n</div>\n<div class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/securing-apps/mcp-authz-server\">Integrating
          with Model Context Protocol (MCP)</a> for the updated guide including CIMD.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Many thanks to <a href=\"https://redirect.github.com/tnorimat\">Takashi
          Norimatsu</a> for the contribution.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_administration\">Administration</h3>\n<div class=\"sect3\">\n<h4 id=\"_workflows_supported\">Workflows
          (supported)</h4>\n<div class=\"paragraph\">\n<p>Workflows allow administrators
          to automate and orchestrate realm administrative tasks, bringing key capabilities
          of Identity Governance and Administration (IGA) to Keycloak. By defining
          workflows in YAML format, you can automate the lifecycle of realm resources
          such as users and clients based on events, conditions, and schedules.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>In this release, Workflows is promoted from preview
          to supported. This release also includes new built-in steps, a troubleshooting
          guide, and various improvements to the workflow engine.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_workflows\">Managing
          workflows</a> chapter in the Server Administration Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_organization_groups\">Organization groups</h4>\n<div
          class=\"paragraph\">\n<p>Organizations now support isolated group hierarchies,
          allowing each organization to manage its own teams and departments without
          naming conflicts across the realm. This update includes Identity Provider
          mappers to automatically assign federated users to organization groups based
          on external claims. Group membership is automatically included in OIDC tokens
          and SAML assertions when an organization context is requested.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_groups_\">Managing
          organization groups</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_new_groups_scope_for_user_membership_changes\">New Groups scope for
          user membership changes</h4>\n<div class=\"paragraph\">\n<p>Fine-Grained
          Admin Permissions (FGAP) now includes a new <code>Groups</code> scope: <code>manage-membership-of-members</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>This scope is now used as the group-side bridge
          for evaluating user-side <code>manage-group-membership</code> permissions
          based on a user&#&#8203;8217;s current group memberships.\nThe existing
          <code>manage-membership</code> scope keeps its current behavior for target
          group membership management operations.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_looking_up_client_secrets_via_the_vault_spi\">Looking up client secrets
          via the Vault SPI</h4>\n<div class=\"paragraph\">\n<p>Secrets for clients
          can now be managed and looked up by the Vault SPI.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank
          you to <a href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for
          contributing this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_forcing_password_change_for_ldap_users\">Forcing password change for
          LDAP users</h4>\n<div class=\"paragraph\">\n<p>There is now initial support
          for LDAP password policy control.\nThe support is limited to prompting users
          to update their password when the LDAP server indicates that the password
          must be changed.\nPreviously, Keycloak let the user in and ignored the mandatory
          password reset.\nThere is a new optional setting &#&#8203;8220;Enable LDAP
          password policy&#&#8203;8221; in the LDAP advanced settings to enable this.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
          Saarni</a> for contributing this change.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_configuring_and_running\">Configuring and Running</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_java_25_support\">Java 25 support</h4>\n<div
          class=\"paragraph\">\n<p>Keycloak now supports running with OpenJDK 25.\nThe
          server container image continues to use OpenJDK 21 for now to support FIPS
          mode. For details, see the\nnote in the FIPS guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_zero_downtime_patch_releases_supported\">Zero-downtime
          patch releases (supported)</h4>\n<div class=\"paragraph\">\n<p>Zero-downtime
          patch releases allow you to perform rolling updates when upgrading to a
          newer patch version within the same <code>major.minor</code> release stream
          without service downtime.</p>\n</div>\n<div class=\"paragraph\">\n<p>In
          this release, zero-downtime patch releases are promoted to supported and
          enabled by default.\nWhen using the Keycloak Operator, set the update strategy
          to <code>Auto</code> to benefit from this functionality.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details on the Operator configuration,
          see the <a href=\"https://www.keycloak.org/operator/rolling-updates\">Avoiding
          downtime with rolling updates</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_installation_instructions_for_cloudnativepg\">Installation instructions
          for CloudNativePG</h4>\n<div class=\"paragraph\">\n<p>For those running
          Keycloak on Kubernetes, there is now a guide on how to deploy a PostgreSQL
          database on Kubernetes by leveraging the CloudNativePG Operator and how
          to connect Keycloak to the database.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          <a href=\"https://www.keycloak.org/nightly/high-availability/single-cluster/deploy-cnpg\">Deploying
          CloudNativePG in multiple availability zones</a> in the High Availability
          Guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_simplified_database_operations\">Simplified
          database operations</h4>\n<div class=\"paragraph\">\n<p>Several new command
          line options simplify the database operations for Keycloak and remove the
          need to use raw JDBC connection options:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p>Configure
          TLS for the database connection.</p>\n</li>\n<li>\n<p>Database connection
          timeouts.</p>\n</li>\n<li>\n<p>Transaction timeouts with production-ready
          defaults.</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>It also
          verifies the correct UTF-8 character encoding of the database at startup
          and prints a warning if this is not the case.</p>\n</div>\n<div class=\"paragraph\">\n<p>When
          running on orchestrators like Kubernetes, the startup and liveness probes
          return UP during database migrations, simplifying upgrades by removing the
          need to adjust the probes during upgrades.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          the migration guide for additional details on each aspect.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_graceful_shutdown_of_http_stack\">Graceful shutdown
          of HTTP stack</h4>\n<div class=\"paragraph\">\n<p>To allow rolling updates
          for configuration changes or version updates, a graceful shutdown of Keycloak
          nodes prevents users from seeing error responses when logging in or refreshing
          their tokens when nodes shut down.</p>\n</div>\n<div class=\"paragraph\">\n<p>Starting
          with this version, Keycloak supports a graceful shutdown of the HTTP stack.\nThis
          includes delaying a shutdown after receiving a termination signal, connection
          draining for HTTP/1.1 and HTTP/2 connections during that period, and a shutdown
          timeout to finish ongoing requests.</p>\n</div>\n<div class=\"paragraph\">\n<p>The
          defaults are a shutdown delay and a shutdown timeout of one second each.\nThis
          should be a good fit for setups where the reverse proxy is using TLS edge
          termination or re-encryption and the reverse proxy is notified about the
          Keycloak node shutting down at the same time as the Keycloak node.\nThis
          is a common setup, for example, in Kubernetes environments.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Users should adjust those values depending on their
          proxy setup.\nSee the section <a href=\"https://www.keycloak.org/server/reverseproxy#graceful-http-shutdown\">Graceful
          HTTP shutdown</a> in the reverse proxy guide for more information.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_kcraw_prefix_for_environment_variables_to_preserve_literal_values\">New
          <code>KCRAW_</code> prefix for environment variables to preserve literal
          values</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports a <code>KCRAW_</code>
          prefix for environment variables to preserve values containing <code>$</code>
          characters exactly as written, without expression evaluation.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>When using the standard <code>KC_</code> prefix,
          Keycloak (via SmallRye Config) evaluates expressions in values (for example,
          <code>${some_key}</code> is resolved and <code>$$</code> is collapsed to
          <code>$</code>).\nThis can silently modify passwords or secrets injected
          by a secrets manager or orchestration tool where manual escaping is not
          feasible.</p>\n</div>\n<div class=\"paragraph\">\n<p>Setting <code>KCRAW_&lt;KEY&gt;</code>
          instead of <code>KC_&lt;KEY&gt;</code> preserves the value exactly as provided.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See the <a href=\"https://www.keycloak.org/server/configuration#kcraw-prefix\">Preserving
          literal values with the KCRAW_ prefix</a> section in the Server Configuration
          guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_reload_of_lists_with_disallowed_passwords\">Automatic
          reload of lists with disallowed passwords</h4>\n<div class=\"paragraph\">\n<p>When
          a list of disallowed passwords (also known as blacklist) changes, it is
          automatically reloaded. This avoids the need for a server restart when the
          list changes.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank you to <a
          href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for contributing
          this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_truststore_initialization_on_kubernetes_and_openshift\">Automatic
          truststore initialization on Kubernetes and OpenShift</h4>\n<div class=\"paragraph\">\n<p>Keycloak
          now automatically discovers and trusts cluster certificate authorities when
          running on Kubernetes or OpenShift, without requiring the Operator to preconfigure
          the truststore.</p>\n</div>\n<div class=\"paragraph\">\n<p>If present in
          the container filesystem, the following certificates are added to the system
          truststore at startup:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code>
          (Kubernetes service account CA)</p>\n</li>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt</code>
          (OpenShift service CA)</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>This
          behavior is enabled by default and can be controlled with the server option
          <code>--truststore-kubernetes-enabled=true|false</code> (default: <code>true</code>).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Most deployments do not require any action. If
          you relied on the Operator to manage these truststore entries previously,
          the server now performs the same function directly.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_client_certificate_lookup_providers_for_traefik_and_envoy\">Client
          certificate lookup providers for Traefik and Envoy</h4>\n<div class=\"paragraph\">\n<p>You
          can now use new client certificate lookup providers for Traefik and Envoy
          proxies.\nFor details, see the <a href=\"https://www.keycloak.org/server/reverseproxy#_enabling_client_certificate_lookup\">Enabling
          Client Certificate Lookup</a> section of the documentation.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_configurable_kubernetes_service_name_and_port_in_the_keycloak_operator\">Configurable
          Kubernetes Service name and port in the Keycloak Operator</h4>\n<div class=\"paragraph\">\n<p>The
          Keycloak Operator now supports overriding the name and port of the Kubernetes
          Service it creates for a Keycloak deployment.</p>\n</div>\n<div class=\"paragraph\">\n<p>Previously,
          the Service name was always derived as <code>&lt;cr-name&gt;-service</code>
          and the Service port always matched the container port.\nYou can now use
          the <code>spec.http.serviceName</code>, <code>spec.http.serviceHttpsPort</code>,
          and <code>spec.http.serviceHttpPort</code> fields to\nconfigure these independently.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration\">Advanced
          configuration</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_sensitive_information_is_not_displayed_in_the_http_access_log\">Sensitive
          information is not displayed in the HTTP Access log</h4>\n<div class=\"paragraph\">\n<p>If
          you are using the HTTP Access logging capability, sensitive information
          is omitted.\nThis means that tokens in the 'Authorization' HTTP header and
          specific sensitive cookies are not shown.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_configurable_log_file_rotation\">Configurable log file rotation</h4>\n<div
          class=\"paragraph\">\n<p>It is now possible to configure log file rotation
          when using Keycloak&#&#8203;8217;s built-in file logging handler.\nThis
          includes a simple option to fully disable log rotation, which is useful
          when using an external log rotation solution such as <code>logrotate</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>To disable log file rotation:</p>\n</div>\n<div
          class=\"listingblock\">\n<div class=\"content\">\n<pre class=\"highlight\"><code
          class=\"language-bash\" data-lang=\"bash\">bin/kc.sh start --log=\"console,file\"
          --log-file-rotation-enabled=false</code></pre>\n</div>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see the <a href=\"https://www.keycloak.org/server/logging/file\">File
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_http_access_logs_in_a_dedicated_file\">HTTP
          access logs in a dedicated file</h4>\n<div class=\"paragraph\">\n<p>HTTP
          access logs can now be written to a dedicated file, separate from the server
          logs.\nThis makes it easier to process and archive access logs independently
          for security auditing and compliance monitoring.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_customizable_service_fields_in_json_log_output\">Customizable service
          fields in JSON log output</h4>\n<div class=\"paragraph\">\n<p>Keycloak now
          provides native options to customize the <code>service.name</code> and <code>service.environment</code>
          fields in JSON log output across all log handlers (console, file, and syslog).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Previously, when using the ECS format, <code>service.name</code>
          and <code>service.environment</code> could not be overridden through Keycloak
          configuration.\nThis made it difficult to align JSON log fields with OpenTelemetry
          resource attributes.</p>\n</div>\n<div class=\"paragraph\">\n<p>You can
          now set these fields using <code>log-service-name</code> and <code>log-service-environment</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more information, see the <a href=\"https://www.keycloak.org/server/logging#customize-service-fields\">Configuring
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_new_and_updated_translations\">New
          and updated translations</h4>\n<div class=\"paragraph\">\n<p>New translations
          for Indonesian and Armenian were added. A warm welcome to the new language
          maintainers for these languages!\nThere are also new language maintainers
          for the Swedish translation, who translated all remaining message keys.
          Thank you so much!</p>\n</div>\n<div class=\"paragraph\">\n<p>Follow the
          translation progress on the <a href=\"https://www.keycloak.org/translations\">translation
          status page</a>, help translate, and read the translation guide on how to
          add additional languages.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_right_to_left_language_support_in_the_account_ui\">Right-to-left language
          support in the Account UI</h4>\n<div class=\"paragraph\">\n<p>Support for
          right-to-left (RTL) languages was added to the Login UI, Admin UI, and email
          templates several releases ago. This release adds initial RTL support to
          the Account UI, which completes this effort.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_observability\">Observability</h3>\n<div class=\"sect3\">\n<h4
          id=\"_telemetry_configuration_via_the_keycloak_cr\">Telemetry configuration
          via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports
          configuring the OpenTelemetry properties via the Keycloak CR when using
          the Operator.\nThese properties are shared among the available OpenTelemetry
          components - logs, metrics, and traces.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_custom_request_headers_for_opentelemetry\">Custom
          request headers for OpenTelemetry</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to set request headers for exporting telemetry via OpenTelemetry
          Protocol (OTLP).\nThis is mainly useful for providing tokens in the request.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>You can specify these headers via the <code>telemetry-header-&lt;header&gt;</code>
          wildcard option, which accepts any custom header name.\nAlternatively, use
          <code>telemetry-logs-header-&lt;header&gt;</code> for OpenTelemetry Logs
          or <code>telemetry-metrics-header-&lt;header&gt;</code> for OpenTelemetry
          Metrics.</p>\n</div>\n<div class=\"paragraph\">\n<p>For more details, see
          the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_service_monitor_annotations_and_labels_via_the_keycloak_cr\">Service
          Monitor annotations and labels via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to configure service monitor labels and annotations via
          the Keycloak CR when using the Operator.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration#_servicemonitor\">Advanced
          Configuration Operator</a> guide.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_extension_development\">Extension Development</h3>\n<div class=\"sect3\">\n<h4
          id=\"_keycloak_test_framework_supported\">Keycloak Test Framework (supported)</h4>\n<div
          class=\"paragraph\">\n<p>The Keycloak Test Framework, based on JUnit 6,
          is now fully supported.</p>\n</div>\n<div class=\"paragraph\">\n<p>It replaces
          the previous solution built on top of Arquillian and JUnit 4.\nBehind the
          scenes, the framework handles the lifecycle of Keycloak, the database, and
          any injected resources such as realms and clients.</p>\n</div>\n<div class=\"paragraph\">\n<p>Tests
          simply declare what they want, including specific configuration, and the
          framework takes care of the rest.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://redirect.github.com/keycloak/keycloak/tree/main/test-framework#readme\">Keycloak
          Test Framework</a>.</p>\n</div>\n</div>\n</div>\n<h2>Upgrading</h2>\n<p>Before
          upgrading refer to <a href=\"https://www.keycloak.org/docs/latest/upgrading/#migration-changes\">the
          migration guide</a> for a complete list of changes.</p>\n\n<h2>All resolved
          issues</h2>\n\n<h3>Deprecated features</h3>\n<ul>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45156\">#&#8203;45156</a>
          Deprecate Token Exchange v1 </li>\n</ul>\n\n<h3>New features</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10155\">#&#8203;10155</a>
          Step-up authentication for SAML clients <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/13102\">#&#8203;13102</a>
          Add support for specifying `client.secret` using vault <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/39888\">#&#8203;39888</a>
          Workflows </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42634\">#&#8203;42634</a>
          Federated client authentication </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43144\">#&#8203;43144</a>
          OAuth Identity and Authorization Chaining Across Domains </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43146\">#&#8203;43146</a>
          New test framework </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43152\">#&#8203;43152</a>
          Authorization Grants </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43252\">#&#8203;43252</a>
          Zero-downtime upgrades between patch releases of Keycloak </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43257\">#&#8203;43257</a>
          Support a Kubernetes Native Database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43507\">#&#8203;43507</a>
          Add support for Organization-specific Groups </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43576\">#&#8203;43576</a>
          Authorization grant for social providers <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44833\">#&#8203;44833</a>
          [OID4VCI] Make natural_person configuration available in all formats <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45106\">#&#8203;45106</a>
          OAuth Client ID Metadata Document </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45284\">#&#8203;45284</a>
          CIMD - Persistent CIMD <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46633\">#&#8203;46633</a>
          keycloak operator: add support for different port and name for the kubernetes
          service definition in the keycloak CRD </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47011\">#&#8203;47011</a>
          Add debug helper utility to the test framework <code>test-framework</code></li>\n</ul>\n\n<h3>Enhancements</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10618\">#&#8203;10618</a>
          Enhancements to logging config <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/14523\">#&#8203;14523</a>
          Add support for enforced password change with LDAP federation <code>ldap</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/17904\">#&#8203;17904</a>
          Support RTL UI <code>account/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/19374\">#&#8203;19374</a>
          Allow absolute path for cache-config-file? <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/19453\">#&#8203;19453</a>
          The default database transaction timeout should not be applied to Liquibase
          or data migrations <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/20618\">#&#8203;20618</a>
          Support enabling access logs <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/27986\">#&#8203;27986</a>
          Remove Liquibase dependency version from Keycloak root pom </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33160\">#&#8203;33160</a>
          Add support for X509 client certificate lookup for Envoy </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/33198\">#&#8203;33198</a>
          Introduce `resourcesCommonUrl` for E-Mail templates <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33818\">#&#8203;33818</a>
          Request for Enhancement: Make x509cert-lookup SPI public </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/34435\">#&#8203;34435</a>
          OTEL: Add tracing ID to user facing error message <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/35298\">#&#8203;35298</a>
          Reverse proxy provided context path not working despite setting X-Forwarded-Prefix
          header <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36226\">#&#8203;36226</a>
          Provide a read only view of Identity Provider Mappers configuration screen
          to the Keycloak Admin UI </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36710\">#&#8203;36710</a>
          Have a first-class CLI option to change Keycloak's transaction timeout <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38884\">#&#8203;38884</a>
          Upgrade command rolling updates for patch releases / step 3: Infinispan/JGroups
          support </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/38888\">#&#8203;38888</a>
          Avoid breaking DB changes during patch releases </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40902\">#&#8203;40902</a>
          More fully document operator upgrade scenarios, in particular with custom
          images <code>docs</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41330\">#&#8203;41330</a>
          Improve logging of JpaUserSessionPersisterProvider#expire </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41353\">#&#8203;41353</a>
          Provide HTTP access logs written to file with rotation <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41629\">#&#8203;41629</a>
          Remove Tracing workaround in Infinispan/JGroups classes </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42256\">#&#8203;42256</a>
          DB Connection Pool acquisition timeout errors on database failover  <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42626\">#&#8203;42626</a>
          Provide a way to add custom labels to generated ServiceMonitor </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42747\">#&#8203;42747</a>
          Make DPoP docs more detailed <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42876\">#&#8203;42876</a>
          dev mode should bind only to localhost if possible </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42900\">#&#8203;42900</a>
          Move the logic of scanning Kubernetes CA to Keycloak <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43589\">#&#8203;43589</a>
          Gracefully shutting down HTTP stack </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43701\">#&#8203;43701</a>
          Improve SimpleHttp API <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43829\">#&#8203;43829</a>
          Add createdTimestamp filter (before/after) to /admin/realms/{realm}/users
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44090\">#&#8203;44090</a>
          ErrorId for error screens and logging </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44101\">#&#8203;44101</a>
          Allow re-using server when running tests with the new framework </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44364\">#&#8203;44364</a>
          Improve client creation with PKCE in admin console <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44424\">#&#8203;44424</a>
          findClientSessionsClientIds performance issue <code>storage</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44459\">#&#8203;44459</a>
          Adding the log to the required action to show the cause of syntax violation
          of the LDAP policy <code>ldap</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44846\">#&#8203;44846</a>
          [OID4VCI]: Ensure OID4VCI optional fields are saved cleanly and use defaults
          <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44849\">#&#8203;44849</a>
          [OID4VCI] Add UI support for `vc.credential_signing_alg` in OID4VCI client
          scopes <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44973\">#&#8203;44973</a>
          Hide Remember Me session settings when Remember Me is disabled in realm
          login settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45006\">#&#8203;45006</a>
          [OID4VCI] Add support for user did as subject id <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45188\">#&#8203;45188</a>
          Upgrade to quarkus 3.30.5 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45220\">#&#8203;45220</a>
          OTEL: Ability to specify headers for exporters <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45231\">#&#8203;45231</a>
          [OID4VCI] Generate pre-authorized codes using the JWT format <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45254\">#&#8203;45254</a>
          Admin UI javascript bundle should have source mapping </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45278\">#&#8203;45278</a>
          Upgrade to Quarkus 3.33.x LTS </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45281\">#&#8203;45281</a>
          Add missing Swedish translations for admin theme messages <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45322\">#&#8203;45322</a>
          Linking user with idp fails with generic message if user is already linked
          <code>identity-brokering</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45337\">#&#8203;45337</a>
          Upgrade to Quarkus 3.31 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45348\">#&#8203;45348</a>
          OTEL: Add Telemetry options to Keycloak CR <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45360\">#&#8203;45360</a>
          Document that the the HA architectures are tested with Openshift 4.18 </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45467\">#&#8203;45467</a>
          Management interface endpoint lists available endpoints <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45620\">#&#8203;45620</a>
          Change default not-before validation to 10 second instead of 0 <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45623\">#&#8203;45623</a>
          Avoid unnecessary warning logs during the operator tests execution <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45629\">#&#8203;45629</a>
          HTTP access log written to file should be in a separate directory <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45689\">#&#8203;45689</a>
          When a user joins a role or group, it should not read all existing roles
          and groups from the database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45704\">#&#8203;45704</a>
          Invite existing users from Admin UI <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45718\">#&#8203;45718</a>
          Improve error message when organization name cannot be used as alias </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45795\">#&#8203;45795</a>
          Promote Keycloak and KeycloakRealmImport CRDs to v2beta1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45841\">#&#8203;45841</a>
          Add revert button to client credentials page </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45880\">#&#8203;45880</a>
          SAMLEndpoint - increase extensibility by increasing accessibility of some
          private fields/methods </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45882\">#&#8203;45882</a>
          Use GroupResource context in Groups so that Group components can be reused
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45884\">#&#8203;45884</a>
          Testframework core has dependency on testcontainers </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45898\">#&#8203;45898</a>
          Supported Configurations guide </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45909\">#&#8203;45909</a>
          Add theme clarification blurb to Realm Settings <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45941\">#&#8203;45941</a>
          Do not use deprecated test containers in tests <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45944\">#&#8203;45944</a>
          OTEL: Use suggested 'code.function.name' for span attributes <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45965\">#&#8203;45965</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45992\">#&#8203;45992</a>
          Clarify operator instructions involving Wildcard certificates and OpenShift
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45996\">#&#8203;45996</a>
          Enforce `LF` line endings on `*.tsx` files with `.gitattributes` </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45999\">#&#8203;45999</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46001\">#&#8203;46001</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46043\">#&#8203;46043</a>
          Upgrade to Quarkus 3.31.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46055\">#&#8203;46055</a>
          [OID4VCI] Confine test realm setup to TestCase.configureTestRealm() </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46156\">#&#8203;46156</a>
          Add node count and next-node selection to LoadBalancer API </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46164\">#&#8203;46164</a>
          Separate password and OTP brute force protection to prevent OTP bypass attacks
          by default </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46255\">#&#8203;46255</a>
          Upgrade to Quarkus 3.32.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46292\">#&#8203;46292</a>
          Allow to expose WellKnown provider via ServerMetadataResource </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46304\">#&#8203;46304</a>
          SPIFFE Identity Provider default TTL too low </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46355\">#&#8203;46355</a>
          [OID4VCI] Add support for CredentialScopeRepresentation <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46395\">#&#8203;46395</a>
          X509 Certificates passed from Traefik PassTlsClientCert middleware broken
          since 26.5.0 <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46421\">#&#8203;46421</a>
          Revisit Infinispan session idle and lifetime settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46429\">#&#8203;46429</a>
          Add username to BrokeredIdentityContext created from JWTBearer Grant <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46471\">#&#8203;46471</a>
          Aggregate client-id field for improved Infinispan query </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46494\">#&#8203;46494</a>
          Allow customizing federated identity lookup in JWTAuthorizationGrantType
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46531\">#&#8203;46531</a>
          Consider exposing UUID for admin api v2 resources </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46556\">#&#8203;46556</a>
          For MSSQL Server, set `sendStringParametersAsUnicode` to `false` by default
          <code>storage</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46557\">#&#8203;46557</a>
          Keycloak should check the Unicode setup of the database on startup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46603\">#&#8203;46603</a>
          Add Database CLI options for TLS encryption for databases </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46617\">#&#8203;46617</a>
          MCP Documentation for 26.6 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46626\">#&#8203;46626</a>
          Allow to configure Client Assertion max expiration for Kubernetes Identity
          Provider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46627\">#&#8203;46627</a>
          Allow to configure Client Assertion max expiration for OIDC Identity Provider
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46657\">#&#8203;46657</a>
          Passwords containing `$$` or `${` patterns are mangled when set via environment
          variables (SmallRye expression evaluation) <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46671\">#&#8203;46671</a>
          Allow custom timeouts in DBLockProvider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46689\">#&#8203;46689</a>
          Remove user input reflection in Token Introspection error responses <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46693\">#&#8203;46693</a>
          Group-level deny policies do not block `manage-group-membership` on group
          members <code>admin/fine-grained-permissions</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46699\">#&#8203;46699</a>
          CIMD - Performance: Avoid repeated convertContentFilledList() in verifyUri()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46701\">#&#8203;46701</a>
          CIMD - Performance: Single-pass HTTP Cache-Control header lookup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46703\">#&#8203;46703</a>
          CIMD - Performance: Eliminate double URI parsing in ClientIdUriSchemeCondition.applyPolicy()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46708\">#&#8203;46708</a>
          CIMD - Performance: Avoid streaming the directive list multipul times </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46711\">#&#8203;46711</a>
          Upgrade to Quarkus 3.32.1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46728\">#&#8203;46728</a>
          Use quarkus properties ahead of keycloak defaults or map from values </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46757\">#&#8203;46757</a>
          Upgrade to jackson-core 2.21.1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46765\">#&#8203;46765</a>
          Adding missing question mark </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46781\">#&#8203;46781</a>
          IdP alias is not clickable in organization's Identity Providers tab <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46796\">#&#8203;46796</a>
          Document that export is not a backup </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46809\">#&#8203;46809</a>
          Set a default connection timeout for all databases types </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46872\">#&#8203;46872</a>
          Be more explicit on how to enable OTel Logs and Metrics in Operator <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46874\">#&#8203;46874</a>
          Be more explicit in using the OTel Logs level <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46890\">#&#8203;46890</a>
          Upgrade to Quarkus 3.32.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46936\">#&#8203;46936</a>
          Reduce tightly coupling between client policy contexts and conditions/executors
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46964\">#&#8203;46964</a>
          Adding more Hungarian translations </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46972\">#&#8203;46972</a>
          Clarify credentials field availability in GET /admin/realms/{realm}/users
          documentation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47038\">#&#8203;47038</a>
          Translation support for UI theme descriptions <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47081\">#&#8203;47081</a>
          Upgrade to Quarkus 3.32.3 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47130\">#&#8203;47130</a>
          Upgrade to Quarkus 3.33.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47140\">#&#8203;47140</a>
          Add CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47146\">#&#8203;47146</a>
          Keycloak: no native option to customize JSON log service.name and service.environment
          fields <code>observability</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47163\">#&#8203;47163</a>
          Enhancement: Password denylist file changes should not require server restart
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47187\">#&#8203;47187</a>
          Asynchronous server initialization </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47229\">#&#8203;47229</a>
          Identity Provider redirection via kc_idp_hint in Pushed Authorization Request
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47416\">#&#8203;47416</a>
          Async startup doesn't be enabled when the health check is not enabled </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47535\">#&#8203;47535</a>
          Polishing CNPG installation docs </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47667\">#&#8203;47667</a>
          Update release-notes for CIMD </li>\n</ul>\n\n<h3>Bugs</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/22569\">#&#8203;22569</a>
          Provide descriptions for default realm-management roles <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/26946\">#&#8203;26946</a>
          Multiple protocolMappers with the same name. <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/28970\">#&#8203;28970</a>
          Documention about the default db-schema is ambiguous <code>docs</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/36593\">#&#8203;36593</a>
          Built-in authentication flows are not updated for KC 26 <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/37231\">#&#8203;37231</a>
          Set New Password Multiple Times via Password Reset Function <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38991\">#&#8203;38991</a>
          [Test framework] Embedded server -> dependency download error when no version
          is specified <code>test-framework</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/39127\">#&#8203;39127</a>
          Incorrect return code with JWT algorithm set to none <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40510\">#&#8203;40510</a>
          Organization flow do not redirect when credentials exist <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40753\">#&#8203;40753</a>
          Resource leak: FileInputStream in Util.readProperties(File) is never closed
          .SAST <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40921\">#&#8203;40921</a>
          Reject invalid resource IDs in permission creation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41165\">#&#8203;41165</a>
          Feishu login has been continuously failing as an identity provider <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41630\">#&#8203;41630</a>
          Warning log message SRCFG01008: The value default has been converted by
          a Boolean Converter to \"false\" <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41924\">#&#8203;41924</a>
          Internal server error after changing Admin UI theme to \"base\" - An old,
          persisted problem <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42222\">#&#8203;42222</a>
          Federation Cache Policy details not shown when editing provider in Keycloak
          26.3+ <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42836\">#&#8203;42836</a>
          Organization selection changes after token refresh <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42839\">#&#8203;42839</a>
          UserInfo endpoint returns incorrect organization claim <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43198\">#&#8203;43198</a>
          Operator status patching of keycloak failed <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43201\">#&#8203;43201</a>
          entity mappings not working on 26.4 <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43356\">#&#8203;43356</a>
          Keycloak tests framework - issue to identify distribution directory inside
          ZIP file when version string uses suffix <code>test-framework</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43613\">#&#8203;43613</a>
          case insensitive match on organization identity provider domain - In case
          'ANY' option is chosen <code>organizations</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43726\">#&#8203;43726</a>
          Slow evaluation of client roles with dots for role mapper and others <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43757\">#&#8203;43757</a>
          Code Examples in Authentication SPI Documentation Don't Match Quickstarts
          Repository <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43854\">#&#8203;43854</a>
          OID4VCI credentials have invalid subject id value <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43949\">#&#8203;43949</a>
          MultivaluedString in mappers is not saved to backend with shown default
          value <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43991\">#&#8203;43991</a>
          Keycloak operator - Reconciliation failure <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44099\">#&#8203;44099</a>
          Out of memory after 3-4 restarts of embedded server <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44100\">#&#8203;44100</a>
          Issue with starting server results in connection refused exception in test
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44132\">#&#8203;44132</a>
          Bug -> Keycloak preview feature \"scripts\" is enabled by default <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44283\">#&#8203;44283</a>
          Flaky test: org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test06_addingUserToNewKeycloakGroup
          <code>ci</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44403\">#&#8203;44403</a>
          DCR endpoint ignores client's requested token_endpoint_auth_method <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44425\">#&#8203;44425</a>
          [Keycloak JS CI] Admin UI E2E Firefox failure <code>ci</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44498\">#&#8203;44498</a>
          [quick-theme] Logo and Favicon problem <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44574\">#&#8203;44574</a>
          Unable to find contextual data of type: org.keycloak.models.KeycloakSession
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44598\">#&#8203;44598</a>
          SAML user created with null username when mapped attribute missing <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44622\">#&#8203;44622</a>
          OID4VCI functionality should be disabled for the realm when \"Verified Credentials\"
          switch is disabled <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44637\">#&#8203;44637</a>
          Fail to import the realm with OID4VCI enabled <code>import-export</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44670\">#&#8203;44670</a>
          CredentialEndpoint can be invoked with incorrect access token <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44678\">#&#8203;44678</a>
          Inconsistent search when using wildcards <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44699\">#&#8203;44699</a>
          Not able to find key for credential signature if client scope was saved
          from admin console <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44737\">#&#8203;44737</a>
          CredentialRequest requires that client scope is assigned as 'Optional' <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44784\">#&#8203;44784</a>
          link to reset-credentials ignores default locale AND ui_locales <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44803\">#&#8203;44803</a>
          Unhandled IllegalArgumentException in SAMLRequestParser <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44807\">#&#8203;44807</a>
          [OID4VCI] Default values are not set for ClientScope <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44819\">#&#8203;44819</a>
          Missing validation error label on UI when editing a user <code>user-profile</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44824\">#&#8203;44824</a>
          Keycloak retains mapped firstName value and does not nullify it when upstream
          identity provider stops sending the claim <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44875\">#&#8203;44875</a>
          [OID4VCI] CredentialSignerException: Proof Type null is not supported for
          format ldp_vc <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44905\">#&#8203;44905</a>
          Email is not updated based on upstream IdP email <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44961\">#&#8203;44961</a>
          Authorization_details added to token-response even when should not be <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45005\">#&#8203;45005</a>
          [OID4VCI] Revisit and fix /credential_offer_uri endpoint  <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45058\">#&#8203;45058</a>
          Base theme: \"user properties\" and \"register\" required mark is\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Enabled.\n\n\u267B **Rebasing**: Whenever
          PR is behind base branch, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/YAKEcloud/yake-ansible).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/YAKEcloud/yake-ansible/pull/582
        commit_id: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        patchset: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        project:
          canonical_hostname: github.com
          canonical_name: github.com/YAKEcloud/yake-ansible
          name: YAKEcloud/yake-ansible
          short_name: yake-ansible
        src_dir: src/github.com/YAKEcloud/yake-ansible
        topic: null
      buildset: d008f5b03c314665a1c5489e94f77add
      buildset_refs:
      - branch: main
        change: '582'
        change_message: "chore(deps): update dependency keycloak/keycloak to v26.6.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [keycloak/keycloak](https://redirect.github.com/keycloak/keycloak)
          | minor | `26.5.7` \u2192 `26.6.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>keycloak/keycloak
          (keycloak/keycloak)</summary>\n\n### [`v26.6.0`](https://redirect.github.com/keycloak/keycloak/releases/tag/26.6.0)\n\n[Compare
          Source](https://redirect.github.com/keycloak/keycloak/compare/26.5.7...26.6.0)\n\n<div>\n
          \   <h2>Highlights</h2>\n<div class=\"paragraph\">\n<p>This release features
          new capabilities for users and administrators of Keycloak. The highlights
          of this release are:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><strong>JWT
          Authorization Grant</strong>, enabling external-to-internal token exchange
          using externally signed JWT assertions.</p>\n</li>\n<li>\n<p><strong>Federated
          client authentication</strong>, eliminating the need to manage individual
          client secrets in Keycloak.</p>\n</li>\n<li>\n<p><strong>Workflows</strong>,
          enabling administrators to automate realm administrative tasks such as user
          and client lifecycle management.</p>\n</li>\n<li>\n<p><strong>Zero-downtime
          patch releases</strong>, allowing rolling updates within a minor release
          stream without service downtime.</p>\n</li>\n<li>\n<p>The <strong>Keycloak
          Test Framework</strong>, replacing the previous Arquillian-based solution.</p>\n</li>\n</ul>\n</div>\n<div
          class=\"paragraph\">\n<p>All of these features are now fully supported and
          no longer in preview.\nRead on to learn more about each new feature.\nIf
          you are upgrading from a previous release, <a href=\"https://www.keycloak.org/docs/latest/upgrading/index.html\">also
          review the changes listed in the upgrading guide</a>.</p>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_security_and_standards\">Security and Standards</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_jwt_authorization_grant_supported\">JWT Authorization
          Grant (supported)</h4>\n<div class=\"paragraph\">\n<p>JWT Authorization
          Grant (<a href=\"https://datatracker.ietf.org/doc/html/rfc7523\">RFC 7523</a>)
          is designed to implement external-to-internal token exchange use cases.
          This grant allows using externally signed JWT assertions to request OAuth
          2.0 access tokens.</p>\n</div>\n<div class=\"paragraph\">\n<p>In this release,
          JWT Authorization Grant is promoted from preview to supported. See the <a
          href=\"https://www.keycloak.org/securing-apps/jwt-authorization-grant\">JWT
          Authorization Grant guide</a> for additional details.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_federated_client_authentication_supported\">Federated
          client authentication (supported)</h4>\n<div class=\"paragraph\">\n<p>Federated
          client authentication allows clients to leverage existing credentials once
          a trust relationship with another issuer exists. It eliminates the need
          to assign and manage individual secrets for each client in Keycloak.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Federated client authentication is now promoted
          to supported, including support for client assertions issued by external
          OpenID Connect identity providers and Kubernetes Service Accounts.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Since the OAuth SPIFFE Client Authentication specification
          is still in draft status, this feature remains a preview feature in Keycloak.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_guide_about_demonstrating_proof_of_possession_dpop\">New
          guide about Demonstrating Proof-of-Possession (DPoP)</h4>\n<div class=\"paragraph\">\n<p>A
          new guide for OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) in the
          Securing applications Guides provides information on how to mitigate the
          risk of stolen tokens by making tokens sender-constrained.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/nightly/securing-apps/dpop\">Securing
          applications with DPoP</a> for more details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_identity_brokering_apis_v2_preview\">Identity Brokering APIs V2 (preview)</h4>\n<div
          class=\"paragraph\">\n<p>A new preview version 2 for the Identity Brokering
          APIs is introduced in this release. When brokering is used during the authentication
          process, Keycloak allows you to store tokens and responses issued by the
          external Identity Provider. Applications can call a specific endpoint to
          retrieve those tokens, which, in turn, can be used to get extra user information
          or invoke endpoints in the external trust domain. The new version improves
          the token retrieval endpoint to substitute the internal to external Token
          Exchange (use case for the <a href=\"https://www.keycloak.org/securing-apps/token-exchange#_legacy-token-exchange\">legacy
          Token Exchange V1</a>).</p>\n</div>\n<div class=\"paragraph\">\n<p>For more
          information, see the chapter <a href=\"https://www.keycloak.org/docs/26.6.0/server_development/#_identity-brokering-apis\">Identity
          Brokering APIs</a> in the Server Developer Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_step_up_authentication_for_saml_preview\">Step-up
          authentication for SAML (preview)</h4>\n<div class=\"paragraph\">\n<p>The
          feature <code>step-up-authentication-saml</code> extends the step-up authentication
          to include the SAML protocol and clients. This feature is in preview mode.
          Additional information is available in the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_step-up-authentication-saml\">Server
          Administration Guide</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_oauth_client_id_metadata_document_experimental\">OAuth Client ID Metadata
          Document (experimental)</h4>\n<div class=\"paragraph\">\n<p><a href=\"https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-01.html\">OAuth
          Client ID Metadata Document (CIMD)</a> is an emerging standard that defines
          a JSON document format for describing OAuth 2.0 client metadata. Since version
          2025-11-25, the Model Context Protocol (MCP) requires an authorization server
          to comply with CIMD. Keycloak now includes experimental support for CIMD,
          allowing it to serve as an authorization server for MCP version 2025-11-25
          or later.</p>\n</div>\n<div class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/securing-apps/mcp-authz-server\">Integrating
          with Model Context Protocol (MCP)</a> for the updated guide including CIMD.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Many thanks to <a href=\"https://redirect.github.com/tnorimat\">Takashi
          Norimatsu</a> for the contribution.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_administration\">Administration</h3>\n<div class=\"sect3\">\n<h4 id=\"_workflows_supported\">Workflows
          (supported)</h4>\n<div class=\"paragraph\">\n<p>Workflows allow administrators
          to automate and orchestrate realm administrative tasks, bringing key capabilities
          of Identity Governance and Administration (IGA) to Keycloak. By defining
          workflows in YAML format, you can automate the lifecycle of realm resources
          such as users and clients based on events, conditions, and schedules.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>In this release, Workflows is promoted from preview
          to supported. This release also includes new built-in steps, a troubleshooting
          guide, and various improvements to the workflow engine.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_workflows\">Managing
          workflows</a> chapter in the Server Administration Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_organization_groups\">Organization groups</h4>\n<div
          class=\"paragraph\">\n<p>Organizations now support isolated group hierarchies,
          allowing each organization to manage its own teams and departments without
          naming conflicts across the realm. This update includes Identity Provider
          mappers to automatically assign federated users to organization groups based
          on external claims. Group membership is automatically included in OIDC tokens
          and SAML assertions when an organization context is requested.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_groups_\">Managing
          organization groups</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_new_groups_scope_for_user_membership_changes\">New Groups scope for
          user membership changes</h4>\n<div class=\"paragraph\">\n<p>Fine-Grained
          Admin Permissions (FGAP) now includes a new <code>Groups</code> scope: <code>manage-membership-of-members</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>This scope is now used as the group-side bridge
          for evaluating user-side <code>manage-group-membership</code> permissions
          based on a user&#&#8203;8217;s current group memberships.\nThe existing
          <code>manage-membership</code> scope keeps its current behavior for target
          group membership management operations.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_looking_up_client_secrets_via_the_vault_spi\">Looking up client secrets
          via the Vault SPI</h4>\n<div class=\"paragraph\">\n<p>Secrets for clients
          can now be managed and looked up by the Vault SPI.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank
          you to <a href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for
          contributing this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_forcing_password_change_for_ldap_users\">Forcing password change for
          LDAP users</h4>\n<div class=\"paragraph\">\n<p>There is now initial support
          for LDAP password policy control.\nThe support is limited to prompting users
          to update their password when the LDAP server indicates that the password
          must be changed.\nPreviously, Keycloak let the user in and ignored the mandatory
          password reset.\nThere is a new optional setting &#&#8203;8220;Enable LDAP
          password policy&#&#8203;8221; in the LDAP advanced settings to enable this.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
          Saarni</a> for contributing this change.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_configuring_and_running\">Configuring and Running</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_java_25_support\">Java 25 support</h4>\n<div
          class=\"paragraph\">\n<p>Keycloak now supports running with OpenJDK 25.\nThe
          server container image continues to use OpenJDK 21 for now to support FIPS
          mode. For details, see the\nnote in the FIPS guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_zero_downtime_patch_releases_supported\">Zero-downtime
          patch releases (supported)</h4>\n<div class=\"paragraph\">\n<p>Zero-downtime
          patch releases allow you to perform rolling updates when upgrading to a
          newer patch version within the same <code>major.minor</code> release stream
          without service downtime.</p>\n</div>\n<div class=\"paragraph\">\n<p>In
          this release, zero-downtime patch releases are promoted to supported and
          enabled by default.\nWhen using the Keycloak Operator, set the update strategy
          to <code>Auto</code> to benefit from this functionality.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details on the Operator configuration,
          see the <a href=\"https://www.keycloak.org/operator/rolling-updates\">Avoiding
          downtime with rolling updates</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_installation_instructions_for_cloudnativepg\">Installation instructions
          for CloudNativePG</h4>\n<div class=\"paragraph\">\n<p>For those running
          Keycloak on Kubernetes, there is now a guide on how to deploy a PostgreSQL
          database on Kubernetes by leveraging the CloudNativePG Operator and how
          to connect Keycloak to the database.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          <a href=\"https://www.keycloak.org/nightly/high-availability/single-cluster/deploy-cnpg\">Deploying
          CloudNativePG in multiple availability zones</a> in the High Availability
          Guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_simplified_database_operations\">Simplified
          database operations</h4>\n<div class=\"paragraph\">\n<p>Several new command
          line options simplify the database operations for Keycloak and remove the
          need to use raw JDBC connection options:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p>Configure
          TLS for the database connection.</p>\n</li>\n<li>\n<p>Database connection
          timeouts.</p>\n</li>\n<li>\n<p>Transaction timeouts with production-ready
          defaults.</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>It also
          verifies the correct UTF-8 character encoding of the database at startup
          and prints a warning if this is not the case.</p>\n</div>\n<div class=\"paragraph\">\n<p>When
          running on orchestrators like Kubernetes, the startup and liveness probes
          return UP during database migrations, simplifying upgrades by removing the
          need to adjust the probes during upgrades.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          the migration guide for additional details on each aspect.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_graceful_shutdown_of_http_stack\">Graceful shutdown
          of HTTP stack</h4>\n<div class=\"paragraph\">\n<p>To allow rolling updates
          for configuration changes or version updates, a graceful shutdown of Keycloak
          nodes prevents users from seeing error responses when logging in or refreshing
          their tokens when nodes shut down.</p>\n</div>\n<div class=\"paragraph\">\n<p>Starting
          with this version, Keycloak supports a graceful shutdown of the HTTP stack.\nThis
          includes delaying a shutdown after receiving a termination signal, connection
          draining for HTTP/1.1 and HTTP/2 connections during that period, and a shutdown
          timeout to finish ongoing requests.</p>\n</div>\n<div class=\"paragraph\">\n<p>The
          defaults are a shutdown delay and a shutdown timeout of one second each.\nThis
          should be a good fit for setups where the reverse proxy is using TLS edge
          termination or re-encryption and the reverse proxy is notified about the
          Keycloak node shutting down at the same time as the Keycloak node.\nThis
          is a common setup, for example, in Kubernetes environments.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Users should adjust those values depending on their
          proxy setup.\nSee the section <a href=\"https://www.keycloak.org/server/reverseproxy#graceful-http-shutdown\">Graceful
          HTTP shutdown</a> in the reverse proxy guide for more information.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_kcraw_prefix_for_environment_variables_to_preserve_literal_values\">New
          <code>KCRAW_</code> prefix for environment variables to preserve literal
          values</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports a <code>KCRAW_</code>
          prefix for environment variables to preserve values containing <code>$</code>
          characters exactly as written, without expression evaluation.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>When using the standard <code>KC_</code> prefix,
          Keycloak (via SmallRye Config) evaluates expressions in values (for example,
          <code>${some_key}</code> is resolved and <code>$$</code> is collapsed to
          <code>$</code>).\nThis can silently modify passwords or secrets injected
          by a secrets manager or orchestration tool where manual escaping is not
          feasible.</p>\n</div>\n<div class=\"paragraph\">\n<p>Setting <code>KCRAW_&lt;KEY&gt;</code>
          instead of <code>KC_&lt;KEY&gt;</code> preserves the value exactly as provided.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See the <a href=\"https://www.keycloak.org/server/configuration#kcraw-prefix\">Preserving
          literal values with the KCRAW_ prefix</a> section in the Server Configuration
          guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_reload_of_lists_with_disallowed_passwords\">Automatic
          reload of lists with disallowed passwords</h4>\n<div class=\"paragraph\">\n<p>When
          a list of disallowed passwords (also known as blacklist) changes, it is
          automatically reloaded. This avoids the need for a server restart when the
          list changes.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank you to <a
          href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for contributing
          this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_truststore_initialization_on_kubernetes_and_openshift\">Automatic
          truststore initialization on Kubernetes and OpenShift</h4>\n<div class=\"paragraph\">\n<p>Keycloak
          now automatically discovers and trusts cluster certificate authorities when
          running on Kubernetes or OpenShift, without requiring the Operator to preconfigure
          the truststore.</p>\n</div>\n<div class=\"paragraph\">\n<p>If present in
          the container filesystem, the following certificates are added to the system
          truststore at startup:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code>
          (Kubernetes service account CA)</p>\n</li>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt</code>
          (OpenShift service CA)</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>This
          behavior is enabled by default and can be controlled with the server option
          <code>--truststore-kubernetes-enabled=true|false</code> (default: <code>true</code>).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Most deployments do not require any action. If
          you relied on the Operator to manage these truststore entries previously,
          the server now performs the same function directly.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_client_certificate_lookup_providers_for_traefik_and_envoy\">Client
          certificate lookup providers for Traefik and Envoy</h4>\n<div class=\"paragraph\">\n<p>You
          can now use new client certificate lookup providers for Traefik and Envoy
          proxies.\nFor details, see the <a href=\"https://www.keycloak.org/server/reverseproxy#_enabling_client_certificate_lookup\">Enabling
          Client Certificate Lookup</a> section of the documentation.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_configurable_kubernetes_service_name_and_port_in_the_keycloak_operator\">Configurable
          Kubernetes Service name and port in the Keycloak Operator</h4>\n<div class=\"paragraph\">\n<p>The
          Keycloak Operator now supports overriding the name and port of the Kubernetes
          Service it creates for a Keycloak deployment.</p>\n</div>\n<div class=\"paragraph\">\n<p>Previously,
          the Service name was always derived as <code>&lt;cr-name&gt;-service</code>
          and the Service port always matched the container port.\nYou can now use
          the <code>spec.http.serviceName</code>, <code>spec.http.serviceHttpsPort</code>,
          and <code>spec.http.serviceHttpPort</code> fields to\nconfigure these independently.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration\">Advanced
          configuration</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_sensitive_information_is_not_displayed_in_the_http_access_log\">Sensitive
          information is not displayed in the HTTP Access log</h4>\n<div class=\"paragraph\">\n<p>If
          you are using the HTTP Access logging capability, sensitive information
          is omitted.\nThis means that tokens in the 'Authorization' HTTP header and
          specific sensitive cookies are not shown.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_configurable_log_file_rotation\">Configurable log file rotation</h4>\n<div
          class=\"paragraph\">\n<p>It is now possible to configure log file rotation
          when using Keycloak&#&#8203;8217;s built-in file logging handler.\nThis
          includes a simple option to fully disable log rotation, which is useful
          when using an external log rotation solution such as <code>logrotate</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>To disable log file rotation:</p>\n</div>\n<div
          class=\"listingblock\">\n<div class=\"content\">\n<pre class=\"highlight\"><code
          class=\"language-bash\" data-lang=\"bash\">bin/kc.sh start --log=\"console,file\"
          --log-file-rotation-enabled=false</code></pre>\n</div>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see the <a href=\"https://www.keycloak.org/server/logging/file\">File
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_http_access_logs_in_a_dedicated_file\">HTTP
          access logs in a dedicated file</h4>\n<div class=\"paragraph\">\n<p>HTTP
          access logs can now be written to a dedicated file, separate from the server
          logs.\nThis makes it easier to process and archive access logs independently
          for security auditing and compliance monitoring.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_customizable_service_fields_in_json_log_output\">Customizable service
          fields in JSON log output</h4>\n<div class=\"paragraph\">\n<p>Keycloak now
          provides native options to customize the <code>service.name</code> and <code>service.environment</code>
          fields in JSON log output across all log handlers (console, file, and syslog).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Previously, when using the ECS format, <code>service.name</code>
          and <code>service.environment</code> could not be overridden through Keycloak
          configuration.\nThis made it difficult to align JSON log fields with OpenTelemetry
          resource attributes.</p>\n</div>\n<div class=\"paragraph\">\n<p>You can
          now set these fields using <code>log-service-name</code> and <code>log-service-environment</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more information, see the <a href=\"https://www.keycloak.org/server/logging#customize-service-fields\">Configuring
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_new_and_updated_translations\">New
          and updated translations</h4>\n<div class=\"paragraph\">\n<p>New translations
          for Indonesian and Armenian were added. A warm welcome to the new language
          maintainers for these languages!\nThere are also new language maintainers
          for the Swedish translation, who translated all remaining message keys.
          Thank you so much!</p>\n</div>\n<div class=\"paragraph\">\n<p>Follow the
          translation progress on the <a href=\"https://www.keycloak.org/translations\">translation
          status page</a>, help translate, and read the translation guide on how to
          add additional languages.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_right_to_left_language_support_in_the_account_ui\">Right-to-left language
          support in the Account UI</h4>\n<div class=\"paragraph\">\n<p>Support for
          right-to-left (RTL) languages was added to the Login UI, Admin UI, and email
          templates several releases ago. This release adds initial RTL support to
          the Account UI, which completes this effort.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_observability\">Observability</h3>\n<div class=\"sect3\">\n<h4
          id=\"_telemetry_configuration_via_the_keycloak_cr\">Telemetry configuration
          via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports
          configuring the OpenTelemetry properties via the Keycloak CR when using
          the Operator.\nThese properties are shared among the available OpenTelemetry
          components - logs, metrics, and traces.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_custom_request_headers_for_opentelemetry\">Custom
          request headers for OpenTelemetry</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to set request headers for exporting telemetry via OpenTelemetry
          Protocol (OTLP).\nThis is mainly useful for providing tokens in the request.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>You can specify these headers via the <code>telemetry-header-&lt;header&gt;</code>
          wildcard option, which accepts any custom header name.\nAlternatively, use
          <code>telemetry-logs-header-&lt;header&gt;</code> for OpenTelemetry Logs
          or <code>telemetry-metrics-header-&lt;header&gt;</code> for OpenTelemetry
          Metrics.</p>\n</div>\n<div class=\"paragraph\">\n<p>For more details, see
          the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_service_monitor_annotations_and_labels_via_the_keycloak_cr\">Service
          Monitor annotations and labels via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to configure service monitor labels and annotations via
          the Keycloak CR when using the Operator.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration#_servicemonitor\">Advanced
          Configuration Operator</a> guide.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_extension_development\">Extension Development</h3>\n<div class=\"sect3\">\n<h4
          id=\"_keycloak_test_framework_supported\">Keycloak Test Framework (supported)</h4>\n<div
          class=\"paragraph\">\n<p>The Keycloak Test Framework, based on JUnit 6,
          is now fully supported.</p>\n</div>\n<div class=\"paragraph\">\n<p>It replaces
          the previous solution built on top of Arquillian and JUnit 4.\nBehind the
          scenes, the framework handles the lifecycle of Keycloak, the database, and
          any injected resources such as realms and clients.</p>\n</div>\n<div class=\"paragraph\">\n<p>Tests
          simply declare what they want, including specific configuration, and the
          framework takes care of the rest.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://redirect.github.com/keycloak/keycloak/tree/main/test-framework#readme\">Keycloak
          Test Framework</a>.</p>\n</div>\n</div>\n</div>\n<h2>Upgrading</h2>\n<p>Before
          upgrading refer to <a href=\"https://www.keycloak.org/docs/latest/upgrading/#migration-changes\">the
          migration guide</a> for a complete list of changes.</p>\n\n<h2>All resolved
          issues</h2>\n\n<h3>Deprecated features</h3>\n<ul>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45156\">#&#8203;45156</a>
          Deprecate Token Exchange v1 </li>\n</ul>\n\n<h3>New features</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10155\">#&#8203;10155</a>
          Step-up authentication for SAML clients <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/13102\">#&#8203;13102</a>
          Add support for specifying `client.secret` using vault <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/39888\">#&#8203;39888</a>
          Workflows </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42634\">#&#8203;42634</a>
          Federated client authentication </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43144\">#&#8203;43144</a>
          OAuth Identity and Authorization Chaining Across Domains </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43146\">#&#8203;43146</a>
          New test framework </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43152\">#&#8203;43152</a>
          Authorization Grants </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43252\">#&#8203;43252</a>
          Zero-downtime upgrades between patch releases of Keycloak </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43257\">#&#8203;43257</a>
          Support a Kubernetes Native Database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43507\">#&#8203;43507</a>
          Add support for Organization-specific Groups </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43576\">#&#8203;43576</a>
          Authorization grant for social providers <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44833\">#&#8203;44833</a>
          [OID4VCI] Make natural_person configuration available in all formats <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45106\">#&#8203;45106</a>
          OAuth Client ID Metadata Document </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45284\">#&#8203;45284</a>
          CIMD - Persistent CIMD <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46633\">#&#8203;46633</a>
          keycloak operator: add support for different port and name for the kubernetes
          service definition in the keycloak CRD </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47011\">#&#8203;47011</a>
          Add debug helper utility to the test framework <code>test-framework</code></li>\n</ul>\n\n<h3>Enhancements</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10618\">#&#8203;10618</a>
          Enhancements to logging config <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/14523\">#&#8203;14523</a>
          Add support for enforced password change with LDAP federation <code>ldap</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/17904\">#&#8203;17904</a>
          Support RTL UI <code>account/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/19374\">#&#8203;19374</a>
          Allow absolute path for cache-config-file? <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/19453\">#&#8203;19453</a>
          The default database transaction timeout should not be applied to Liquibase
          or data migrations <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/20618\">#&#8203;20618</a>
          Support enabling access logs <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/27986\">#&#8203;27986</a>
          Remove Liquibase dependency version from Keycloak root pom </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33160\">#&#8203;33160</a>
          Add support for X509 client certificate lookup for Envoy </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/33198\">#&#8203;33198</a>
          Introduce `resourcesCommonUrl` for E-Mail templates <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33818\">#&#8203;33818</a>
          Request for Enhancement: Make x509cert-lookup SPI public </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/34435\">#&#8203;34435</a>
          OTEL: Add tracing ID to user facing error message <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/35298\">#&#8203;35298</a>
          Reverse proxy provided context path not working despite setting X-Forwarded-Prefix
          header <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36226\">#&#8203;36226</a>
          Provide a read only view of Identity Provider Mappers configuration screen
          to the Keycloak Admin UI </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36710\">#&#8203;36710</a>
          Have a first-class CLI option to change Keycloak's transaction timeout <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38884\">#&#8203;38884</a>
          Upgrade command rolling updates for patch releases / step 3: Infinispan/JGroups
          support </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/38888\">#&#8203;38888</a>
          Avoid breaking DB changes during patch releases </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40902\">#&#8203;40902</a>
          More fully document operator upgrade scenarios, in particular with custom
          images <code>docs</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41330\">#&#8203;41330</a>
          Improve logging of JpaUserSessionPersisterProvider#expire </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41353\">#&#8203;41353</a>
          Provide HTTP access logs written to file with rotation <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41629\">#&#8203;41629</a>
          Remove Tracing workaround in Infinispan/JGroups classes </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42256\">#&#8203;42256</a>
          DB Connection Pool acquisition timeout errors on database failover  <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42626\">#&#8203;42626</a>
          Provide a way to add custom labels to generated ServiceMonitor </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42747\">#&#8203;42747</a>
          Make DPoP docs more detailed <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42876\">#&#8203;42876</a>
          dev mode should bind only to localhost if possible </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42900\">#&#8203;42900</a>
          Move the logic of scanning Kubernetes CA to Keycloak <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43589\">#&#8203;43589</a>
          Gracefully shutting down HTTP stack </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43701\">#&#8203;43701</a>
          Improve SimpleHttp API <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43829\">#&#8203;43829</a>
          Add createdTimestamp filter (before/after) to /admin/realms/{realm}/users
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44090\">#&#8203;44090</a>
          ErrorId for error screens and logging </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44101\">#&#8203;44101</a>
          Allow re-using server when running tests with the new framework </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44364\">#&#8203;44364</a>
          Improve client creation with PKCE in admin console <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44424\">#&#8203;44424</a>
          findClientSessionsClientIds performance issue <code>storage</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44459\">#&#8203;44459</a>
          Adding the log to the required action to show the cause of syntax violation
          of the LDAP policy <code>ldap</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44846\">#&#8203;44846</a>
          [OID4VCI]: Ensure OID4VCI optional fields are saved cleanly and use defaults
          <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44849\">#&#8203;44849</a>
          [OID4VCI] Add UI support for `vc.credential_signing_alg` in OID4VCI client
          scopes <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44973\">#&#8203;44973</a>
          Hide Remember Me session settings when Remember Me is disabled in realm
          login settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45006\">#&#8203;45006</a>
          [OID4VCI] Add support for user did as subject id <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45188\">#&#8203;45188</a>
          Upgrade to quarkus 3.30.5 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45220\">#&#8203;45220</a>
          OTEL: Ability to specify headers for exporters <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45231\">#&#8203;45231</a>
          [OID4VCI] Generate pre-authorized codes using the JWT format <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45254\">#&#8203;45254</a>
          Admin UI javascript bundle should have source mapping </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45278\">#&#8203;45278</a>
          Upgrade to Quarkus 3.33.x LTS </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45281\">#&#8203;45281</a>
          Add missing Swedish translations for admin theme messages <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45322\">#&#8203;45322</a>
          Linking user with idp fails with generic message if user is already linked
          <code>identity-brokering</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45337\">#&#8203;45337</a>
          Upgrade to Quarkus 3.31 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45348\">#&#8203;45348</a>
          OTEL: Add Telemetry options to Keycloak CR <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45360\">#&#8203;45360</a>
          Document that the the HA architectures are tested with Openshift 4.18 </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45467\">#&#8203;45467</a>
          Management interface endpoint lists available endpoints <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45620\">#&#8203;45620</a>
          Change default not-before validation to 10 second instead of 0 <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45623\">#&#8203;45623</a>
          Avoid unnecessary warning logs during the operator tests execution <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45629\">#&#8203;45629</a>
          HTTP access log written to file should be in a separate directory <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45689\">#&#8203;45689</a>
          When a user joins a role or group, it should not read all existing roles
          and groups from the database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45704\">#&#8203;45704</a>
          Invite existing users from Admin UI <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45718\">#&#8203;45718</a>
          Improve error message when organization name cannot be used as alias </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45795\">#&#8203;45795</a>
          Promote Keycloak and KeycloakRealmImport CRDs to v2beta1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45841\">#&#8203;45841</a>
          Add revert button to client credentials page </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45880\">#&#8203;45880</a>
          SAMLEndpoint - increase extensibility by increasing accessibility of some
          private fields/methods </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45882\">#&#8203;45882</a>
          Use GroupResource context in Groups so that Group components can be reused
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45884\">#&#8203;45884</a>
          Testframework core has dependency on testcontainers </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45898\">#&#8203;45898</a>
          Supported Configurations guide </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45909\">#&#8203;45909</a>
          Add theme clarification blurb to Realm Settings <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45941\">#&#8203;45941</a>
          Do not use deprecated test containers in tests <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45944\">#&#8203;45944</a>
          OTEL: Use suggested 'code.function.name' for span attributes <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45965\">#&#8203;45965</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45992\">#&#8203;45992</a>
          Clarify operator instructions involving Wildcard certificates and OpenShift
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45996\">#&#8203;45996</a>
          Enforce `LF` line endings on `*.tsx` files with `.gitattributes` </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45999\">#&#8203;45999</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46001\">#&#8203;46001</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46043\">#&#8203;46043</a>
          Upgrade to Quarkus 3.31.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46055\">#&#8203;46055</a>
          [OID4VCI] Confine test realm setup to TestCase.configureTestRealm() </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46156\">#&#8203;46156</a>
          Add node count and next-node selection to LoadBalancer API </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46164\">#&#8203;46164</a>
          Separate password and OTP brute force protection to prevent OTP bypass attacks
          by default </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46255\">#&#8203;46255</a>
          Upgrade to Quarkus 3.32.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46292\">#&#8203;46292</a>
          Allow to expose WellKnown provider via ServerMetadataResource </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46304\">#&#8203;46304</a>
          SPIFFE Identity Provider default TTL too low </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46355\">#&#8203;46355</a>
          [OID4VCI] Add support for CredentialScopeRepresentation <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46395\">#&#8203;46395</a>
          X509 Certificates passed from Traefik PassTlsClientCert middleware broken
          since 26.5.0 <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46421\">#&#8203;46421</a>
          Revisit Infinispan session idle and lifetime settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46429\">#&#8203;46429</a>
          Add username to BrokeredIdentityContext created from JWTBearer Grant <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46471\">#&#8203;46471</a>
          Aggregate client-id field for improved Infinispan query </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46494\">#&#8203;46494</a>
          Allow customizing federated identity lookup in JWTAuthorizationGrantType
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46531\">#&#8203;46531</a>
          Consider exposing UUID for admin api v2 resources </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46556\">#&#8203;46556</a>
          For MSSQL Server, set `sendStringParametersAsUnicode` to `false` by default
          <code>storage</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46557\">#&#8203;46557</a>
          Keycloak should check the Unicode setup of the database on startup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46603\">#&#8203;46603</a>
          Add Database CLI options for TLS encryption for databases </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46617\">#&#8203;46617</a>
          MCP Documentation for 26.6 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46626\">#&#8203;46626</a>
          Allow to configure Client Assertion max expiration for Kubernetes Identity
          Provider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46627\">#&#8203;46627</a>
          Allow to configure Client Assertion max expiration for OIDC Identity Provider
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46657\">#&#8203;46657</a>
          Passwords containing `$$` or `${` patterns are mangled when set via environment
          variables (SmallRye expression evaluation) <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46671\">#&#8203;46671</a>
          Allow custom timeouts in DBLockProvider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46689\">#&#8203;46689</a>
          Remove user input reflection in Token Introspection error responses <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46693\">#&#8203;46693</a>
          Group-level deny policies do not block `manage-group-membership` on group
          members <code>admin/fine-grained-permissions</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46699\">#&#8203;46699</a>
          CIMD - Performance: Avoid repeated convertContentFilledList() in verifyUri()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46701\">#&#8203;46701</a>
          CIMD - Performance: Single-pass HTTP Cache-Control header lookup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46703\">#&#8203;46703</a>
          CIMD - Performance: Eliminate double URI parsing in ClientIdUriSchemeCondition.applyPolicy()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46708\">#&#8203;46708</a>
          CIMD - Performance: Avoid streaming the directive list multipul times </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46711\">#&#8203;46711</a>
          Upgrade to Quarkus 3.32.1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46728\">#&#8203;46728</a>
          Use quarkus properties ahead of keycloak defaults or map from values </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46757\">#&#8203;46757</a>
          Upgrade to jackson-core 2.21.1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46765\">#&#8203;46765</a>
          Adding missing question mark </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46781\">#&#8203;46781</a>
          IdP alias is not clickable in organization's Identity Providers tab <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46796\">#&#8203;46796</a>
          Document that export is not a backup </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46809\">#&#8203;46809</a>
          Set a default connection timeout for all databases types </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46872\">#&#8203;46872</a>
          Be more explicit on how to enable OTel Logs and Metrics in Operator <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46874\">#&#8203;46874</a>
          Be more explicit in using the OTel Logs level <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46890\">#&#8203;46890</a>
          Upgrade to Quarkus 3.32.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46936\">#&#8203;46936</a>
          Reduce tightly coupling between client policy contexts and conditions/executors
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46964\">#&#8203;46964</a>
          Adding more Hungarian translations </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46972\">#&#8203;46972</a>
          Clarify credentials field availability in GET /admin/realms/{realm}/users
          documentation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47038\">#&#8203;47038</a>
          Translation support for UI theme descriptions <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47081\">#&#8203;47081</a>
          Upgrade to Quarkus 3.32.3 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47130\">#&#8203;47130</a>
          Upgrade to Quarkus 3.33.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47140\">#&#8203;47140</a>
          Add CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47146\">#&#8203;47146</a>
          Keycloak: no native option to customize JSON log service.name and service.environment
          fields <code>observability</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47163\">#&#8203;47163</a>
          Enhancement: Password denylist file changes should not require server restart
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47187\">#&#8203;47187</a>
          Asynchronous server initialization </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47229\">#&#8203;47229</a>
          Identity Provider redirection via kc_idp_hint in Pushed Authorization Request
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47416\">#&#8203;47416</a>
          Async startup doesn't be enabled when the health check is not enabled </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47535\">#&#8203;47535</a>
          Polishing CNPG installation docs </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47667\">#&#8203;47667</a>
          Update release-notes for CIMD </li>\n</ul>\n\n<h3>Bugs</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/22569\">#&#8203;22569</a>
          Provide descriptions for default realm-management roles <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/26946\">#&#8203;26946</a>
          Multiple protocolMappers with the same name. <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/28970\">#&#8203;28970</a>
          Documention about the default db-schema is ambiguous <code>docs</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/36593\">#&#8203;36593</a>
          Built-in authentication flows are not updated for KC 26 <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/37231\">#&#8203;37231</a>
          Set New Password Multiple Times via Password Reset Function <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38991\">#&#8203;38991</a>
          [Test framework] Embedded server -> dependency download error when no version
          is specified <code>test-framework</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/39127\">#&#8203;39127</a>
          Incorrect return code with JWT algorithm set to none <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40510\">#&#8203;40510</a>
          Organization flow do not redirect when credentials exist <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40753\">#&#8203;40753</a>
          Resource leak: FileInputStream in Util.readProperties(File) is never closed
          .SAST <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40921\">#&#8203;40921</a>
          Reject invalid resource IDs in permission creation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41165\">#&#8203;41165</a>
          Feishu login has been continuously failing as an identity provider <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41630\">#&#8203;41630</a>
          Warning log message SRCFG01008: The value default has been converted by
          a Boolean Converter to \"false\" <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41924\">#&#8203;41924</a>
          Internal server error after changing Admin UI theme to \"base\" - An old,
          persisted problem <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42222\">#&#8203;42222</a>
          Federation Cache Policy details not shown when editing provider in Keycloak
          26.3+ <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42836\">#&#8203;42836</a>
          Organization selection changes after token refresh <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42839\">#&#8203;42839</a>
          UserInfo endpoint returns incorrect organization claim <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43198\">#&#8203;43198</a>
          Operator status patching of keycloak failed <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43201\">#&#8203;43201</a>
          entity mappings not working on 26.4 <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43356\">#&#8203;43356</a>
          Keycloak tests framework - issue to identify distribution directory inside
          ZIP file when version string uses suffix <code>test-framework</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43613\">#&#8203;43613</a>
          case insensitive match on organization identity provider domain - In case
          'ANY' option is chosen <code>organizations</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43726\">#&#8203;43726</a>
          Slow evaluation of client roles with dots for role mapper and others <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43757\">#&#8203;43757</a>
          Code Examples in Authentication SPI Documentation Don't Match Quickstarts
          Repository <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43854\">#&#8203;43854</a>
          OID4VCI credentials have invalid subject id value <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43949\">#&#8203;43949</a>
          MultivaluedString in mappers is not saved to backend with shown default
          value <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43991\">#&#8203;43991</a>
          Keycloak operator - Reconciliation failure <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44099\">#&#8203;44099</a>
          Out of memory after 3-4 restarts of embedded server <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44100\">#&#8203;44100</a>
          Issue with starting server results in connection refused exception in test
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44132\">#&#8203;44132</a>
          Bug -> Keycloak preview feature \"scripts\" is enabled by default <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44283\">#&#8203;44283</a>
          Flaky test: org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test06_addingUserToNewKeycloakGroup
          <code>ci</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44403\">#&#8203;44403</a>
          DCR endpoint ignores client's requested token_endpoint_auth_method <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44425\">#&#8203;44425</a>
          [Keycloak JS CI] Admin UI E2E Firefox failure <code>ci</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44498\">#&#8203;44498</a>
          [quick-theme] Logo and Favicon problem <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44574\">#&#8203;44574</a>
          Unable to find contextual data of type: org.keycloak.models.KeycloakSession
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44598\">#&#8203;44598</a>
          SAML user created with null username when mapped attribute missing <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44622\">#&#8203;44622</a>
          OID4VCI functionality should be disabled for the realm when \"Verified Credentials\"
          switch is disabled <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44637\">#&#8203;44637</a>
          Fail to import the realm with OID4VCI enabled <code>import-export</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44670\">#&#8203;44670</a>
          CredentialEndpoint can be invoked with incorrect access token <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44678\">#&#8203;44678</a>
          Inconsistent search when using wildcards <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44699\">#&#8203;44699</a>
          Not able to find key for credential signature if client scope was saved
          from admin console <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44737\">#&#8203;44737</a>
          CredentialRequest requires that client scope is assigned as 'Optional' <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44784\">#&#8203;44784</a>
          link to reset-credentials ignores default locale AND ui_locales <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44803\">#&#8203;44803</a>
          Unhandled IllegalArgumentException in SAMLRequestParser <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44807\">#&#8203;44807</a>
          [OID4VCI] Default values are not set for ClientScope <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44819\">#&#8203;44819</a>
          Missing validation error label on UI when editing a user <code>user-profile</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44824\">#&#8203;44824</a>
          Keycloak retains mapped firstName value and does not nullify it when upstream
          identity provider stops sending the claim <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44875\">#&#8203;44875</a>
          [OID4VCI] CredentialSignerException: Proof Type null is not supported for
          format ldp_vc <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44905\">#&#8203;44905</a>
          Email is not updated based on upstream IdP email <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44961\">#&#8203;44961</a>
          Authorization_details added to token-response even when should not be <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45005\">#&#8203;45005</a>
          [OID4VCI] Revisit and fix /credential_offer_uri endpoint  <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45058\">#&#8203;45058</a>
          Base theme: \"user properties\" and \"register\" required mark is\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Enabled.\n\n\u267B **Rebasing**: Whenever
          PR is behind base branch, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/YAKEcloud/yake-ansible).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/YAKEcloud/yake-ansible/pull/582
        commit_id: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        patchset: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        project:
          canonical_hostname: github.com
          canonical_name: github.com/YAKEcloud/yake-ansible
          name: YAKEcloud/yake-ansible
          short_name: yake-ansible
        src_dir: src/github.com/YAKEcloud/yake-ansible
        topic: null
      change: '582'
      change_message: "chore(deps): update dependency keycloak/keycloak to v26.6.0\n\n>
        \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis
        PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [keycloak/keycloak](https://redirect.github.com/keycloak/keycloak) | minor
        | `26.5.7` \u2192 `26.6.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>keycloak/keycloak
        (keycloak/keycloak)</summary>\n\n### [`v26.6.0`](https://redirect.github.com/keycloak/keycloak/releases/tag/26.6.0)\n\n[Compare
        Source](https://redirect.github.com/keycloak/keycloak/compare/26.5.7...26.6.0)\n\n<div>\n
        \   <h2>Highlights</h2>\n<div class=\"paragraph\">\n<p>This release features
        new capabilities for users and administrators of Keycloak. The highlights
        of this release are:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><strong>JWT
        Authorization Grant</strong>, enabling external-to-internal token exchange
        using externally signed JWT assertions.</p>\n</li>\n<li>\n<p><strong>Federated
        client authentication</strong>, eliminating the need to manage individual
        client secrets in Keycloak.</p>\n</li>\n<li>\n<p><strong>Workflows</strong>,
        enabling administrators to automate realm administrative tasks such as user
        and client lifecycle management.</p>\n</li>\n<li>\n<p><strong>Zero-downtime
        patch releases</strong>, allowing rolling updates within a minor release stream
        without service downtime.</p>\n</li>\n<li>\n<p>The <strong>Keycloak Test Framework</strong>,
        replacing the previous Arquillian-based solution.</p>\n</li>\n</ul>\n</div>\n<div
        class=\"paragraph\">\n<p>All of these features are now fully supported and
        no longer in preview.\nRead on to learn more about each new feature.\nIf you
        are upgrading from a previous release, <a href=\"https://www.keycloak.org/docs/latest/upgrading/index.html\">also
        review the changes listed in the upgrading guide</a>.</p>\n</div>\n<div class=\"sect2\">\n<h3
        id=\"_security_and_standards\">Security and Standards</h3>\n<div class=\"sect3\">\n<h4
        id=\"_jwt_authorization_grant_supported\">JWT Authorization Grant (supported)</h4>\n<div
        class=\"paragraph\">\n<p>JWT Authorization Grant (<a href=\"https://datatracker.ietf.org/doc/html/rfc7523\">RFC
        7523</a>) is designed to implement external-to-internal token exchange use
        cases. This grant allows using externally signed JWT assertions to request
        OAuth 2.0 access tokens.</p>\n</div>\n<div class=\"paragraph\">\n<p>In this
        release, JWT Authorization Grant is promoted from preview to supported. See
        the <a href=\"https://www.keycloak.org/securing-apps/jwt-authorization-grant\">JWT
        Authorization Grant guide</a> for additional details.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_federated_client_authentication_supported\">Federated
        client authentication (supported)</h4>\n<div class=\"paragraph\">\n<p>Federated
        client authentication allows clients to leverage existing credentials once
        a trust relationship with another issuer exists. It eliminates the need to
        assign and manage individual secrets for each client in Keycloak.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Federated client authentication is now promoted to
        supported, including support for client assertions issued by external OpenID
        Connect identity providers and Kubernetes Service Accounts.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Since the OAuth SPIFFE Client Authentication specification
        is still in draft status, this feature remains a preview feature in Keycloak.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_new_guide_about_demonstrating_proof_of_possession_dpop\">New
        guide about Demonstrating Proof-of-Possession (DPoP)</h4>\n<div class=\"paragraph\">\n<p>A
        new guide for OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) in the Securing
        applications Guides provides information on how to mitigate the risk of stolen
        tokens by making tokens sender-constrained.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
        <a href=\"https://www.keycloak.org/nightly/securing-apps/dpop\">Securing applications
        with DPoP</a> for more details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_identity_brokering_apis_v2_preview\">Identity Brokering APIs V2 (preview)</h4>\n<div
        class=\"paragraph\">\n<p>A new preview version 2 for the Identity Brokering
        APIs is introduced in this release. When brokering is used during the authentication
        process, Keycloak allows you to store tokens and responses issued by the external
        Identity Provider. Applications can call a specific endpoint to retrieve those
        tokens, which, in turn, can be used to get extra user information or invoke
        endpoints in the external trust domain. The new version improves the token
        retrieval endpoint to substitute the internal to external Token Exchange (use
        case for the <a href=\"https://www.keycloak.org/securing-apps/token-exchange#_legacy-token-exchange\">legacy
        Token Exchange V1</a>).</p>\n</div>\n<div class=\"paragraph\">\n<p>For more
        information, see the chapter <a href=\"https://www.keycloak.org/docs/26.6.0/server_development/#_identity-brokering-apis\">Identity
        Brokering APIs</a> in the Server Developer Guide.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_step_up_authentication_for_saml_preview\">Step-up
        authentication for SAML (preview)</h4>\n<div class=\"paragraph\">\n<p>The
        feature <code>step-up-authentication-saml</code> extends the step-up authentication
        to include the SAML protocol and clients. This feature is in preview mode.
        Additional information is available in the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_step-up-authentication-saml\">Server
        Administration Guide</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_oauth_client_id_metadata_document_experimental\">OAuth Client ID Metadata
        Document (experimental)</h4>\n<div class=\"paragraph\">\n<p><a href=\"https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-01.html\">OAuth
        Client ID Metadata Document (CIMD)</a> is an emerging standard that defines
        a JSON document format for describing OAuth 2.0 client metadata. Since version
        2025-11-25, the Model Context Protocol (MCP) requires an authorization server
        to comply with CIMD. Keycloak now includes experimental support for CIMD,
        allowing it to serve as an authorization server for MCP version 2025-11-25
        or later.</p>\n</div>\n<div class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/securing-apps/mcp-authz-server\">Integrating
        with Model Context Protocol (MCP)</a> for the updated guide including CIMD.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Many thanks to <a href=\"https://redirect.github.com/tnorimat\">Takashi
        Norimatsu</a> for the contribution.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
        id=\"_administration\">Administration</h3>\n<div class=\"sect3\">\n<h4 id=\"_workflows_supported\">Workflows
        (supported)</h4>\n<div class=\"paragraph\">\n<p>Workflows allow administrators
        to automate and orchestrate realm administrative tasks, bringing key capabilities
        of Identity Governance and Administration (IGA) to Keycloak. By defining workflows
        in YAML format, you can automate the lifecycle of realm resources such as
        users and clients based on events, conditions, and schedules.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>In this release, Workflows is promoted from preview
        to supported. This release also includes new built-in steps, a troubleshooting
        guide, and various improvements to the workflow engine.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_workflows\">Managing
        workflows</a> chapter in the Server Administration Guide.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_organization_groups\">Organization groups</h4>\n<div
        class=\"paragraph\">\n<p>Organizations now support isolated group hierarchies,
        allowing each organization to manage its own teams and departments without
        naming conflicts across the realm. This update includes Identity Provider
        mappers to automatically assign federated users to organization groups based
        on external claims. Group membership is automatically included in OIDC tokens
        and SAML assertions when an organization context is requested.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_groups_\">Managing
        organization groups</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_new_groups_scope_for_user_membership_changes\">New Groups scope for
        user membership changes</h4>\n<div class=\"paragraph\">\n<p>Fine-Grained Admin
        Permissions (FGAP) now includes a new <code>Groups</code> scope: <code>manage-membership-of-members</code>.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>This scope is now used as the group-side bridge for
        evaluating user-side <code>manage-group-membership</code> permissions based
        on a user&#&#8203;8217;s current group memberships.\nThe existing <code>manage-membership</code>
        scope keeps its current behavior for target group membership management operations.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_looking_up_client_secrets_via_the_vault_spi\">Looking
        up client secrets via the Vault SPI</h4>\n<div class=\"paragraph\">\n<p>Secrets
        for clients can now be managed and looked up by the Vault SPI.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
        Saarni</a> for contributing this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_forcing_password_change_for_ldap_users\">Forcing password change for
        LDAP users</h4>\n<div class=\"paragraph\">\n<p>There is now initial support
        for LDAP password policy control.\nThe support is limited to prompting users
        to update their password when the LDAP server indicates that the password
        must be changed.\nPreviously, Keycloak let the user in and ignored the mandatory
        password reset.\nThere is a new optional setting &#&#8203;8220;Enable LDAP
        password policy&#&#8203;8221; in the LDAP advanced settings to enable this.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
        Saarni</a> for contributing this change.</p>\n</div>\n</div>\n</div>\n<div
        class=\"sect2\">\n<h3 id=\"_configuring_and_running\">Configuring and Running</h3>\n<div
        class=\"sect3\">\n<h4 id=\"_java_25_support\">Java 25 support</h4>\n<div class=\"paragraph\">\n<p>Keycloak
        now supports running with OpenJDK 25.\nThe server container image continues
        to use OpenJDK 21 for now to support FIPS mode. For details, see the\nnote
        in the FIPS guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_zero_downtime_patch_releases_supported\">Zero-downtime
        patch releases (supported)</h4>\n<div class=\"paragraph\">\n<p>Zero-downtime
        patch releases allow you to perform rolling updates when upgrading to a newer
        patch version within the same <code>major.minor</code> release stream without
        service downtime.</p>\n</div>\n<div class=\"paragraph\">\n<p>In this release,
        zero-downtime patch releases are promoted to supported and enabled by default.\nWhen
        using the Keycloak Operator, set the update strategy to <code>Auto</code>
        to benefit from this functionality.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more details on the Operator configuration, see the <a href=\"https://www.keycloak.org/operator/rolling-updates\">Avoiding
        downtime with rolling updates</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_installation_instructions_for_cloudnativepg\">Installation instructions
        for CloudNativePG</h4>\n<div class=\"paragraph\">\n<p>For those running Keycloak
        on Kubernetes, there is now a guide on how to deploy a PostgreSQL database
        on Kubernetes by leveraging the CloudNativePG Operator and how to connect
        Keycloak to the database.</p>\n</div>\n<div class=\"paragraph\">\n<p>See <a
        href=\"https://www.keycloak.org/nightly/high-availability/single-cluster/deploy-cnpg\">Deploying
        CloudNativePG in multiple availability zones</a> in the High Availability
        Guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_simplified_database_operations\">Simplified
        database operations</h4>\n<div class=\"paragraph\">\n<p>Several new command
        line options simplify the database operations for Keycloak and remove the
        need to use raw JDBC connection options:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p>Configure
        TLS for the database connection.</p>\n</li>\n<li>\n<p>Database connection
        timeouts.</p>\n</li>\n<li>\n<p>Transaction timeouts with production-ready
        defaults.</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>It also
        verifies the correct UTF-8 character encoding of the database at startup and
        prints a warning if this is not the case.</p>\n</div>\n<div class=\"paragraph\">\n<p>When
        running on orchestrators like Kubernetes, the startup and liveness probes
        return UP during database migrations, simplifying upgrades by removing the
        need to adjust the probes during upgrades.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
        the migration guide for additional details on each aspect.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_graceful_shutdown_of_http_stack\">Graceful shutdown
        of HTTP stack</h4>\n<div class=\"paragraph\">\n<p>To allow rolling updates
        for configuration changes or version updates, a graceful shutdown of Keycloak
        nodes prevents users from seeing error responses when logging in or refreshing
        their tokens when nodes shut down.</p>\n</div>\n<div class=\"paragraph\">\n<p>Starting
        with this version, Keycloak supports a graceful shutdown of the HTTP stack.\nThis
        includes delaying a shutdown after receiving a termination signal, connection
        draining for HTTP/1.1 and HTTP/2 connections during that period, and a shutdown
        timeout to finish ongoing requests.</p>\n</div>\n<div class=\"paragraph\">\n<p>The
        defaults are a shutdown delay and a shutdown timeout of one second each.\nThis
        should be a good fit for setups where the reverse proxy is using TLS edge
        termination or re-encryption and the reverse proxy is notified about the Keycloak
        node shutting down at the same time as the Keycloak node.\nThis is a common
        setup, for example, in Kubernetes environments.</p>\n</div>\n<div class=\"paragraph\">\n<p>Users
        should adjust those values depending on their proxy setup.\nSee the section
        <a href=\"https://www.keycloak.org/server/reverseproxy#graceful-http-shutdown\">Graceful
        HTTP shutdown</a> in the reverse proxy guide for more information.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_new_kcraw_prefix_for_environment_variables_to_preserve_literal_values\">New
        <code>KCRAW_</code> prefix for environment variables to preserve literal values</h4>\n<div
        class=\"paragraph\">\n<p>Keycloak now supports a <code>KCRAW_</code> prefix
        for environment variables to preserve values containing <code>$</code> characters
        exactly as written, without expression evaluation.</p>\n</div>\n<div class=\"paragraph\">\n<p>When
        using the standard <code>KC_</code> prefix, Keycloak (via SmallRye Config)
        evaluates expressions in values (for example, <code>${some_key}</code> is
        resolved and <code>$$</code> is collapsed to <code>$</code>).\nThis can silently
        modify passwords or secrets injected by a secrets manager or orchestration
        tool where manual escaping is not feasible.</p>\n</div>\n<div class=\"paragraph\">\n<p>Setting
        <code>KCRAW_&lt;KEY&gt;</code> instead of <code>KC_&lt;KEY&gt;</code> preserves
        the value exactly as provided.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
        the <a href=\"https://www.keycloak.org/server/configuration#kcraw-prefix\">Preserving
        literal values with the KCRAW_ prefix</a> section in the Server Configuration
        guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_reload_of_lists_with_disallowed_passwords\">Automatic
        reload of lists with disallowed passwords</h4>\n<div class=\"paragraph\">\n<p>When
        a list of disallowed passwords (also known as blacklist) changes, it is automatically
        reloaded. This avoids the need for a server restart when the list changes.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
        Saarni</a> for contributing this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_automatic_truststore_initialization_on_kubernetes_and_openshift\">Automatic
        truststore initialization on Kubernetes and OpenShift</h4>\n<div class=\"paragraph\">\n<p>Keycloak
        now automatically discovers and trusts cluster certificate authorities when
        running on Kubernetes or OpenShift, without requiring the Operator to preconfigure
        the truststore.</p>\n</div>\n<div class=\"paragraph\">\n<p>If present in the
        container filesystem, the following certificates are added to the system truststore
        at startup:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code>
        (Kubernetes service account CA)</p>\n</li>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt</code>
        (OpenShift service CA)</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>This
        behavior is enabled by default and can be controlled with the server option
        <code>--truststore-kubernetes-enabled=true|false</code> (default: <code>true</code>).</p>\n</div>\n<div
        class=\"paragraph\">\n<p>Most deployments do not require any action. If you
        relied on the Operator to manage these truststore entries previously, the
        server now performs the same function directly.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_client_certificate_lookup_providers_for_traefik_and_envoy\">Client
        certificate lookup providers for Traefik and Envoy</h4>\n<div class=\"paragraph\">\n<p>You
        can now use new client certificate lookup providers for Traefik and Envoy
        proxies.\nFor details, see the <a href=\"https://www.keycloak.org/server/reverseproxy#_enabling_client_certificate_lookup\">Enabling
        Client Certificate Lookup</a> section of the documentation.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_configurable_kubernetes_service_name_and_port_in_the_keycloak_operator\">Configurable
        Kubernetes Service name and port in the Keycloak Operator</h4>\n<div class=\"paragraph\">\n<p>The
        Keycloak Operator now supports overriding the name and port of the Kubernetes
        Service it creates for a Keycloak deployment.</p>\n</div>\n<div class=\"paragraph\">\n<p>Previously,
        the Service name was always derived as <code>&lt;cr-name&gt;-service</code>
        and the Service port always matched the container port.\nYou can now use the
        <code>spec.http.serviceName</code>, <code>spec.http.serviceHttpsPort</code>,
        and <code>spec.http.serviceHttpPort</code> fields to\nconfigure these independently.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration\">Advanced
        configuration</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_sensitive_information_is_not_displayed_in_the_http_access_log\">Sensitive
        information is not displayed in the HTTP Access log</h4>\n<div class=\"paragraph\">\n<p>If
        you are using the HTTP Access logging capability, sensitive information is
        omitted.\nThis means that tokens in the 'Authorization' HTTP header and specific
        sensitive cookies are not shown.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
        HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_configurable_log_file_rotation\">Configurable
        log file rotation</h4>\n<div class=\"paragraph\">\n<p>It is now possible to
        configure log file rotation when using Keycloak&#&#8203;8217;s built-in file
        logging handler.\nThis includes a simple option to fully disable log rotation,
        which is useful when using an external log rotation solution such as <code>logrotate</code>.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>To disable log file rotation:</p>\n</div>\n<div class=\"listingblock\">\n<div
        class=\"content\">\n<pre class=\"highlight\"><code class=\"language-bash\"
        data-lang=\"bash\">bin/kc.sh start --log=\"console,file\" --log-file-rotation-enabled=false</code></pre>\n</div>\n</div>\n<div
        class=\"paragraph\">\n<p>For more information, see the <a href=\"https://www.keycloak.org/server/logging/file\">File
        logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_http_access_logs_in_a_dedicated_file\">HTTP
        access logs in a dedicated file</h4>\n<div class=\"paragraph\">\n<p>HTTP access
        logs can now be written to a dedicated file, separate from the server logs.\nThis
        makes it easier to process and archive access logs independently for security
        auditing and compliance monitoring.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
        HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_customizable_service_fields_in_json_log_output\">Customizable
        service fields in JSON log output</h4>\n<div class=\"paragraph\">\n<p>Keycloak
        now provides native options to customize the <code>service.name</code> and
        <code>service.environment</code> fields in JSON log output across all log
        handlers (console, file, and syslog).</p>\n</div>\n<div class=\"paragraph\">\n<p>Previously,
        when using the ECS format, <code>service.name</code> and <code>service.environment</code>
        could not be overridden through Keycloak configuration.\nThis made it difficult
        to align JSON log fields with OpenTelemetry resource attributes.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>You can now set these fields using <code>log-service-name</code>
        and <code>log-service-environment</code>.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more information, see the <a href=\"https://www.keycloak.org/server/logging#customize-service-fields\">Configuring
        logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_new_and_updated_translations\">New
        and updated translations</h4>\n<div class=\"paragraph\">\n<p>New translations
        for Indonesian and Armenian were added. A warm welcome to the new language
        maintainers for these languages!\nThere are also new language maintainers
        for the Swedish translation, who translated all remaining message keys. Thank
        you so much!</p>\n</div>\n<div class=\"paragraph\">\n<p>Follow the translation
        progress on the <a href=\"https://www.keycloak.org/translations\">translation
        status page</a>, help translate, and read the translation guide on how to
        add additional languages.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
        id=\"_right_to_left_language_support_in_the_account_ui\">Right-to-left language
        support in the Account UI</h4>\n<div class=\"paragraph\">\n<p>Support for
        right-to-left (RTL) languages was added to the Login UI, Admin UI, and email
        templates several releases ago. This release adds initial RTL support to the
        Account UI, which completes this effort.</p>\n</div>\n</div>\n</div>\n<div
        class=\"sect2\">\n<h3 id=\"_observability\">Observability</h3>\n<div class=\"sect3\">\n<h4
        id=\"_telemetry_configuration_via_the_keycloak_cr\">Telemetry configuration
        via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports
        configuring the OpenTelemetry properties via the Keycloak CR when using the
        Operator.\nThese properties are shared among the available OpenTelemetry components
        - logs, metrics, and traces.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more details, see the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
        your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_custom_request_headers_for_opentelemetry\">Custom
        request headers for OpenTelemetry</h4>\n<div class=\"paragraph\">\n<p>It is
        now possible to set request headers for exporting telemetry via OpenTelemetry
        Protocol (OTLP).\nThis is mainly useful for providing tokens in the request.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>You can specify these headers via the <code>telemetry-header-&lt;header&gt;</code>
        wildcard option, which accepts any custom header name.\nAlternatively, use
        <code>telemetry-logs-header-&lt;header&gt;</code> for OpenTelemetry Logs or
        <code>telemetry-metrics-header-&lt;header&gt;</code> for OpenTelemetry Metrics.</p>\n</div>\n<div
        class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
        your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
        class=\"sect3\">\n<h4 id=\"_service_monitor_annotations_and_labels_via_the_keycloak_cr\">Service
        Monitor annotations and labels via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>It
        is now possible to configure service monitor labels and annotations via the
        Keycloak CR when using the Operator.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
        more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration#_servicemonitor\">Advanced
        Configuration Operator</a> guide.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
        id=\"_extension_development\">Extension Development</h3>\n<div class=\"sect3\">\n<h4
        id=\"_keycloak_test_framework_supported\">Keycloak Test Framework (supported)</h4>\n<div
        class=\"paragraph\">\n<p>The Keycloak Test Framework, based on JUnit 6, is
        now fully supported.</p>\n</div>\n<div class=\"paragraph\">\n<p>It replaces
        the previous solution built on top of Arquillian and JUnit 4.\nBehind the
        scenes, the framework handles the lifecycle of Keycloak, the database, and
        any injected resources such as realms and clients.</p>\n</div>\n<div class=\"paragraph\">\n<p>Tests
        simply declare what they want, including specific configuration, and the framework
        takes care of the rest.</p>\n</div>\n<div class=\"paragraph\">\n<p>For more
        information, see <a href=\"https://redirect.github.com/keycloak/keycloak/tree/main/test-framework#readme\">Keycloak
        Test Framework</a>.</p>\n</div>\n</div>\n</div>\n<h2>Upgrading</h2>\n<p>Before
        upgrading refer to <a href=\"https://www.keycloak.org/docs/latest/upgrading/#migration-changes\">the
        migration guide</a> for a complete list of changes.</p>\n\n<h2>All resolved
        issues</h2>\n\n<h3>Deprecated features</h3>\n<ul>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45156\">#&#8203;45156</a>
        Deprecate Token Exchange v1 </li>\n</ul>\n\n<h3>New features</h3>\n<ul>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/10155\">#&#8203;10155</a>
        Step-up authentication for SAML clients <code>authentication</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/13102\">#&#8203;13102</a>
        Add support for specifying `client.secret` using vault <code>core</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/39888\">#&#8203;39888</a>
        Workflows </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42634\">#&#8203;42634</a>
        Federated client authentication </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43144\">#&#8203;43144</a>
        OAuth Identity and Authorization Chaining Across Domains </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43146\">#&#8203;43146</a>
        New test framework </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43152\">#&#8203;43152</a>
        Authorization Grants </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43252\">#&#8203;43252</a>
        Zero-downtime upgrades between patch releases of Keycloak </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43257\">#&#8203;43257</a>
        Support a Kubernetes Native Database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43507\">#&#8203;43507</a>
        Add support for Organization-specific Groups </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43576\">#&#8203;43576</a>
        Authorization grant for social providers <code>token-exchange/federated</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44833\">#&#8203;44833</a>
        [OID4VCI] Make natural_person configuration available in all formats <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45106\">#&#8203;45106</a>
        OAuth Client ID Metadata Document </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45284\">#&#8203;45284</a>
        CIMD - Persistent CIMD <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46633\">#&#8203;46633</a>
        keycloak operator: add support for different port and name for the kubernetes
        service definition in the keycloak CRD </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47011\">#&#8203;47011</a>
        Add debug helper utility to the test framework <code>test-framework</code></li>\n</ul>\n\n<h3>Enhancements</h3>\n<ul>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/10618\">#&#8203;10618</a>
        Enhancements to logging config <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/14523\">#&#8203;14523</a>
        Add support for enforced password change with LDAP federation <code>ldap</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/17904\">#&#8203;17904</a>
        Support RTL UI <code>account/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/19374\">#&#8203;19374</a>
        Allow absolute path for cache-config-file? <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/19453\">#&#8203;19453</a>
        The default database transaction timeout should not be applied to Liquibase
        or data migrations <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/20618\">#&#8203;20618</a>
        Support enabling access logs <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/27986\">#&#8203;27986</a>
        Remove Liquibase dependency version from Keycloak root pom </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/33160\">#&#8203;33160</a>
        Add support for X509 client certificate lookup for Envoy </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/33198\">#&#8203;33198</a>
        Introduce `resourcesCommonUrl` for E-Mail templates <code>core</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/33818\">#&#8203;33818</a>
        Request for Enhancement: Make x509cert-lookup SPI public </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/34435\">#&#8203;34435</a>
        OTEL: Add tracing ID to user facing error message <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/35298\">#&#8203;35298</a>
        Reverse proxy provided context path not working despite setting X-Forwarded-Prefix
        header <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36226\">#&#8203;36226</a>
        Provide a read only view of Identity Provider Mappers configuration screen
        to the Keycloak Admin UI </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36710\">#&#8203;36710</a>
        Have a first-class CLI option to change Keycloak's transaction timeout <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/38884\">#&#8203;38884</a>
        Upgrade command rolling updates for patch releases / step 3: Infinispan/JGroups
        support </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/38888\">#&#8203;38888</a>
        Avoid breaking DB changes during patch releases </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40902\">#&#8203;40902</a>
        More fully document operator upgrade scenarios, in particular with custom
        images <code>docs</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41330\">#&#8203;41330</a>
        Improve logging of JpaUserSessionPersisterProvider#expire </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41353\">#&#8203;41353</a>
        Provide HTTP access logs written to file with rotation <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/41629\">#&#8203;41629</a>
        Remove Tracing workaround in Infinispan/JGroups classes </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42256\">#&#8203;42256</a>
        DB Connection Pool acquisition timeout errors on database failover  <code>core</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/42626\">#&#8203;42626</a>
        Provide a way to add custom labels to generated ServiceMonitor </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/42747\">#&#8203;42747</a>
        Make DPoP docs more detailed <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42876\">#&#8203;42876</a>
        dev mode should bind only to localhost if possible </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42900\">#&#8203;42900</a>
        Move the logic of scanning Kubernetes CA to Keycloak <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43589\">#&#8203;43589</a>
        Gracefully shutting down HTTP stack </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43701\">#&#8203;43701</a>
        Improve SimpleHttp API <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43829\">#&#8203;43829</a>
        Add createdTimestamp filter (before/after) to /admin/realms/{realm}/users
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44090\">#&#8203;44090</a>
        ErrorId for error screens and logging </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44101\">#&#8203;44101</a>
        Allow re-using server when running tests with the new framework </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44364\">#&#8203;44364</a>
        Improve client creation with PKCE in admin console <code>core</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44424\">#&#8203;44424</a>
        findClientSessionsClientIds performance issue <code>storage</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44459\">#&#8203;44459</a>
        Adding the log to the required action to show the cause of syntax violation
        of the LDAP policy <code>ldap</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44846\">#&#8203;44846</a>
        [OID4VCI]: Ensure OID4VCI optional fields are saved cleanly and use defaults
        <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44849\">#&#8203;44849</a>
        [OID4VCI] Add UI support for `vc.credential_signing_alg` in OID4VCI client
        scopes <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44973\">#&#8203;44973</a>
        Hide Remember Me session settings when Remember Me is disabled in realm login
        settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45006\">#&#8203;45006</a>
        [OID4VCI] Add support for user did as subject id <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45188\">#&#8203;45188</a>
        Upgrade to quarkus 3.30.5 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45220\">#&#8203;45220</a>
        OTEL: Ability to specify headers for exporters <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45231\">#&#8203;45231</a>
        [OID4VCI] Generate pre-authorized codes using the JWT format <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45254\">#&#8203;45254</a>
        Admin UI javascript bundle should have source mapping </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45278\">#&#8203;45278</a>
        Upgrade to Quarkus 3.33.x LTS </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45281\">#&#8203;45281</a>
        Add missing Swedish translations for admin theme messages <code>translations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45322\">#&#8203;45322</a>
        Linking user with idp fails with generic message if user is already linked
        <code>identity-brokering</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45337\">#&#8203;45337</a>
        Upgrade to Quarkus 3.31 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45348\">#&#8203;45348</a>
        OTEL: Add Telemetry options to Keycloak CR <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45360\">#&#8203;45360</a>
        Document that the the HA architectures are tested with Openshift 4.18 </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45467\">#&#8203;45467</a>
        Management interface endpoint lists available endpoints <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45620\">#&#8203;45620</a>
        Change default not-before validation to 10 second instead of 0 <code>oidc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45623\">#&#8203;45623</a>
        Avoid unnecessary warning logs during the operator tests execution <code>testsuite</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45629\">#&#8203;45629</a>
        HTTP access log written to file should be in a separate directory <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45689\">#&#8203;45689</a>
        When a user joins a role or group, it should not read all existing roles and
        groups from the database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45704\">#&#8203;45704</a>
        Invite existing users from Admin UI <code>organizations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45718\">#&#8203;45718</a>
        Improve error message when organization name cannot be used as alias </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45795\">#&#8203;45795</a>
        Promote Keycloak and KeycloakRealmImport CRDs to v2beta1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45841\">#&#8203;45841</a>
        Add revert button to client credentials page </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45880\">#&#8203;45880</a>
        SAMLEndpoint - increase extensibility by increasing accessibility of some
        private fields/methods </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45882\">#&#8203;45882</a>
        Use GroupResource context in Groups so that Group components can be reused
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45884\">#&#8203;45884</a>
        Testframework core has dependency on testcontainers </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45898\">#&#8203;45898</a>
        Supported Configurations guide </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45909\">#&#8203;45909</a>
        Add theme clarification blurb to Realm Settings <code>admin/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45941\">#&#8203;45941</a>
        Do not use deprecated test containers in tests <code>testsuite</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45944\">#&#8203;45944</a>
        OTEL: Use suggested 'code.function.name' for span attributes <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45965\">#&#8203;45965</a>
        [OID4VCI] Revisit and fix OAuthClient.credentialRequest() <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45992\">#&#8203;45992</a>
        Clarify operator instructions involving Wildcard certificates and OpenShift
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45996\">#&#8203;45996</a>
        Enforce `LF` line endings on `*.tsx` files with `.gitattributes` </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45999\">#&#8203;45999</a>
        [OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest() <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46001\">#&#8203;46001</a>
        [OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest() <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46043\">#&#8203;46043</a>
        Upgrade to Quarkus 3.31.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46055\">#&#8203;46055</a>
        [OID4VCI] Confine test realm setup to TestCase.configureTestRealm() </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46156\">#&#8203;46156</a>
        Add node count and next-node selection to LoadBalancer API </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46164\">#&#8203;46164</a>
        Separate password and OTP brute force protection to prevent OTP bypass attacks
        by default </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46255\">#&#8203;46255</a>
        Upgrade to Quarkus 3.32.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46292\">#&#8203;46292</a>
        Allow to expose WellKnown provider via ServerMetadataResource </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46304\">#&#8203;46304</a>
        SPIFFE Identity Provider default TTL too low </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46355\">#&#8203;46355</a>
        [OID4VCI] Add support for CredentialScopeRepresentation <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46395\">#&#8203;46395</a>
        X509 Certificates passed from Traefik PassTlsClientCert middleware broken
        since 26.5.0 <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46421\">#&#8203;46421</a>
        Revisit Infinispan session idle and lifetime settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46429\">#&#8203;46429</a>
        Add username to BrokeredIdentityContext created from JWTBearer Grant <code>token-exchange/federated</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46471\">#&#8203;46471</a>
        Aggregate client-id field for improved Infinispan query </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46494\">#&#8203;46494</a>
        Allow customizing federated identity lookup in JWTAuthorizationGrantType </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46531\">#&#8203;46531</a>
        Consider exposing UUID for admin api v2 resources </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46556\">#&#8203;46556</a>
        For MSSQL Server, set `sendStringParametersAsUnicode` to `false` by default
        <code>storage</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46557\">#&#8203;46557</a>
        Keycloak should check the Unicode setup of the database on startup </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46603\">#&#8203;46603</a>
        Add Database CLI options for TLS encryption for databases </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46617\">#&#8203;46617</a>
        MCP Documentation for 26.6 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46626\">#&#8203;46626</a>
        Allow to configure Client Assertion max expiration for Kubernetes Identity
        Provider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46627\">#&#8203;46627</a>
        Allow to configure Client Assertion max expiration for OIDC Identity Provider
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46657\">#&#8203;46657</a>
        Passwords containing `$$` or `${` patterns are mangled when set via environment
        variables (SmallRye expression evaluation) <code>dist/quarkus</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46671\">#&#8203;46671</a>
        Allow custom timeouts in DBLockProvider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46689\">#&#8203;46689</a>
        Remove user input reflection in Token Introspection error responses <code>oidc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46693\">#&#8203;46693</a>
        Group-level deny policies do not block `manage-group-membership` on group
        members <code>admin/fine-grained-permissions</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46699\">#&#8203;46699</a>
        CIMD - Performance: Avoid repeated convertContentFilledList() in verifyUri()
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46701\">#&#8203;46701</a>
        CIMD - Performance: Single-pass HTTP Cache-Control header lookup </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46703\">#&#8203;46703</a>
        CIMD - Performance: Eliminate double URI parsing in ClientIdUriSchemeCondition.applyPolicy()
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46708\">#&#8203;46708</a>
        CIMD - Performance: Avoid streaming the directive list multipul times </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46711\">#&#8203;46711</a>
        Upgrade to Quarkus 3.32.1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46728\">#&#8203;46728</a>
        Use quarkus properties ahead of keycloak defaults or map from values </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46757\">#&#8203;46757</a>
        Upgrade to jackson-core 2.21.1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46765\">#&#8203;46765</a>
        Adding missing question mark </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46781\">#&#8203;46781</a>
        IdP alias is not clickable in organization's Identity Providers tab <code>admin/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46796\">#&#8203;46796</a>
        Document that export is not a backup </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46809\">#&#8203;46809</a>
        Set a default connection timeout for all databases types </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46872\">#&#8203;46872</a>
        Be more explicit on how to enable OTel Logs and Metrics in Operator <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46874\">#&#8203;46874</a>
        Be more explicit in using the OTel Logs level <code>observability</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/46890\">#&#8203;46890</a>
        Upgrade to Quarkus 3.32.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46936\">#&#8203;46936</a>
        Reduce tightly coupling between client policy contexts and conditions/executors
        <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46964\">#&#8203;46964</a>
        Adding more Hungarian translations </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46972\">#&#8203;46972</a>
        Clarify credentials field availability in GET /admin/realms/{realm}/users
        documentation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47038\">#&#8203;47038</a>
        Translation support for UI theme descriptions <code>translations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/47081\">#&#8203;47081</a>
        Upgrade to Quarkus 3.32.3 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47130\">#&#8203;47130</a>
        Upgrade to Quarkus 3.33.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47140\">#&#8203;47140</a>
        Add CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47146\">#&#8203;47146</a>
        Keycloak: no native option to customize JSON log service.name and service.environment
        fields <code>observability</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47163\">#&#8203;47163</a>
        Enhancement: Password denylist file changes should not require server restart
        </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47187\">#&#8203;47187</a>
        Asynchronous server initialization </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47229\">#&#8203;47229</a>
        Identity Provider redirection via kc_idp_hint in Pushed Authorization Request
        <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47416\">#&#8203;47416</a>
        Async startup doesn't be enabled when the health check is not enabled </li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/47535\">#&#8203;47535</a>
        Polishing CNPG installation docs </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47667\">#&#8203;47667</a>
        Update release-notes for CIMD </li>\n</ul>\n\n<h3>Bugs</h3>\n<ul>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/22569\">#&#8203;22569</a>
        Provide descriptions for default realm-management roles <code>admin/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/26946\">#&#8203;26946</a>
        Multiple protocolMappers with the same name. <code>admin/api</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/28970\">#&#8203;28970</a>
        Documention about the default db-schema is ambiguous <code>docs</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/36593\">#&#8203;36593</a>
        Built-in authentication flows are not updated for KC 26 <code>organizations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/37231\">#&#8203;37231</a>
        Set New Password Multiple Times via Password Reset Function <code>login/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/38991\">#&#8203;38991</a>
        [Test framework] Embedded server -> dependency download error when no version
        is specified <code>test-framework</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/39127\">#&#8203;39127</a>
        Incorrect return code with JWT algorithm set to none <code>authentication</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/40510\">#&#8203;40510</a>
        Organization flow do not redirect when credentials exist <code>organizations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/40753\">#&#8203;40753</a>
        Resource leak: FileInputStream in Util.readProperties(File) is never closed
        .SAST <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40921\">#&#8203;40921</a>
        Reject invalid resource IDs in permission creation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41165\">#&#8203;41165</a>
        Feishu login has been continuously failing as an identity provider <code>identity-brokering</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/41630\">#&#8203;41630</a>
        Warning log message SRCFG01008: The value default has been converted by a
        Boolean Converter to \"false\" <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41924\">#&#8203;41924</a>
        Internal server error after changing Admin UI theme to \"base\" - An old,
        persisted problem <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42222\">#&#8203;42222</a>
        Federation Cache Policy details not shown when editing provider in Keycloak
        26.3+ <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42836\">#&#8203;42836</a>
        Organization selection changes after token refresh <code>organizations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/42839\">#&#8203;42839</a>
        UserInfo endpoint returns incorrect organization claim <code>organizations</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43198\">#&#8203;43198</a>
        Operator status patching of keycloak failed <code>operator</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43201\">#&#8203;43201</a>
        entity mappings not working on 26.4 <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43356\">#&#8203;43356</a>
        Keycloak tests framework - issue to identify distribution directory inside
        ZIP file when version string uses suffix <code>test-framework</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43613\">#&#8203;43613</a>
        case insensitive match on organization identity provider domain - In case
        'ANY' option is chosen <code>organizations</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43726\">#&#8203;43726</a>
        Slow evaluation of client roles with dots for role mapper and others <code>identity-brokering</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43757\">#&#8203;43757</a>
        Code Examples in Authentication SPI Documentation Don't Match Quickstarts
        Repository <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43854\">#&#8203;43854</a>
        OID4VCI credentials have invalid subject id value <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/43949\">#&#8203;43949</a>
        MultivaluedString in mappers is not saved to backend with shown default value
        <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43991\">#&#8203;43991</a>
        Keycloak operator - Reconciliation failure <code>operator</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44099\">#&#8203;44099</a>
        Out of memory after 3-4 restarts of embedded server <code>testsuite</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44100\">#&#8203;44100</a>
        Issue with starting server results in connection refused exception in test
        <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44132\">#&#8203;44132</a>
        Bug -> Keycloak preview feature \"scripts\" is enabled by default <code>authentication</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44283\">#&#8203;44283</a>
        Flaky test: org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test06_addingUserToNewKeycloakGroup
        <code>ci</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44403\">#&#8203;44403</a>
        DCR endpoint ignores client's requested token_endpoint_auth_method <code>oidc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44425\">#&#8203;44425</a>
        [Keycloak JS CI] Admin UI E2E Firefox failure <code>ci</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44498\">#&#8203;44498</a>
        [quick-theme] Logo and Favicon problem <code>login/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44574\">#&#8203;44574</a>
        Unable to find contextual data of type: org.keycloak.models.KeycloakSession
        <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44598\">#&#8203;44598</a>
        SAML user created with null username when mapped attribute missing <code>saml</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44622\">#&#8203;44622</a>
        OID4VCI functionality should be disabled for the realm when \"Verified Credentials\"
        switch is disabled <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44637\">#&#8203;44637</a>
        Fail to import the realm with OID4VCI enabled <code>import-export</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44670\">#&#8203;44670</a>
        CredentialEndpoint can be invoked with incorrect access token <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44678\">#&#8203;44678</a>
        Inconsistent search when using wildcards <code>admin/api</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44699\">#&#8203;44699</a>
        Not able to find key for credential signature if client scope was saved from
        admin console <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44737\">#&#8203;44737</a>
        CredentialRequest requires that client scope is assigned as 'Optional' <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44784\">#&#8203;44784</a>
        link to reset-credentials ignores default locale AND ui_locales <code>login/ui</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44803\">#&#8203;44803</a>
        Unhandled IllegalArgumentException in SAMLRequestParser <code>saml</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44807\">#&#8203;44807</a>
        [OID4VCI] Default values are not set for ClientScope <code>core</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44819\">#&#8203;44819</a>
        Missing validation error label on UI when editing a user <code>user-profile</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44824\">#&#8203;44824</a>
        Keycloak retains mapped firstName value and does not nullify it when upstream
        identity provider stops sending the claim <code>identity-brokering</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44875\">#&#8203;44875</a>
        [OID4VCI] CredentialSignerException: Proof Type null is not supported for
        format ldp_vc <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44905\">#&#8203;44905</a>
        Email is not updated based on upstream IdP email <code>identity-brokering</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/44961\">#&#8203;44961</a>
        Authorization_details added to token-response even when should not be <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45005\">#&#8203;45005</a>
        [OID4VCI] Revisit and fix /credential_offer_uri endpoint  <code>oid4vc</code></li>\n<li><a
        href=\"https://redirect.github.com/keycloak/keycloak/issues/45058\">#&#8203;45058</a>
        Base theme: \"user properties\" and \"register\" required mark is\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Enabled.\n\n\u267B **Rebasing**: Whenever
        PR is behind base branch, or you tick the rebase/retry checkbox.\n\n\U0001F515
        **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/YAKEcloud/yake-ansible).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
      change_url: https://github.com/YAKEcloud/yake-ansible/pull/582
      child_jobs: []
      commit_id: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
      event_id: 550d3c00-33f9-11f1-995a-2193fefe80f9
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/97be0756d4aa4e419bcdbbe2cedd6b83/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/97be0756d4aa4e419bcdbbe2cedd6b83/work/logs
        result_data_file: /var/lib/zuul/builds/97be0756d4aa4e419bcdbbe2cedd6b83/work/results.json
        src_root: /var/lib/zuul/builds/97be0756d4aa4e419bcdbbe2cedd6b83/work/src
        work_root: /var/lib/zuul/builds/97be0756d4aa4e419bcdbbe2cedd6b83/work
      include_vars: []
      items:
      - branch: main
        change: '582'
        change_message: "chore(deps): update dependency keycloak/keycloak to v26.6.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [keycloak/keycloak](https://redirect.github.com/keycloak/keycloak)
          | minor | `26.5.7` \u2192 `26.6.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>keycloak/keycloak
          (keycloak/keycloak)</summary>\n\n### [`v26.6.0`](https://redirect.github.com/keycloak/keycloak/releases/tag/26.6.0)\n\n[Compare
          Source](https://redirect.github.com/keycloak/keycloak/compare/26.5.7...26.6.0)\n\n<div>\n
          \   <h2>Highlights</h2>\n<div class=\"paragraph\">\n<p>This release features
          new capabilities for users and administrators of Keycloak. The highlights
          of this release are:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><strong>JWT
          Authorization Grant</strong>, enabling external-to-internal token exchange
          using externally signed JWT assertions.</p>\n</li>\n<li>\n<p><strong>Federated
          client authentication</strong>, eliminating the need to manage individual
          client secrets in Keycloak.</p>\n</li>\n<li>\n<p><strong>Workflows</strong>,
          enabling administrators to automate realm administrative tasks such as user
          and client lifecycle management.</p>\n</li>\n<li>\n<p><strong>Zero-downtime
          patch releases</strong>, allowing rolling updates within a minor release
          stream without service downtime.</p>\n</li>\n<li>\n<p>The <strong>Keycloak
          Test Framework</strong>, replacing the previous Arquillian-based solution.</p>\n</li>\n</ul>\n</div>\n<div
          class=\"paragraph\">\n<p>All of these features are now fully supported and
          no longer in preview.\nRead on to learn more about each new feature.\nIf
          you are upgrading from a previous release, <a href=\"https://www.keycloak.org/docs/latest/upgrading/index.html\">also
          review the changes listed in the upgrading guide</a>.</p>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_security_and_standards\">Security and Standards</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_jwt_authorization_grant_supported\">JWT Authorization
          Grant (supported)</h4>\n<div class=\"paragraph\">\n<p>JWT Authorization
          Grant (<a href=\"https://datatracker.ietf.org/doc/html/rfc7523\">RFC 7523</a>)
          is designed to implement external-to-internal token exchange use cases.
          This grant allows using externally signed JWT assertions to request OAuth
          2.0 access tokens.</p>\n</div>\n<div class=\"paragraph\">\n<p>In this release,
          JWT Authorization Grant is promoted from preview to supported. See the <a
          href=\"https://www.keycloak.org/securing-apps/jwt-authorization-grant\">JWT
          Authorization Grant guide</a> for additional details.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_federated_client_authentication_supported\">Federated
          client authentication (supported)</h4>\n<div class=\"paragraph\">\n<p>Federated
          client authentication allows clients to leverage existing credentials once
          a trust relationship with another issuer exists. It eliminates the need
          to assign and manage individual secrets for each client in Keycloak.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Federated client authentication is now promoted
          to supported, including support for client assertions issued by external
          OpenID Connect identity providers and Kubernetes Service Accounts.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Since the OAuth SPIFFE Client Authentication specification
          is still in draft status, this feature remains a preview feature in Keycloak.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_guide_about_demonstrating_proof_of_possession_dpop\">New
          guide about Demonstrating Proof-of-Possession (DPoP)</h4>\n<div class=\"paragraph\">\n<p>A
          new guide for OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) in the
          Securing applications Guides provides information on how to mitigate the
          risk of stolen tokens by making tokens sender-constrained.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/nightly/securing-apps/dpop\">Securing
          applications with DPoP</a> for more details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_identity_brokering_apis_v2_preview\">Identity Brokering APIs V2 (preview)</h4>\n<div
          class=\"paragraph\">\n<p>A new preview version 2 for the Identity Brokering
          APIs is introduced in this release. When brokering is used during the authentication
          process, Keycloak allows you to store tokens and responses issued by the
          external Identity Provider. Applications can call a specific endpoint to
          retrieve those tokens, which, in turn, can be used to get extra user information
          or invoke endpoints in the external trust domain. The new version improves
          the token retrieval endpoint to substitute the internal to external Token
          Exchange (use case for the <a href=\"https://www.keycloak.org/securing-apps/token-exchange#_legacy-token-exchange\">legacy
          Token Exchange V1</a>).</p>\n</div>\n<div class=\"paragraph\">\n<p>For more
          information, see the chapter <a href=\"https://www.keycloak.org/docs/26.6.0/server_development/#_identity-brokering-apis\">Identity
          Brokering APIs</a> in the Server Developer Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_step_up_authentication_for_saml_preview\">Step-up
          authentication for SAML (preview)</h4>\n<div class=\"paragraph\">\n<p>The
          feature <code>step-up-authentication-saml</code> extends the step-up authentication
          to include the SAML protocol and clients. This feature is in preview mode.
          Additional information is available in the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_step-up-authentication-saml\">Server
          Administration Guide</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_oauth_client_id_metadata_document_experimental\">OAuth Client ID Metadata
          Document (experimental)</h4>\n<div class=\"paragraph\">\n<p><a href=\"https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-01.html\">OAuth
          Client ID Metadata Document (CIMD)</a> is an emerging standard that defines
          a JSON document format for describing OAuth 2.0 client metadata. Since version
          2025-11-25, the Model Context Protocol (MCP) requires an authorization server
          to comply with CIMD. Keycloak now includes experimental support for CIMD,
          allowing it to serve as an authorization server for MCP version 2025-11-25
          or later.</p>\n</div>\n<div class=\"paragraph\">\n<p>See <a href=\"https://www.keycloak.org/securing-apps/mcp-authz-server\">Integrating
          with Model Context Protocol (MCP)</a> for the updated guide including CIMD.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Many thanks to <a href=\"https://redirect.github.com/tnorimat\">Takashi
          Norimatsu</a> for the contribution.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_administration\">Administration</h3>\n<div class=\"sect3\">\n<h4 id=\"_workflows_supported\">Workflows
          (supported)</h4>\n<div class=\"paragraph\">\n<p>Workflows allow administrators
          to automate and orchestrate realm administrative tasks, bringing key capabilities
          of Identity Governance and Administration (IGA) to Keycloak. By defining
          workflows in YAML format, you can automate the lifecycle of realm resources
          such as users and clients based on events, conditions, and schedules.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>In this release, Workflows is promoted from preview
          to supported. This release also includes new built-in steps, a troubleshooting
          guide, and various improvements to the workflow engine.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_workflows\">Managing
          workflows</a> chapter in the Server Administration Guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_organization_groups\">Organization groups</h4>\n<div
          class=\"paragraph\">\n<p>Organizations now support isolated group hierarchies,
          allowing each organization to manage its own teams and departments without
          naming conflicts across the realm. This update includes Identity Provider
          mappers to automatically assign federated users to organization groups based
          on external claims. Group membership is automatically included in OIDC tokens
          and SAML assertions when an organization context is requested.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/docs/26.6.0/server_admin/#_managing_groups_\">Managing
          organization groups</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_new_groups_scope_for_user_membership_changes\">New Groups scope for
          user membership changes</h4>\n<div class=\"paragraph\">\n<p>Fine-Grained
          Admin Permissions (FGAP) now includes a new <code>Groups</code> scope: <code>manage-membership-of-members</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>This scope is now used as the group-side bridge
          for evaluating user-side <code>manage-group-membership</code> permissions
          based on a user&#&#8203;8217;s current group memberships.\nThe existing
          <code>manage-membership</code> scope keeps its current behavior for target
          group membership management operations.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_looking_up_client_secrets_via_the_vault_spi\">Looking up client secrets
          via the Vault SPI</h4>\n<div class=\"paragraph\">\n<p>Secrets for clients
          can now be managed and looked up by the Vault SPI.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank
          you to <a href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for
          contributing this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_forcing_password_change_for_ldap_users\">Forcing password change for
          LDAP users</h4>\n<div class=\"paragraph\">\n<p>There is now initial support
          for LDAP password policy control.\nThe support is limited to prompting users
          to update their password when the LDAP server indicates that the password
          must be changed.\nPreviously, Keycloak let the user in and ignored the mandatory
          password reset.\nThere is a new optional setting &#&#8203;8220;Enable LDAP
          password policy&#&#8203;8221; in the LDAP advanced settings to enable this.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Thank you to <a href=\"https://redirect.github.com/tsaarni\">Tero
          Saarni</a> for contributing this change.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_configuring_and_running\">Configuring and Running</h3>\n<div
          class=\"sect3\">\n<h4 id=\"_java_25_support\">Java 25 support</h4>\n<div
          class=\"paragraph\">\n<p>Keycloak now supports running with OpenJDK 25.\nThe
          server container image continues to use OpenJDK 21 for now to support FIPS
          mode. For details, see the\nnote in the FIPS guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_zero_downtime_patch_releases_supported\">Zero-downtime
          patch releases (supported)</h4>\n<div class=\"paragraph\">\n<p>Zero-downtime
          patch releases allow you to perform rolling updates when upgrading to a
          newer patch version within the same <code>major.minor</code> release stream
          without service downtime.</p>\n</div>\n<div class=\"paragraph\">\n<p>In
          this release, zero-downtime patch releases are promoted to supported and
          enabled by default.\nWhen using the Keycloak Operator, set the update strategy
          to <code>Auto</code> to benefit from this functionality.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details on the Operator configuration,
          see the <a href=\"https://www.keycloak.org/operator/rolling-updates\">Avoiding
          downtime with rolling updates</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_installation_instructions_for_cloudnativepg\">Installation instructions
          for CloudNativePG</h4>\n<div class=\"paragraph\">\n<p>For those running
          Keycloak on Kubernetes, there is now a guide on how to deploy a PostgreSQL
          database on Kubernetes by leveraging the CloudNativePG Operator and how
          to connect Keycloak to the database.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          <a href=\"https://www.keycloak.org/nightly/high-availability/single-cluster/deploy-cnpg\">Deploying
          CloudNativePG in multiple availability zones</a> in the High Availability
          Guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_simplified_database_operations\">Simplified
          database operations</h4>\n<div class=\"paragraph\">\n<p>Several new command
          line options simplify the database operations for Keycloak and remove the
          need to use raw JDBC connection options:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p>Configure
          TLS for the database connection.</p>\n</li>\n<li>\n<p>Database connection
          timeouts.</p>\n</li>\n<li>\n<p>Transaction timeouts with production-ready
          defaults.</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>It also
          verifies the correct UTF-8 character encoding of the database at startup
          and prints a warning if this is not the case.</p>\n</div>\n<div class=\"paragraph\">\n<p>When
          running on orchestrators like Kubernetes, the startup and liveness probes
          return UP during database migrations, simplifying upgrades by removing the
          need to adjust the probes during upgrades.</p>\n</div>\n<div class=\"paragraph\">\n<p>See
          the migration guide for additional details on each aspect.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_graceful_shutdown_of_http_stack\">Graceful shutdown
          of HTTP stack</h4>\n<div class=\"paragraph\">\n<p>To allow rolling updates
          for configuration changes or version updates, a graceful shutdown of Keycloak
          nodes prevents users from seeing error responses when logging in or refreshing
          their tokens when nodes shut down.</p>\n</div>\n<div class=\"paragraph\">\n<p>Starting
          with this version, Keycloak supports a graceful shutdown of the HTTP stack.\nThis
          includes delaying a shutdown after receiving a termination signal, connection
          draining for HTTP/1.1 and HTTP/2 connections during that period, and a shutdown
          timeout to finish ongoing requests.</p>\n</div>\n<div class=\"paragraph\">\n<p>The
          defaults are a shutdown delay and a shutdown timeout of one second each.\nThis
          should be a good fit for setups where the reverse proxy is using TLS edge
          termination or re-encryption and the reverse proxy is notified about the
          Keycloak node shutting down at the same time as the Keycloak node.\nThis
          is a common setup, for example, in Kubernetes environments.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Users should adjust those values depending on their
          proxy setup.\nSee the section <a href=\"https://www.keycloak.org/server/reverseproxy#graceful-http-shutdown\">Graceful
          HTTP shutdown</a> in the reverse proxy guide for more information.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_new_kcraw_prefix_for_environment_variables_to_preserve_literal_values\">New
          <code>KCRAW_</code> prefix for environment variables to preserve literal
          values</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports a <code>KCRAW_</code>
          prefix for environment variables to preserve values containing <code>$</code>
          characters exactly as written, without expression evaluation.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>When using the standard <code>KC_</code> prefix,
          Keycloak (via SmallRye Config) evaluates expressions in values (for example,
          <code>${some_key}</code> is resolved and <code>$$</code> is collapsed to
          <code>$</code>).\nThis can silently modify passwords or secrets injected
          by a secrets manager or orchestration tool where manual escaping is not
          feasible.</p>\n</div>\n<div class=\"paragraph\">\n<p>Setting <code>KCRAW_&lt;KEY&gt;</code>
          instead of <code>KC_&lt;KEY&gt;</code> preserves the value exactly as provided.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>See the <a href=\"https://www.keycloak.org/server/configuration#kcraw-prefix\">Preserving
          literal values with the KCRAW_ prefix</a> section in the Server Configuration
          guide for details.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_reload_of_lists_with_disallowed_passwords\">Automatic
          reload of lists with disallowed passwords</h4>\n<div class=\"paragraph\">\n<p>When
          a list of disallowed passwords (also known as blacklist) changes, it is
          automatically reloaded. This avoids the need for a server restart when the
          list changes.</p>\n</div>\n<div class=\"paragraph\">\n<p>Thank you to <a
          href=\"https://redirect.github.com/tsaarni\">Tero Saarni</a> for contributing
          this change.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_automatic_truststore_initialization_on_kubernetes_and_openshift\">Automatic
          truststore initialization on Kubernetes and OpenShift</h4>\n<div class=\"paragraph\">\n<p>Keycloak
          now automatically discovers and trusts cluster certificate authorities when
          running on Kubernetes or OpenShift, without requiring the Operator to preconfigure
          the truststore.</p>\n</div>\n<div class=\"paragraph\">\n<p>If present in
          the container filesystem, the following certificates are added to the system
          truststore at startup:</p>\n</div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code>
          (Kubernetes service account CA)</p>\n</li>\n<li>\n<p><code>/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt</code>
          (OpenShift service CA)</p>\n</li>\n</ul>\n</div>\n<div class=\"paragraph\">\n<p>This
          behavior is enabled by default and can be controlled with the server option
          <code>--truststore-kubernetes-enabled=true|false</code> (default: <code>true</code>).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Most deployments do not require any action. If
          you relied on the Operator to manage these truststore entries previously,
          the server now performs the same function directly.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_client_certificate_lookup_providers_for_traefik_and_envoy\">Client
          certificate lookup providers for Traefik and Envoy</h4>\n<div class=\"paragraph\">\n<p>You
          can now use new client certificate lookup providers for Traefik and Envoy
          proxies.\nFor details, see the <a href=\"https://www.keycloak.org/server/reverseproxy#_enabling_client_certificate_lookup\">Enabling
          Client Certificate Lookup</a> section of the documentation.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_configurable_kubernetes_service_name_and_port_in_the_keycloak_operator\">Configurable
          Kubernetes Service name and port in the Keycloak Operator</h4>\n<div class=\"paragraph\">\n<p>The
          Keycloak Operator now supports overriding the name and port of the Kubernetes
          Service it creates for a Keycloak deployment.</p>\n</div>\n<div class=\"paragraph\">\n<p>Previously,
          the Service name was always derived as <code>&lt;cr-name&gt;-service</code>
          and the Service port always matched the container port.\nYou can now use
          the <code>spec.http.serviceName</code>, <code>spec.http.serviceHttpsPort</code>,
          and <code>spec.http.serviceHttpPort</code> fields to\nconfigure these independently.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration\">Advanced
          configuration</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_sensitive_information_is_not_displayed_in_the_http_access_log\">Sensitive
          information is not displayed in the HTTP Access log</h4>\n<div class=\"paragraph\">\n<p>If
          you are using the HTTP Access logging capability, sensitive information
          is omitted.\nThis means that tokens in the 'Authorization' HTTP header and
          specific sensitive cookies are not shown.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_configurable_log_file_rotation\">Configurable log file rotation</h4>\n<div
          class=\"paragraph\">\n<p>It is now possible to configure log file rotation
          when using Keycloak&#&#8203;8217;s built-in file logging handler.\nThis
          includes a simple option to fully disable log rotation, which is useful
          when using an external log rotation solution such as <code>logrotate</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>To disable log file rotation:</p>\n</div>\n<div
          class=\"listingblock\">\n<div class=\"content\">\n<pre class=\"highlight\"><code
          class=\"language-bash\" data-lang=\"bash\">bin/kc.sh start --log=\"console,file\"
          --log-file-rotation-enabled=false</code></pre>\n</div>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see the <a href=\"https://www.keycloak.org/server/logging/file\">File
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_http_access_logs_in_a_dedicated_file\">HTTP
          access logs in a dedicated file</h4>\n<div class=\"paragraph\">\n<p>HTTP
          access logs can now be written to a dedicated file, separate from the server
          logs.\nThis makes it easier to process and archive access logs independently
          for security auditing and compliance monitoring.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://www.keycloak.org/server/logging#http-access-logging\">Configuring
          HTTP access logging</a>.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_customizable_service_fields_in_json_log_output\">Customizable service
          fields in JSON log output</h4>\n<div class=\"paragraph\">\n<p>Keycloak now
          provides native options to customize the <code>service.name</code> and <code>service.environment</code>
          fields in JSON log output across all log handlers (console, file, and syslog).</p>\n</div>\n<div
          class=\"paragraph\">\n<p>Previously, when using the ECS format, <code>service.name</code>
          and <code>service.environment</code> could not be overridden through Keycloak
          configuration.\nThis made it difficult to align JSON log fields with OpenTelemetry
          resource attributes.</p>\n</div>\n<div class=\"paragraph\">\n<p>You can
          now set these fields using <code>log-service-name</code> and <code>log-service-environment</code>.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>For more information, see the <a href=\"https://www.keycloak.org/server/logging#customize-service-fields\">Configuring
          logging</a> guide.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4 id=\"_new_and_updated_translations\">New
          and updated translations</h4>\n<div class=\"paragraph\">\n<p>New translations
          for Indonesian and Armenian were added. A warm welcome to the new language
          maintainers for these languages!\nThere are also new language maintainers
          for the Swedish translation, who translated all remaining message keys.
          Thank you so much!</p>\n</div>\n<div class=\"paragraph\">\n<p>Follow the
          translation progress on the <a href=\"https://www.keycloak.org/translations\">translation
          status page</a>, help translate, and read the translation guide on how to
          add additional languages.</p>\n</div>\n</div>\n<div class=\"sect3\">\n<h4
          id=\"_right_to_left_language_support_in_the_account_ui\">Right-to-left language
          support in the Account UI</h4>\n<div class=\"paragraph\">\n<p>Support for
          right-to-left (RTL) languages was added to the Login UI, Admin UI, and email
          templates several releases ago. This release adds initial RTL support to
          the Account UI, which completes this effort.</p>\n</div>\n</div>\n</div>\n<div
          class=\"sect2\">\n<h3 id=\"_observability\">Observability</h3>\n<div class=\"sect3\">\n<h4
          id=\"_telemetry_configuration_via_the_keycloak_cr\">Telemetry configuration
          via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>Keycloak now supports
          configuring the OpenTelemetry properties via the Keycloak CR when using
          the Operator.\nThese properties are shared among the available OpenTelemetry
          components - logs, metrics, and traces.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_custom_request_headers_for_opentelemetry\">Custom
          request headers for OpenTelemetry</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to set request headers for exporting telemetry via OpenTelemetry
          Protocol (OTLP).\nThis is mainly useful for providing tokens in the request.</p>\n</div>\n<div
          class=\"paragraph\">\n<p>You can specify these headers via the <code>telemetry-header-&lt;header&gt;</code>
          wildcard option, which accepts any custom header name.\nAlternatively, use
          <code>telemetry-logs-header-&lt;header&gt;</code> for OpenTelemetry Logs
          or <code>telemetry-metrics-header-&lt;header&gt;</code> for OpenTelemetry
          Metrics.</p>\n</div>\n<div class=\"paragraph\">\n<p>For more details, see
          the <a href=\"https://www.keycloak.org/observability/telemetry\">Centralize
          your observability stack with OpenTelemetry</a> guide.</p>\n</div>\n</div>\n<div
          class=\"sect3\">\n<h4 id=\"_service_monitor_annotations_and_labels_via_the_keycloak_cr\">Service
          Monitor annotations and labels via the Keycloak CR</h4>\n<div class=\"paragraph\">\n<p>It
          is now possible to configure service monitor labels and annotations via
          the Keycloak CR when using the Operator.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more details, see the <a href=\"https://www.keycloak.org/operator/advanced-configuration#_servicemonitor\">Advanced
          Configuration Operator</a> guide.</p>\n</div>\n</div>\n</div>\n<div class=\"sect2\">\n<h3
          id=\"_extension_development\">Extension Development</h3>\n<div class=\"sect3\">\n<h4
          id=\"_keycloak_test_framework_supported\">Keycloak Test Framework (supported)</h4>\n<div
          class=\"paragraph\">\n<p>The Keycloak Test Framework, based on JUnit 6,
          is now fully supported.</p>\n</div>\n<div class=\"paragraph\">\n<p>It replaces
          the previous solution built on top of Arquillian and JUnit 4.\nBehind the
          scenes, the framework handles the lifecycle of Keycloak, the database, and
          any injected resources such as realms and clients.</p>\n</div>\n<div class=\"paragraph\">\n<p>Tests
          simply declare what they want, including specific configuration, and the
          framework takes care of the rest.</p>\n</div>\n<div class=\"paragraph\">\n<p>For
          more information, see <a href=\"https://redirect.github.com/keycloak/keycloak/tree/main/test-framework#readme\">Keycloak
          Test Framework</a>.</p>\n</div>\n</div>\n</div>\n<h2>Upgrading</h2>\n<p>Before
          upgrading refer to <a href=\"https://www.keycloak.org/docs/latest/upgrading/#migration-changes\">the
          migration guide</a> for a complete list of changes.</p>\n\n<h2>All resolved
          issues</h2>\n\n<h3>Deprecated features</h3>\n<ul>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45156\">#&#8203;45156</a>
          Deprecate Token Exchange v1 </li>\n</ul>\n\n<h3>New features</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10155\">#&#8203;10155</a>
          Step-up authentication for SAML clients <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/13102\">#&#8203;13102</a>
          Add support for specifying `client.secret` using vault <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/39888\">#&#8203;39888</a>
          Workflows </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42634\">#&#8203;42634</a>
          Federated client authentication </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43144\">#&#8203;43144</a>
          OAuth Identity and Authorization Chaining Across Domains </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43146\">#&#8203;43146</a>
          New test framework </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43152\">#&#8203;43152</a>
          Authorization Grants </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43252\">#&#8203;43252</a>
          Zero-downtime upgrades between patch releases of Keycloak </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43257\">#&#8203;43257</a>
          Support a Kubernetes Native Database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43507\">#&#8203;43507</a>
          Add support for Organization-specific Groups </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43576\">#&#8203;43576</a>
          Authorization grant for social providers <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44833\">#&#8203;44833</a>
          [OID4VCI] Make natural_person configuration available in all formats <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45106\">#&#8203;45106</a>
          OAuth Client ID Metadata Document </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45284\">#&#8203;45284</a>
          CIMD - Persistent CIMD <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46633\">#&#8203;46633</a>
          keycloak operator: add support for different port and name for the kubernetes
          service definition in the keycloak CRD </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47011\">#&#8203;47011</a>
          Add debug helper utility to the test framework <code>test-framework</code></li>\n</ul>\n\n<h3>Enhancements</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/10618\">#&#8203;10618</a>
          Enhancements to logging config <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/14523\">#&#8203;14523</a>
          Add support for enforced password change with LDAP federation <code>ldap</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/17904\">#&#8203;17904</a>
          Support RTL UI <code>account/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/19374\">#&#8203;19374</a>
          Allow absolute path for cache-config-file? <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/19453\">#&#8203;19453</a>
          The default database transaction timeout should not be applied to Liquibase
          or data migrations <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/20618\">#&#8203;20618</a>
          Support enabling access logs <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/27986\">#&#8203;27986</a>
          Remove Liquibase dependency version from Keycloak root pom </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33160\">#&#8203;33160</a>
          Add support for X509 client certificate lookup for Envoy </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/33198\">#&#8203;33198</a>
          Introduce `resourcesCommonUrl` for E-Mail templates <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/33818\">#&#8203;33818</a>
          Request for Enhancement: Make x509cert-lookup SPI public </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/34435\">#&#8203;34435</a>
          OTEL: Add tracing ID to user facing error message <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/35298\">#&#8203;35298</a>
          Reverse proxy provided context path not working despite setting X-Forwarded-Prefix
          header <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36226\">#&#8203;36226</a>
          Provide a read only view of Identity Provider Mappers configuration screen
          to the Keycloak Admin UI </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/36710\">#&#8203;36710</a>
          Have a first-class CLI option to change Keycloak's transaction timeout <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38884\">#&#8203;38884</a>
          Upgrade command rolling updates for patch releases / step 3: Infinispan/JGroups
          support </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/38888\">#&#8203;38888</a>
          Avoid breaking DB changes during patch releases </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40902\">#&#8203;40902</a>
          More fully document operator upgrade scenarios, in particular with custom
          images <code>docs</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41330\">#&#8203;41330</a>
          Improve logging of JpaUserSessionPersisterProvider#expire </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41353\">#&#8203;41353</a>
          Provide HTTP access logs written to file with rotation <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41629\">#&#8203;41629</a>
          Remove Tracing workaround in Infinispan/JGroups classes </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42256\">#&#8203;42256</a>
          DB Connection Pool acquisition timeout errors on database failover  <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42626\">#&#8203;42626</a>
          Provide a way to add custom labels to generated ServiceMonitor </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42747\">#&#8203;42747</a>
          Make DPoP docs more detailed <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42876\">#&#8203;42876</a>
          dev mode should bind only to localhost if possible </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42900\">#&#8203;42900</a>
          Move the logic of scanning Kubernetes CA to Keycloak <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43589\">#&#8203;43589</a>
          Gracefully shutting down HTTP stack </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43701\">#&#8203;43701</a>
          Improve SimpleHttp API <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43829\">#&#8203;43829</a>
          Add createdTimestamp filter (before/after) to /admin/realms/{realm}/users
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44090\">#&#8203;44090</a>
          ErrorId for error screens and logging </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44101\">#&#8203;44101</a>
          Allow re-using server when running tests with the new framework </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44364\">#&#8203;44364</a>
          Improve client creation with PKCE in admin console <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44424\">#&#8203;44424</a>
          findClientSessionsClientIds performance issue <code>storage</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44459\">#&#8203;44459</a>
          Adding the log to the required action to show the cause of syntax violation
          of the LDAP policy <code>ldap</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44846\">#&#8203;44846</a>
          [OID4VCI]: Ensure OID4VCI optional fields are saved cleanly and use defaults
          <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44849\">#&#8203;44849</a>
          [OID4VCI] Add UI support for `vc.credential_signing_alg` in OID4VCI client
          scopes <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44973\">#&#8203;44973</a>
          Hide Remember Me session settings when Remember Me is disabled in realm
          login settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45006\">#&#8203;45006</a>
          [OID4VCI] Add support for user did as subject id <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45188\">#&#8203;45188</a>
          Upgrade to quarkus 3.30.5 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45220\">#&#8203;45220</a>
          OTEL: Ability to specify headers for exporters <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45231\">#&#8203;45231</a>
          [OID4VCI] Generate pre-authorized codes using the JWT format <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45254\">#&#8203;45254</a>
          Admin UI javascript bundle should have source mapping </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45278\">#&#8203;45278</a>
          Upgrade to Quarkus 3.33.x LTS </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45281\">#&#8203;45281</a>
          Add missing Swedish translations for admin theme messages <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45322\">#&#8203;45322</a>
          Linking user with idp fails with generic message if user is already linked
          <code>identity-brokering</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45337\">#&#8203;45337</a>
          Upgrade to Quarkus 3.31 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45348\">#&#8203;45348</a>
          OTEL: Add Telemetry options to Keycloak CR <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45360\">#&#8203;45360</a>
          Document that the the HA architectures are tested with Openshift 4.18 </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45467\">#&#8203;45467</a>
          Management interface endpoint lists available endpoints <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45620\">#&#8203;45620</a>
          Change default not-before validation to 10 second instead of 0 <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45623\">#&#8203;45623</a>
          Avoid unnecessary warning logs during the operator tests execution <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45629\">#&#8203;45629</a>
          HTTP access log written to file should be in a separate directory <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45689\">#&#8203;45689</a>
          When a user joins a role or group, it should not read all existing roles
          and groups from the database </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45704\">#&#8203;45704</a>
          Invite existing users from Admin UI <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45718\">#&#8203;45718</a>
          Improve error message when organization name cannot be used as alias </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45795\">#&#8203;45795</a>
          Promote Keycloak and KeycloakRealmImport CRDs to v2beta1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45841\">#&#8203;45841</a>
          Add revert button to client credentials page </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45880\">#&#8203;45880</a>
          SAMLEndpoint - increase extensibility by increasing accessibility of some
          private fields/methods </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45882\">#&#8203;45882</a>
          Use GroupResource context in Groups so that Group components can be reused
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45884\">#&#8203;45884</a>
          Testframework core has dependency on testcontainers </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45898\">#&#8203;45898</a>
          Supported Configurations guide </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45909\">#&#8203;45909</a>
          Add theme clarification blurb to Realm Settings <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45941\">#&#8203;45941</a>
          Do not use deprecated test containers in tests <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45944\">#&#8203;45944</a>
          OTEL: Use suggested 'code.function.name' for span attributes <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45965\">#&#8203;45965</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45992\">#&#8203;45992</a>
          Clarify operator instructions involving Wildcard certificates and OpenShift
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/45996\">#&#8203;45996</a>
          Enforce `LF` line endings on `*.tsx` files with `.gitattributes` </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45999\">#&#8203;45999</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46001\">#&#8203;46001</a>
          [OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest() <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46043\">#&#8203;46043</a>
          Upgrade to Quarkus 3.31.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46055\">#&#8203;46055</a>
          [OID4VCI] Confine test realm setup to TestCase.configureTestRealm() </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46156\">#&#8203;46156</a>
          Add node count and next-node selection to LoadBalancer API </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46164\">#&#8203;46164</a>
          Separate password and OTP brute force protection to prevent OTP bypass attacks
          by default </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46255\">#&#8203;46255</a>
          Upgrade to Quarkus 3.32.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46292\">#&#8203;46292</a>
          Allow to expose WellKnown provider via ServerMetadataResource </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46304\">#&#8203;46304</a>
          SPIFFE Identity Provider default TTL too low </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46355\">#&#8203;46355</a>
          [OID4VCI] Add support for CredentialScopeRepresentation <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46395\">#&#8203;46395</a>
          X509 Certificates passed from Traefik PassTlsClientCert middleware broken
          since 26.5.0 <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46421\">#&#8203;46421</a>
          Revisit Infinispan session idle and lifetime settings </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46429\">#&#8203;46429</a>
          Add username to BrokeredIdentityContext created from JWTBearer Grant <code>token-exchange/federated</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46471\">#&#8203;46471</a>
          Aggregate client-id field for improved Infinispan query </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46494\">#&#8203;46494</a>
          Allow customizing federated identity lookup in JWTAuthorizationGrantType
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46531\">#&#8203;46531</a>
          Consider exposing UUID for admin api v2 resources </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46556\">#&#8203;46556</a>
          For MSSQL Server, set `sendStringParametersAsUnicode` to `false` by default
          <code>storage</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46557\">#&#8203;46557</a>
          Keycloak should check the Unicode setup of the database on startup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46603\">#&#8203;46603</a>
          Add Database CLI options for TLS encryption for databases </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46617\">#&#8203;46617</a>
          MCP Documentation for 26.6 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46626\">#&#8203;46626</a>
          Allow to configure Client Assertion max expiration for Kubernetes Identity
          Provider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46627\">#&#8203;46627</a>
          Allow to configure Client Assertion max expiration for OIDC Identity Provider
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46657\">#&#8203;46657</a>
          Passwords containing `$$` or `${` patterns are mangled when set via environment
          variables (SmallRye expression evaluation) <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46671\">#&#8203;46671</a>
          Allow custom timeouts in DBLockProvider </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46689\">#&#8203;46689</a>
          Remove user input reflection in Token Introspection error responses <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46693\">#&#8203;46693</a>
          Group-level deny policies do not block `manage-group-membership` on group
          members <code>admin/fine-grained-permissions</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46699\">#&#8203;46699</a>
          CIMD - Performance: Avoid repeated convertContentFilledList() in verifyUri()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46701\">#&#8203;46701</a>
          CIMD - Performance: Single-pass HTTP Cache-Control header lookup </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46703\">#&#8203;46703</a>
          CIMD - Performance: Eliminate double URI parsing in ClientIdUriSchemeCondition.applyPolicy()
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46708\">#&#8203;46708</a>
          CIMD - Performance: Avoid streaming the directive list multipul times </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46711\">#&#8203;46711</a>
          Upgrade to Quarkus 3.32.1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46728\">#&#8203;46728</a>
          Use quarkus properties ahead of keycloak defaults or map from values </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46757\">#&#8203;46757</a>
          Upgrade to jackson-core 2.21.1 </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46765\">#&#8203;46765</a>
          Adding missing question mark </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46781\">#&#8203;46781</a>
          IdP alias is not clickable in organization's Identity Providers tab <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46796\">#&#8203;46796</a>
          Document that export is not a backup </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46809\">#&#8203;46809</a>
          Set a default connection timeout for all databases types </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46872\">#&#8203;46872</a>
          Be more explicit on how to enable OTel Logs and Metrics in Operator <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46874\">#&#8203;46874</a>
          Be more explicit in using the OTel Logs level <code>observability</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/46890\">#&#8203;46890</a>
          Upgrade to Quarkus 3.32.2 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46936\">#&#8203;46936</a>
          Reduce tightly coupling between client policy contexts and conditions/executors
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46964\">#&#8203;46964</a>
          Adding more Hungarian translations </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/46972\">#&#8203;46972</a>
          Clarify credentials field availability in GET /admin/realms/{realm}/users
          documentation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47038\">#&#8203;47038</a>
          Translation support for UI theme descriptions <code>translations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47081\">#&#8203;47081</a>
          Upgrade to Quarkus 3.32.3 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47130\">#&#8203;47130</a>
          Upgrade to Quarkus 3.33.0.CR1 <code>dist/quarkus</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47140\">#&#8203;47140</a>
          Add CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47146\">#&#8203;47146</a>
          Keycloak: no native option to customize JSON log service.name and service.environment
          fields <code>observability</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47163\">#&#8203;47163</a>
          Enhancement: Password denylist file changes should not require server restart
          </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47187\">#&#8203;47187</a>
          Asynchronous server initialization </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47229\">#&#8203;47229</a>
          Identity Provider redirection via kc_idp_hint in Pushed Authorization Request
          <code>oidc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47416\">#&#8203;47416</a>
          Async startup doesn't be enabled when the health check is not enabled </li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/47535\">#&#8203;47535</a>
          Polishing CNPG installation docs </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/47667\">#&#8203;47667</a>
          Update release-notes for CIMD </li>\n</ul>\n\n<h3>Bugs</h3>\n<ul>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/22569\">#&#8203;22569</a>
          Provide descriptions for default realm-management roles <code>admin/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/26946\">#&#8203;26946</a>
          Multiple protocolMappers with the same name. <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/28970\">#&#8203;28970</a>
          Documention about the default db-schema is ambiguous <code>docs</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/36593\">#&#8203;36593</a>
          Built-in authentication flows are not updated for KC 26 <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/37231\">#&#8203;37231</a>
          Set New Password Multiple Times via Password Reset Function <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/38991\">#&#8203;38991</a>
          [Test framework] Embedded server -> dependency download error when no version
          is specified <code>test-framework</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/39127\">#&#8203;39127</a>
          Incorrect return code with JWT algorithm set to none <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40510\">#&#8203;40510</a>
          Organization flow do not redirect when credentials exist <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/40753\">#&#8203;40753</a>
          Resource leak: FileInputStream in Util.readProperties(File) is never closed
          .SAST <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/40921\">#&#8203;40921</a>
          Reject invalid resource IDs in permission creation </li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/41165\">#&#8203;41165</a>
          Feishu login has been continuously failing as an identity provider <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41630\">#&#8203;41630</a>
          Warning log message SRCFG01008: The value default has been converted by
          a Boolean Converter to \"false\" <code>dist/quarkus</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/41924\">#&#8203;41924</a>
          Internal server error after changing Admin UI theme to \"base\" - An old,
          persisted problem <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42222\">#&#8203;42222</a>
          Federation Cache Policy details not shown when editing provider in Keycloak
          26.3+ <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/42836\">#&#8203;42836</a>
          Organization selection changes after token refresh <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/42839\">#&#8203;42839</a>
          UserInfo endpoint returns incorrect organization claim <code>organizations</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43198\">#&#8203;43198</a>
          Operator status patching of keycloak failed <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43201\">#&#8203;43201</a>
          entity mappings not working on 26.4 <code>core</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43356\">#&#8203;43356</a>
          Keycloak tests framework - issue to identify distribution directory inside
          ZIP file when version string uses suffix <code>test-framework</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43613\">#&#8203;43613</a>
          case insensitive match on organization identity provider domain - In case
          'ANY' option is chosen <code>organizations</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43726\">#&#8203;43726</a>
          Slow evaluation of client roles with dots for role mapper and others <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43757\">#&#8203;43757</a>
          Code Examples in Authentication SPI Documentation Don't Match Quickstarts
          Repository <code>authentication</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43854\">#&#8203;43854</a>
          OID4VCI credentials have invalid subject id value <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/43949\">#&#8203;43949</a>
          MultivaluedString in mappers is not saved to backend with shown default
          value <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/43991\">#&#8203;43991</a>
          Keycloak operator - Reconciliation failure <code>operator</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44099\">#&#8203;44099</a>
          Out of memory after 3-4 restarts of embedded server <code>testsuite</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44100\">#&#8203;44100</a>
          Issue with starting server results in connection refused exception in test
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44132\">#&#8203;44132</a>
          Bug -> Keycloak preview feature \"scripts\" is enabled by default <code>authentication</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44283\">#&#8203;44283</a>
          Flaky test: org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test06_addingUserToNewKeycloakGroup
          <code>ci</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44403\">#&#8203;44403</a>
          DCR endpoint ignores client's requested token_endpoint_auth_method <code>oidc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44425\">#&#8203;44425</a>
          [Keycloak JS CI] Admin UI E2E Firefox failure <code>ci</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44498\">#&#8203;44498</a>
          [quick-theme] Logo and Favicon problem <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44574\">#&#8203;44574</a>
          Unable to find contextual data of type: org.keycloak.models.KeycloakSession
          <code>testsuite</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44598\">#&#8203;44598</a>
          SAML user created with null username when mapped attribute missing <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44622\">#&#8203;44622</a>
          OID4VCI functionality should be disabled for the realm when \"Verified Credentials\"
          switch is disabled <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44637\">#&#8203;44637</a>
          Fail to import the realm with OID4VCI enabled <code>import-export</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44670\">#&#8203;44670</a>
          CredentialEndpoint can be invoked with incorrect access token <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44678\">#&#8203;44678</a>
          Inconsistent search when using wildcards <code>admin/api</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44699\">#&#8203;44699</a>
          Not able to find key for credential signature if client scope was saved
          from admin console <code>admin/ui</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44737\">#&#8203;44737</a>
          CredentialRequest requires that client scope is assigned as 'Optional' <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44784\">#&#8203;44784</a>
          link to reset-credentials ignores default locale AND ui_locales <code>login/ui</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44803\">#&#8203;44803</a>
          Unhandled IllegalArgumentException in SAMLRequestParser <code>saml</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44807\">#&#8203;44807</a>
          [OID4VCI] Default values are not set for ClientScope <code>core</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44819\">#&#8203;44819</a>
          Missing validation error label on UI when editing a user <code>user-profile</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44824\">#&#8203;44824</a>
          Keycloak retains mapped firstName value and does not nullify it when upstream
          identity provider stops sending the claim <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44875\">#&#8203;44875</a>
          [OID4VCI] CredentialSignerException: Proof Type null is not supported for
          format ldp_vc <code>oid4vc</code></li>\n<li><a href=\"https://redirect.github.com/keycloak/keycloak/issues/44905\">#&#8203;44905</a>
          Email is not updated based on upstream IdP email <code>identity-brokering</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/44961\">#&#8203;44961</a>
          Authorization_details added to token-response even when should not be <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45005\">#&#8203;45005</a>
          [OID4VCI] Revisit and fix /credential_offer_uri endpoint  <code>oid4vc</code></li>\n<li><a
          href=\"https://redirect.github.com/keycloak/keycloak/issues/45058\">#&#8203;45058</a>
          Base theme: \"user properties\" and \"register\" required mark is\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Enabled.\n\n\u267B **Rebasing**: Whenever
          PR is behind base branch, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/YAKEcloud/yake-ansible).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/YAKEcloud/yake-ansible/pull/582
        commit_id: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        patchset: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
        project:
          canonical_hostname: github.com
          canonical_name: github.com/YAKEcloud/yake-ansible
          name: YAKEcloud/yake-ansible
          short_name: yake-ansible
          src_dir: src/github.com/YAKEcloud/yake-ansible
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IGtleWNsb2FrL2tleWNsb2FrIHRvIHYyNi42LjAKCj4g4oS577iPICoqTm90ZSoqCj4gCj4gVGhpcyBQUiBib2R5IHdhcyB0cnVuY2F0ZWQgZHVlIHRvIHBsYXRmb3JtIGxpbWl0cy4KClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgVXBkYXRlIHwgQ2hhbmdlIHwKfC0tLXwtLS18LS0tfAp8IFtrZXljbG9hay9rZXljbG9ha10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrKSB8IG1pbm9yIHwgYDI2LjUuN2Ag4oaSIGAyNi42LjBgIHwKCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5rZXljbG9hay9rZXljbG9hayAoa2V5Y2xvYWsva2V5Y2xvYWspPC9zdW1tYXJ5PgoKIyMjIFtgdjI2LjYuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9yZWxlYXNlcy90YWcvMjYuNi4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvY29tcGFyZS8yNi41LjcuLi4yNi42LjApCgo8ZGl2PgogICAgPGgyPkhpZ2hsaWdodHM8L2gyPgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UaGlzIHJlbGVhc2UgZmVhdHVyZXMgbmV3IGNhcGFiaWxpdGllcyBmb3IgdXNlcnMgYW5kIGFkbWluaXN0cmF0b3JzIG9mIEtleWNsb2FrLiBUaGUgaGlnaGxpZ2h0cyBvZiB0aGlzIHJlbGVhc2UgYXJlOjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InVsaXN0Ij4KPHVsPgo8bGk+CjxwPjxzdHJvbmc+SldUIEF1dGhvcml6YXRpb24gR3JhbnQ8L3N0cm9uZz4sIGVuYWJsaW5nIGV4dGVybmFsLXRvLWludGVybmFsIHRva2VuIGV4Y2hhbmdlIHVzaW5nIGV4dGVybmFsbHkgc2lnbmVkIEpXVCBhc3NlcnRpb25zLjwvcD4KPC9saT4KPGxpPgo8cD48c3Ryb25nPkZlZGVyYXRlZCBjbGllbnQgYXV0aGVudGljYXRpb248L3N0cm9uZz4sIGVsaW1pbmF0aW5nIHRoZSBuZWVkIHRvIG1hbmFnZSBpbmRpdmlkdWFsIGNsaWVudCBzZWNyZXRzIGluIEtleWNsb2FrLjwvcD4KPC9saT4KPGxpPgo8cD48c3Ryb25nPldvcmtmbG93czwvc3Ryb25nPiwgZW5hYmxpbmcgYWRtaW5pc3RyYXRvcnMgdG8gYXV0b21hdGUgcmVhbG0gYWRtaW5pc3RyYXRpdmUgdGFza3Mgc3VjaCBhcyB1c2VyIGFuZCBjbGllbnQgbGlmZWN5Y2xlIG1hbmFnZW1lbnQuPC9wPgo8L2xpPgo8bGk+CjxwPjxzdHJvbmc+WmVyby1kb3dudGltZSBwYXRjaCByZWxlYXNlczwvc3Ryb25nPiwgYWxsb3dpbmcgcm9sbGluZyB1cGRhdGVzIHdpdGhpbiBhIG1pbm9yIHJlbGVhc2Ugc3RyZWFtIHdpdGhvdXQgc2VydmljZSBkb3dudGltZS48L3A+CjwvbGk+CjxsaT4KPHA+VGhlIDxzdHJvbmc+S2V5Y2xvYWsgVGVzdCBGcmFtZXdvcms8L3N0cm9uZz4sIHJlcGxhY2luZyB0aGUgcHJldmlvdXMgQXJxdWlsbGlhbi1iYXNlZCBzb2x1dGlvbi48L3A+CjwvbGk+CjwvdWw+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5BbGwgb2YgdGhlc2UgZmVhdHVyZXMgYXJlIG5vdyBmdWxseSBzdXBwb3J0ZWQgYW5kIG5vIGxvbmdlciBpbiBwcmV2aWV3LgpSZWFkIG9uIHRvIGxlYXJuIG1vcmUgYWJvdXQgZWFjaCBuZXcgZmVhdHVyZS4KSWYgeW91IGFyZSB1cGdyYWRpbmcgZnJvbSBhIHByZXZpb3VzIHJlbGVhc2UsIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9kb2NzL2xhdGVzdC91cGdyYWRpbmcvaW5kZXguaHRtbCI+YWxzbyByZXZpZXcgdGhlIGNoYW5nZXMgbGlzdGVkIGluIHRoZSB1cGdyYWRpbmcgZ3VpZGU8L2E+LjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QyIj4KPGgzIGlkPSJfc2VjdXJpdHlfYW5kX3N0YW5kYXJkcyI+U2VjdXJpdHkgYW5kIFN0YW5kYXJkczwvaDM+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfand0X2F1dGhvcml6YXRpb25fZ3JhbnRfc3VwcG9ydGVkIj5KV1QgQXV0aG9yaXphdGlvbiBHcmFudCAoc3VwcG9ydGVkKTwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkpXVCBBdXRob3JpemF0aW9uIEdyYW50ICg8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL3JmYzc1MjMiPlJGQyA3NTIzPC9hPikgaXMgZGVzaWduZWQgdG8gaW1wbGVtZW50IGV4dGVybmFsLXRvLWludGVybmFsIHRva2VuIGV4Y2hhbmdlIHVzZSBjYXNlcy4gVGhpcyBncmFudCBhbGxvd3MgdXNpbmcgZXh0ZXJuYWxseSBzaWduZWQgSldUIGFzc2VydGlvbnMgdG8gcmVxdWVzdCBPQXV0aCAyLjAgYWNjZXNzIHRva2Vucy48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5JbiB0aGlzIHJlbGVhc2UsIEpXVCBBdXRob3JpemF0aW9uIEdyYW50IGlzIHByb21vdGVkIGZyb20gcHJldmlldyB0byBzdXBwb3J0ZWQuIFNlZSB0aGUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlY3VyaW5nLWFwcHMvand0LWF1dGhvcml6YXRpb24tZ3JhbnQiPkpXVCBBdXRob3JpemF0aW9uIEdyYW50IGd1aWRlPC9hPiBmb3IgYWRkaXRpb25hbCBkZXRhaWxzLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2ZlZGVyYXRlZF9jbGllbnRfYXV0aGVudGljYXRpb25fc3VwcG9ydGVkIj5GZWRlcmF0ZWQgY2xpZW50IGF1dGhlbnRpY2F0aW9uIChzdXBwb3J0ZWQpPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+RmVkZXJhdGVkIGNsaWVudCBhdXRoZW50aWNhdGlvbiBhbGxvd3MgY2xpZW50cyB0byBsZXZlcmFnZSBleGlzdGluZyBjcmVkZW50aWFscyBvbmNlIGEgdHJ1c3QgcmVsYXRpb25zaGlwIHdpdGggYW5vdGhlciBpc3N1ZXIgZXhpc3RzLiBJdCBlbGltaW5hdGVzIHRoZSBuZWVkIHRvIGFzc2lnbiBhbmQgbWFuYWdlIGluZGl2aWR1YWwgc2VjcmV0cyBmb3IgZWFjaCBjbGllbnQgaW4gS2V5Y2xvYWsuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+RmVkZXJhdGVkIGNsaWVudCBhdXRoZW50aWNhdGlvbiBpcyBub3cgcHJvbW90ZWQgdG8gc3VwcG9ydGVkLCBpbmNsdWRpbmcgc3VwcG9ydCBmb3IgY2xpZW50IGFzc2VydGlvbnMgaXNzdWVkIGJ5IGV4dGVybmFsIE9wZW5JRCBDb25uZWN0IGlkZW50aXR5IHByb3ZpZGVycyBhbmQgS3ViZXJuZXRlcyBTZXJ2aWNlIEFjY291bnRzLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlNpbmNlIHRoZSBPQXV0aCBTUElGRkUgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIHNwZWNpZmljYXRpb24gaXMgc3RpbGwgaW4gZHJhZnQgc3RhdHVzLCB0aGlzIGZlYXR1cmUgcmVtYWlucyBhIHByZXZpZXcgZmVhdHVyZSBpbiBLZXljbG9hay48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9uZXdfZ3VpZGVfYWJvdXRfZGVtb25zdHJhdGluZ19wcm9vZl9vZl9wb3NzZXNzaW9uX2Rwb3AiPk5ldyBndWlkZSBhYm91dCBEZW1vbnN0cmF0aW5nIFByb29mLW9mLVBvc3Nlc3Npb24gKERQb1ApPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+QSBuZXcgZ3VpZGUgZm9yIE9BdXRoIDIuMCBEZW1vbnN0cmF0aW5nIFByb29mLW9mLVBvc3Nlc3Npb24gKERQb1ApIGluIHRoZSBTZWN1cmluZyBhcHBsaWNhdGlvbnMgR3VpZGVzIHByb3ZpZGVzIGluZm9ybWF0aW9uIG9uIGhvdyB0byBtaXRpZ2F0ZSB0aGUgcmlzayBvZiBzdG9sZW4gdG9rZW5zIGJ5IG1ha2luZyB0b2tlbnMgc2VuZGVyLWNvbnN0cmFpbmVkLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlNlZSA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvbmlnaHRseS9zZWN1cmluZy1hcHBzL2Rwb3AiPlNlY3VyaW5nIGFwcGxpY2F0aW9ucyB3aXRoIERQb1A8L2E+IGZvciBtb3JlIGRldGFpbHMuPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfaWRlbnRpdHlfYnJva2VyaW5nX2FwaXNfdjJfcHJldmlldyI+SWRlbnRpdHkgQnJva2VyaW5nIEFQSXMgVjIgKHByZXZpZXcpPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+QSBuZXcgcHJldmlldyB2ZXJzaW9uIDIgZm9yIHRoZSBJZGVudGl0eSBCcm9rZXJpbmcgQVBJcyBpcyBpbnRyb2R1Y2VkIGluIHRoaXMgcmVsZWFzZS4gV2hlbiBicm9rZXJpbmcgaXMgdXNlZCBkdXJpbmcgdGhlIGF1dGhlbnRpY2F0aW9uIHByb2Nlc3MsIEtleWNsb2FrIGFsbG93cyB5b3UgdG8gc3RvcmUgdG9rZW5zIGFuZCByZXNwb25zZXMgaXNzdWVkIGJ5IHRoZSBleHRlcm5hbCBJZGVudGl0eSBQcm92aWRlci4gQXBwbGljYXRpb25zIGNhbiBjYWxsIGEgc3BlY2lmaWMgZW5kcG9pbnQgdG8gcmV0cmlldmUgdGhvc2UgdG9rZW5zLCB3aGljaCwgaW4gdHVybiwgY2FuIGJlIHVzZWQgdG8gZ2V0IGV4dHJhIHVzZXIgaW5mb3JtYXRpb24gb3IgaW52b2tlIGVuZHBvaW50cyBpbiB0aGUgZXh0ZXJuYWwgdHJ1c3QgZG9tYWluLiBUaGUgbmV3IHZlcnNpb24gaW1wcm92ZXMgdGhlIHRva2VuIHJldHJpZXZhbCBlbmRwb2ludCB0byBzdWJzdGl0dXRlIHRoZSBpbnRlcm5hbCB0byBleHRlcm5hbCBUb2tlbiBFeGNoYW5nZSAodXNlIGNhc2UgZm9yIHRoZSA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvc2VjdXJpbmctYXBwcy90b2tlbi1leGNoYW5nZSNfbGVnYWN5LXRva2VuLWV4Y2hhbmdlIj5sZWdhY3kgVG9rZW4gRXhjaGFuZ2UgVjE8L2E+KS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBpbmZvcm1hdGlvbiwgc2VlIHRoZSBjaGFwdGVyIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9kb2NzLzI2LjYuMC9zZXJ2ZXJfZGV2ZWxvcG1lbnQvI19pZGVudGl0eS1icm9rZXJpbmctYXBpcyI+SWRlbnRpdHkgQnJva2VyaW5nIEFQSXM8L2E+IGluIHRoZSBTZXJ2ZXIgRGV2ZWxvcGVyIEd1aWRlLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX3N0ZXBfdXBfYXV0aGVudGljYXRpb25fZm9yX3NhbWxfcHJldmlldyI+U3RlcC11cCBhdXRoZW50aWNhdGlvbiBmb3IgU0FNTCAocHJldmlldyk8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UaGUgZmVhdHVyZSA8Y29kZT5zdGVwLXVwLWF1dGhlbnRpY2F0aW9uLXNhbWw8L2NvZGU+IGV4dGVuZHMgdGhlIHN0ZXAtdXAgYXV0aGVudGljYXRpb24gdG8gaW5jbHVkZSB0aGUgU0FNTCBwcm90b2NvbCBhbmQgY2xpZW50cy4gVGhpcyBmZWF0dXJlIGlzIGluIHByZXZpZXcgbW9kZS4gQWRkaXRpb25hbCBpbmZvcm1hdGlvbiBpcyBhdmFpbGFibGUgaW4gdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9kb2NzLzI2LjYuMC9zZXJ2ZXJfYWRtaW4vI19zdGVwLXVwLWF1dGhlbnRpY2F0aW9uLXNhbWwiPlNlcnZlciBBZG1pbmlzdHJhdGlvbiBHdWlkZTwvYT4uPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfb2F1dGhfY2xpZW50X2lkX21ldGFkYXRhX2RvY3VtZW50X2V4cGVyaW1lbnRhbCI+T0F1dGggQ2xpZW50IElEIE1ldGFkYXRhIERvY3VtZW50IChleHBlcmltZW50YWwpPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvYXJjaGl2ZS9pZC9kcmFmdC1pZXRmLW9hdXRoLWNsaWVudC1pZC1tZXRhZGF0YS1kb2N1bWVudC0wMS5odG1sIj5PQXV0aCBDbGllbnQgSUQgTWV0YWRhdGEgRG9jdW1lbnQgKENJTUQpPC9hPiBpcyBhbiBlbWVyZ2luZyBzdGFuZGFyZCB0aGF0IGRlZmluZXMgYSBKU09OIGRvY3VtZW50IGZvcm1hdCBmb3IgZGVzY3JpYmluZyBPQXV0aCAyLjAgY2xpZW50IG1ldGFkYXRhLiBTaW5jZSB2ZXJzaW9uIDIwMjUtMTEtMjUsIHRoZSBNb2RlbCBDb250ZXh0IFByb3RvY29sIChNQ1ApIHJlcXVpcmVzIGFuIGF1dGhvcml6YXRpb24gc2VydmVyIHRvIGNvbXBseSB3aXRoIENJTUQuIEtleWNsb2FrIG5vdyBpbmNsdWRlcyBleHBlcmltZW50YWwgc3VwcG9ydCBmb3IgQ0lNRCwgYWxsb3dpbmcgaXQgdG8gc2VydmUgYXMgYW4gYXV0aG9yaXphdGlvbiBzZXJ2ZXIgZm9yIE1DUCB2ZXJzaW9uIDIwMjUtMTEtMjUgb3IgbGF0ZXIuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+U2VlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9zZWN1cmluZy1hcHBzL21jcC1hdXRoei1zZXJ2ZXIiPkludGVncmF0aW5nIHdpdGggTW9kZWwgQ29udGV4dCBQcm90b2NvbCAoTUNQKTwvYT4gZm9yIHRoZSB1cGRhdGVkIGd1aWRlIGluY2x1ZGluZyBDSU1ELjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPk1hbnkgdGhhbmtzIHRvIDxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS90bm9yaW1hdCI+VGFrYXNoaSBOb3JpbWF0c3U8L2E+IGZvciB0aGUgY29udHJpYnV0aW9uLjwvcD4KPC9kaXY+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDIiPgo8aDMgaWQ9Il9hZG1pbmlzdHJhdGlvbiI+QWRtaW5pc3RyYXRpb248L2gzPgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX3dvcmtmbG93c19zdXBwb3J0ZWQiPldvcmtmbG93cyAoc3VwcG9ydGVkKTwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPldvcmtmbG93cyBhbGxvdyBhZG1pbmlzdHJhdG9ycyB0byBhdXRvbWF0ZSBhbmQgb3JjaGVzdHJhdGUgcmVhbG0gYWRtaW5pc3RyYXRpdmUgdGFza3MsIGJyaW5naW5nIGtleSBjYXBhYmlsaXRpZXMgb2YgSWRlbnRpdHkgR292ZXJuYW5jZSBhbmQgQWRtaW5pc3RyYXRpb24gKElHQSkgdG8gS2V5Y2xvYWsuIEJ5IGRlZmluaW5nIHdvcmtmbG93cyBpbiBZQU1MIGZvcm1hdCwgeW91IGNhbiBhdXRvbWF0ZSB0aGUgbGlmZWN5Y2xlIG9mIHJlYWxtIHJlc291cmNlcyBzdWNoIGFzIHVzZXJzIGFuZCBjbGllbnRzIGJhc2VkIG9uIGV2ZW50cywgY29uZGl0aW9ucywgYW5kIHNjaGVkdWxlcy48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5JbiB0aGlzIHJlbGVhc2UsIFdvcmtmbG93cyBpcyBwcm9tb3RlZCBmcm9tIHByZXZpZXcgdG8gc3VwcG9ydGVkLiBUaGlzIHJlbGVhc2UgYWxzbyBpbmNsdWRlcyBuZXcgYnVpbHQtaW4gc3RlcHMsIGEgdHJvdWJsZXNob290aW5nIGd1aWRlLCBhbmQgdmFyaW91cyBpbXByb3ZlbWVudHMgdG8gdGhlIHdvcmtmbG93IGVuZ2luZS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBkZXRhaWxzLCBzZWUgdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9kb2NzLzI2LjYuMC9zZXJ2ZXJfYWRtaW4vI19tYW5hZ2luZ193b3JrZmxvd3MiPk1hbmFnaW5nIHdvcmtmbG93czwvYT4gY2hhcHRlciBpbiB0aGUgU2VydmVyIEFkbWluaXN0cmF0aW9uIEd1aWRlLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX29yZ2FuaXphdGlvbl9ncm91cHMiPk9yZ2FuaXphdGlvbiBncm91cHM8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Pcmdhbml6YXRpb25zIG5vdyBzdXBwb3J0IGlzb2xhdGVkIGdyb3VwIGhpZXJhcmNoaWVzLCBhbGxvd2luZyBlYWNoIG9yZ2FuaXphdGlvbiB0byBtYW5hZ2UgaXRzIG93biB0ZWFtcyBhbmQgZGVwYXJ0bWVudHMgd2l0aG91dCBuYW1pbmcgY29uZmxpY3RzIGFjcm9zcyB0aGUgcmVhbG0uIFRoaXMgdXBkYXRlIGluY2x1ZGVzIElkZW50aXR5IFByb3ZpZGVyIG1hcHBlcnMgdG8gYXV0b21hdGljYWxseSBhc3NpZ24gZmVkZXJhdGVkIHVzZXJzIHRvIG9yZ2FuaXphdGlvbiBncm91cHMgYmFzZWQgb24gZXh0ZXJuYWwgY2xhaW1zLiBHcm91cCBtZW1iZXJzaGlwIGlzIGF1dG9tYXRpY2FsbHkgaW5jbHVkZWQgaW4gT0lEQyB0b2tlbnMgYW5kIFNBTUwgYXNzZXJ0aW9ucyB3aGVuIGFuIG9yZ2FuaXphdGlvbiBjb250ZXh0IGlzIHJlcXVlc3RlZC48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBkZXRhaWxzLCBzZWUgdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9kb2NzLzI2LjYuMC9zZXJ2ZXJfYWRtaW4vI19tYW5hZ2luZ19ncm91cHNfIj5NYW5hZ2luZyBvcmdhbml6YXRpb24gZ3JvdXBzPC9hPiBndWlkZS48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9uZXdfZ3JvdXBzX3Njb3BlX2Zvcl91c2VyX21lbWJlcnNoaXBfY2hhbmdlcyI+TmV3IEdyb3VwcyBzY29wZSBmb3IgdXNlciBtZW1iZXJzaGlwIGNoYW5nZXM8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5GaW5lLUdyYWluZWQgQWRtaW4gUGVybWlzc2lvbnMgKEZHQVApIG5vdyBpbmNsdWRlcyBhIG5ldyA8Y29kZT5Hcm91cHM8L2NvZGU+IHNjb3BlOiA8Y29kZT5tYW5hZ2UtbWVtYmVyc2hpcC1vZi1tZW1iZXJzPC9jb2RlPi48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UaGlzIHNjb3BlIGlzIG5vdyB1c2VkIGFzIHRoZSBncm91cC1zaWRlIGJyaWRnZSBmb3IgZXZhbHVhdGluZyB1c2VyLXNpZGUgPGNvZGU+bWFuYWdlLWdyb3VwLW1lbWJlcnNoaXA8L2NvZGU+IHBlcm1pc3Npb25zIGJhc2VkIG9uIGEgdXNlciYjJiM4MjAzOzgyMTc7cyBjdXJyZW50IGdyb3VwIG1lbWJlcnNoaXBzLgpUaGUgZXhpc3RpbmcgPGNvZGU+bWFuYWdlLW1lbWJlcnNoaXA8L2NvZGU+IHNjb3BlIGtlZXBzIGl0cyBjdXJyZW50IGJlaGF2aW9yIGZvciB0YXJnZXQgZ3JvdXAgbWVtYmVyc2hpcCBtYW5hZ2VtZW50IG9wZXJhdGlvbnMuPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfbG9va2luZ191cF9jbGllbnRfc2VjcmV0c192aWFfdGhlX3ZhdWx0X3NwaSI+TG9va2luZyB1cCBjbGllbnQgc2VjcmV0cyB2aWEgdGhlIFZhdWx0IFNQSTwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlNlY3JldHMgZm9yIGNsaWVudHMgY2FuIG5vdyBiZSBtYW5hZ2VkIGFuZCBsb29rZWQgdXAgYnkgdGhlIFZhdWx0IFNQSS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UaGFuayB5b3UgdG8gPGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3RzYWFybmkiPlRlcm8gU2Fhcm5pPC9hPiBmb3IgY29udHJpYnV0aW5nIHRoaXMgY2hhbmdlLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2ZvcmNpbmdfcGFzc3dvcmRfY2hhbmdlX2Zvcl9sZGFwX3VzZXJzIj5Gb3JjaW5nIHBhc3N3b3JkIGNoYW5nZSBmb3IgTERBUCB1c2VyczwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlRoZXJlIGlzIG5vdyBpbml0aWFsIHN1cHBvcnQgZm9yIExEQVAgcGFzc3dvcmQgcG9saWN5IGNvbnRyb2wuClRoZSBzdXBwb3J0IGlzIGxpbWl0ZWQgdG8gcHJvbXB0aW5nIHVzZXJzIHRvIHVwZGF0ZSB0aGVpciBwYXNzd29yZCB3aGVuIHRoZSBMREFQIHNlcnZlciBpbmRpY2F0ZXMgdGhhdCB0aGUgcGFzc3dvcmQgbXVzdCBiZSBjaGFuZ2VkLgpQcmV2aW91c2x5LCBLZXljbG9hayBsZXQgdGhlIHVzZXIgaW4gYW5kIGlnbm9yZWQgdGhlIG1hbmRhdG9yeSBwYXNzd29yZCByZXNldC4KVGhlcmUgaXMgYSBuZXcgb3B0aW9uYWwgc2V0dGluZyAmIyYjODIwMzs4MjIwO0VuYWJsZSBMREFQIHBhc3N3b3JkIHBvbGljeSYjJiM4MjAzOzgyMjE7IGluIHRoZSBMREFQIGFkdmFuY2VkIHNldHRpbmdzIHRvIGVuYWJsZSB0aGlzLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlRoYW5rIHlvdSB0byA8YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdHNhYXJuaSI+VGVybyBTYWFybmk8L2E+IGZvciBjb250cmlidXRpbmcgdGhpcyBjaGFuZ2UuPC9wPgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MiI+CjxoMyBpZD0iX2NvbmZpZ3VyaW5nX2FuZF9ydW5uaW5nIj5Db25maWd1cmluZyBhbmQgUnVubmluZzwvaDM+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfamF2YV8yNV9zdXBwb3J0Ij5KYXZhIDI1IHN1cHBvcnQ8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5LZXljbG9hayBub3cgc3VwcG9ydHMgcnVubmluZyB3aXRoIE9wZW5KREsgMjUuClRoZSBzZXJ2ZXIgY29udGFpbmVyIGltYWdlIGNvbnRpbnVlcyB0byB1c2UgT3BlbkpESyAyMSBmb3Igbm93IHRvIHN1cHBvcnQgRklQUyBtb2RlLiBGb3IgZGV0YWlscywgc2VlIHRoZQpub3RlIGluIHRoZSBGSVBTIGd1aWRlLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX3plcm9fZG93bnRpbWVfcGF0Y2hfcmVsZWFzZXNfc3VwcG9ydGVkIj5aZXJvLWRvd250aW1lIHBhdGNoIHJlbGVhc2VzIChzdXBwb3J0ZWQpPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+WmVyby1kb3dudGltZSBwYXRjaCByZWxlYXNlcyBhbGxvdyB5b3UgdG8gcGVyZm9ybSByb2xsaW5nIHVwZGF0ZXMgd2hlbiB1cGdyYWRpbmcgdG8gYSBuZXdlciBwYXRjaCB2ZXJzaW9uIHdpdGhpbiB0aGUgc2FtZSA8Y29kZT5tYWpvci5taW5vcjwvY29kZT4gcmVsZWFzZSBzdHJlYW0gd2l0aG91dCBzZXJ2aWNlIGRvd250aW1lLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkluIHRoaXMgcmVsZWFzZSwgemVyby1kb3dudGltZSBwYXRjaCByZWxlYXNlcyBhcmUgcHJvbW90ZWQgdG8gc3VwcG9ydGVkIGFuZCBlbmFibGVkIGJ5IGRlZmF1bHQuCldoZW4gdXNpbmcgdGhlIEtleWNsb2FrIE9wZXJhdG9yLCBzZXQgdGhlIHVwZGF0ZSBzdHJhdGVneSB0byA8Y29kZT5BdXRvPC9jb2RlPiB0byBiZW5lZml0IGZyb20gdGhpcyBmdW5jdGlvbmFsaXR5LjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkZvciBtb3JlIGRldGFpbHMgb24gdGhlIE9wZXJhdG9yIGNvbmZpZ3VyYXRpb24sIHNlZSB0aGUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL29wZXJhdG9yL3JvbGxpbmctdXBkYXRlcyI+QXZvaWRpbmcgZG93bnRpbWUgd2l0aCByb2xsaW5nIHVwZGF0ZXM8L2E+IGd1aWRlLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2luc3RhbGxhdGlvbl9pbnN0cnVjdGlvbnNfZm9yX2Nsb3VkbmF0aXZlcGciPkluc3RhbGxhdGlvbiBpbnN0cnVjdGlvbnMgZm9yIENsb3VkTmF0aXZlUEc8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgdGhvc2UgcnVubmluZyBLZXljbG9hayBvbiBLdWJlcm5ldGVzLCB0aGVyZSBpcyBub3cgYSBndWlkZSBvbiBob3cgdG8gZGVwbG95IGEgUG9zdGdyZVNRTCBkYXRhYmFzZSBvbiBLdWJlcm5ldGVzIGJ5IGxldmVyYWdpbmcgdGhlIENsb3VkTmF0aXZlUEcgT3BlcmF0b3IgYW5kIGhvdyB0byBjb25uZWN0IEtleWNsb2FrIHRvIHRoZSBkYXRhYmFzZS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5TZWUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL25pZ2h0bHkvaGlnaC1hdmFpbGFiaWxpdHkvc2luZ2xlLWNsdXN0ZXIvZGVwbG95LWNucGciPkRlcGxveWluZyBDbG91ZE5hdGl2ZVBHIGluIG11bHRpcGxlIGF2YWlsYWJpbGl0eSB6b25lczwvYT4gaW4gdGhlIEhpZ2ggQXZhaWxhYmlsaXR5IEd1aWRlIGZvciBkZXRhaWxzLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX3NpbXBsaWZpZWRfZGF0YWJhc2Vfb3BlcmF0aW9ucyI+U2ltcGxpZmllZCBkYXRhYmFzZSBvcGVyYXRpb25zPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+U2V2ZXJhbCBuZXcgY29tbWFuZCBsaW5lIG9wdGlvbnMgc2ltcGxpZnkgdGhlIGRhdGFiYXNlIG9wZXJhdGlvbnMgZm9yIEtleWNsb2FrIGFuZCByZW1vdmUgdGhlIG5lZWQgdG8gdXNlIHJhdyBKREJDIGNvbm5lY3Rpb24gb3B0aW9uczo8L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJ1bGlzdCI+Cjx1bD4KPGxpPgo8cD5Db25maWd1cmUgVExTIGZvciB0aGUgZGF0YWJhc2UgY29ubmVjdGlvbi48L3A+CjwvbGk+CjxsaT4KPHA+RGF0YWJhc2UgY29ubmVjdGlvbiB0aW1lb3V0cy48L3A+CjwvbGk+CjxsaT4KPHA+VHJhbnNhY3Rpb24gdGltZW91dHMgd2l0aCBwcm9kdWN0aW9uLXJlYWR5IGRlZmF1bHRzLjwvcD4KPC9saT4KPC91bD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkl0IGFsc28gdmVyaWZpZXMgdGhlIGNvcnJlY3QgVVRGLTggY2hhcmFjdGVyIGVuY29kaW5nIG9mIHRoZSBkYXRhYmFzZSBhdCBzdGFydHVwIGFuZCBwcmludHMgYSB3YXJuaW5nIGlmIHRoaXMgaXMgbm90IHRoZSBjYXNlLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPldoZW4gcnVubmluZyBvbiBvcmNoZXN0cmF0b3JzIGxpa2UgS3ViZXJuZXRlcywgdGhlIHN0YXJ0dXAgYW5kIGxpdmVuZXNzIHByb2JlcyByZXR1cm4gVVAgZHVyaW5nIGRhdGFiYXNlIG1pZ3JhdGlvbnMsIHNpbXBsaWZ5aW5nIHVwZ3JhZGVzIGJ5IHJlbW92aW5nIHRoZSBuZWVkIHRvIGFkanVzdCB0aGUgcHJvYmVzIGR1cmluZyB1cGdyYWRlcy48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5TZWUgdGhlIG1pZ3JhdGlvbiBndWlkZSBmb3IgYWRkaXRpb25hbCBkZXRhaWxzIG9uIGVhY2ggYXNwZWN0LjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2dyYWNlZnVsX3NodXRkb3duX29mX2h0dHBfc3RhY2siPkdyYWNlZnVsIHNodXRkb3duIG9mIEhUVFAgc3RhY2s8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UbyBhbGxvdyByb2xsaW5nIHVwZGF0ZXMgZm9yIGNvbmZpZ3VyYXRpb24gY2hhbmdlcyBvciB2ZXJzaW9uIHVwZGF0ZXMsIGEgZ3JhY2VmdWwgc2h1dGRvd24gb2YgS2V5Y2xvYWsgbm9kZXMgcHJldmVudHMgdXNlcnMgZnJvbSBzZWVpbmcgZXJyb3IgcmVzcG9uc2VzIHdoZW4gbG9nZ2luZyBpbiBvciByZWZyZXNoaW5nIHRoZWlyIHRva2VucyB3aGVuIG5vZGVzIHNodXQgZG93bi48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5TdGFydGluZyB3aXRoIHRoaXMgdmVyc2lvbiwgS2V5Y2xvYWsgc3VwcG9ydHMgYSBncmFjZWZ1bCBzaHV0ZG93biBvZiB0aGUgSFRUUCBzdGFjay4KVGhpcyBpbmNsdWRlcyBkZWxheWluZyBhIHNodXRkb3duIGFmdGVyIHJlY2VpdmluZyBhIHRlcm1pbmF0aW9uIHNpZ25hbCwgY29ubmVjdGlvbiBkcmFpbmluZyBmb3IgSFRUUC8xLjEgYW5kIEhUVFAvMiBjb25uZWN0aW9ucyBkdXJpbmcgdGhhdCBwZXJpb2QsIGFuZCBhIHNodXRkb3duIHRpbWVvdXQgdG8gZmluaXNoIG9uZ29pbmcgcmVxdWVzdHMuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+VGhlIGRlZmF1bHRzIGFyZSBhIHNodXRkb3duIGRlbGF5IGFuZCBhIHNodXRkb3duIHRpbWVvdXQgb2Ygb25lIHNlY29uZCBlYWNoLgpUaGlzIHNob3VsZCBiZSBhIGdvb2QgZml0IGZvciBzZXR1cHMgd2hlcmUgdGhlIHJldmVyc2UgcHJveHkgaXMgdXNpbmcgVExTIGVkZ2UgdGVybWluYXRpb24gb3IgcmUtZW5jcnlwdGlvbiBhbmQgdGhlIHJldmVyc2UgcHJveHkgaXMgbm90aWZpZWQgYWJvdXQgdGhlIEtleWNsb2FrIG5vZGUgc2h1dHRpbmcgZG93biBhdCB0aGUgc2FtZSB0aW1lIGFzIHRoZSBLZXljbG9hayBub2RlLgpUaGlzIGlzIGEgY29tbW9uIHNldHVwLCBmb3IgZXhhbXBsZSwgaW4gS3ViZXJuZXRlcyBlbnZpcm9ubWVudHMuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+VXNlcnMgc2hvdWxkIGFkanVzdCB0aG9zZSB2YWx1ZXMgZGVwZW5kaW5nIG9uIHRoZWlyIHByb3h5IHNldHVwLgpTZWUgdGhlIHNlY3Rpb24gPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlcnZlci9yZXZlcnNlcHJveHkjZ3JhY2VmdWwtaHR0cC1zaHV0ZG93biI+R3JhY2VmdWwgSFRUUCBzaHV0ZG93bjwvYT4gaW4gdGhlIHJldmVyc2UgcHJveHkgZ3VpZGUgZm9yIG1vcmUgaW5mb3JtYXRpb24uPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfbmV3X2tjcmF3X3ByZWZpeF9mb3JfZW52aXJvbm1lbnRfdmFyaWFibGVzX3RvX3ByZXNlcnZlX2xpdGVyYWxfdmFsdWVzIj5OZXcgPGNvZGU+S0NSQVdfPC9jb2RlPiBwcmVmaXggZm9yIGVudmlyb25tZW50IHZhcmlhYmxlcyB0byBwcmVzZXJ2ZSBsaXRlcmFsIHZhbHVlczwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPktleWNsb2FrIG5vdyBzdXBwb3J0cyBhIDxjb2RlPktDUkFXXzwvY29kZT4gcHJlZml4IGZvciBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdG8gcHJlc2VydmUgdmFsdWVzIGNvbnRhaW5pbmcgPGNvZGU+JDwvY29kZT4gY2hhcmFjdGVycyBleGFjdGx5IGFzIHdyaXR0ZW4sIHdpdGhvdXQgZXhwcmVzc2lvbiBldmFsdWF0aW9uLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPldoZW4gdXNpbmcgdGhlIHN0YW5kYXJkIDxjb2RlPktDXzwvY29kZT4gcHJlZml4LCBLZXljbG9hayAodmlhIFNtYWxsUnllIENvbmZpZykgZXZhbHVhdGVzIGV4cHJlc3Npb25zIGluIHZhbHVlcyAoZm9yIGV4YW1wbGUsIDxjb2RlPiR7c29tZV9rZXl9PC9jb2RlPiBpcyByZXNvbHZlZCBhbmQgPGNvZGU+JCQ8L2NvZGU+IGlzIGNvbGxhcHNlZCB0byA8Y29kZT4kPC9jb2RlPikuClRoaXMgY2FuIHNpbGVudGx5IG1vZGlmeSBwYXNzd29yZHMgb3Igc2VjcmV0cyBpbmplY3RlZCBieSBhIHNlY3JldHMgbWFuYWdlciBvciBvcmNoZXN0cmF0aW9uIHRvb2wgd2hlcmUgbWFudWFsIGVzY2FwaW5nIGlzIG5vdCBmZWFzaWJsZS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5TZXR0aW5nIDxjb2RlPktDUkFXXyZsdDtLRVkmZ3Q7PC9jb2RlPiBpbnN0ZWFkIG9mIDxjb2RlPktDXyZsdDtLRVkmZ3Q7PC9jb2RlPiBwcmVzZXJ2ZXMgdGhlIHZhbHVlIGV4YWN0bHkgYXMgcHJvdmlkZWQuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+U2VlIHRoZSA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvc2VydmVyL2NvbmZpZ3VyYXRpb24ja2NyYXctcHJlZml4Ij5QcmVzZXJ2aW5nIGxpdGVyYWwgdmFsdWVzIHdpdGggdGhlIEtDUkFXXyBwcmVmaXg8L2E+IHNlY3Rpb24gaW4gdGhlIFNlcnZlciBDb25maWd1cmF0aW9uIGd1aWRlIGZvciBkZXRhaWxzLjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2F1dG9tYXRpY19yZWxvYWRfb2ZfbGlzdHNfd2l0aF9kaXNhbGxvd2VkX3Bhc3N3b3JkcyI+QXV0b21hdGljIHJlbG9hZCBvZiBsaXN0cyB3aXRoIGRpc2FsbG93ZWQgcGFzc3dvcmRzPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+V2hlbiBhIGxpc3Qgb2YgZGlzYWxsb3dlZCBwYXNzd29yZHMgKGFsc28ga25vd24gYXMgYmxhY2tsaXN0KSBjaGFuZ2VzLCBpdCBpcyBhdXRvbWF0aWNhbGx5IHJlbG9hZGVkLiBUaGlzIGF2b2lkcyB0aGUgbmVlZCBmb3IgYSBzZXJ2ZXIgcmVzdGFydCB3aGVuIHRoZSBsaXN0IGNoYW5nZXMuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+VGhhbmsgeW91IHRvIDxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS90c2Fhcm5pIj5UZXJvIFNhYXJuaTwvYT4gZm9yIGNvbnRyaWJ1dGluZyB0aGlzIGNoYW5nZS48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9hdXRvbWF0aWNfdHJ1c3RzdG9yZV9pbml0aWFsaXphdGlvbl9vbl9rdWJlcm5ldGVzX2FuZF9vcGVuc2hpZnQiPkF1dG9tYXRpYyB0cnVzdHN0b3JlIGluaXRpYWxpemF0aW9uIG9uIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdDwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPktleWNsb2FrIG5vdyBhdXRvbWF0aWNhbGx5IGRpc2NvdmVycyBhbmQgdHJ1c3RzIGNsdXN0ZXIgY2VydGlmaWNhdGUgYXV0aG9yaXRpZXMgd2hlbiBydW5uaW5nIG9uIEt1YmVybmV0ZXMgb3IgT3BlblNoaWZ0LCB3aXRob3V0IHJlcXVpcmluZyB0aGUgT3BlcmF0b3IgdG8gcHJlY29uZmlndXJlIHRoZSB0cnVzdHN0b3JlLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPklmIHByZXNlbnQgaW4gdGhlIGNvbnRhaW5lciBmaWxlc3lzdGVtLCB0aGUgZm9sbG93aW5nIGNlcnRpZmljYXRlcyBhcmUgYWRkZWQgdG8gdGhlIHN5c3RlbSB0cnVzdHN0b3JlIGF0IHN0YXJ0dXA6PC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0idWxpc3QiPgo8dWw+CjxsaT4KPHA+PGNvZGU+L3Zhci9ydW4vc2VjcmV0cy9rdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L2NhLmNydDwvY29kZT4gKEt1YmVybmV0ZXMgc2VydmljZSBhY2NvdW50IENBKTwvcD4KPC9saT4KPGxpPgo8cD48Y29kZT4vdmFyL3J1bi9zZWNyZXRzL2t1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1jYS5jcnQ8L2NvZGU+IChPcGVuU2hpZnQgc2VydmljZSBDQSk8L3A+CjwvbGk+CjwvdWw+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UaGlzIGJlaGF2aW9yIGlzIGVuYWJsZWQgYnkgZGVmYXVsdCBhbmQgY2FuIGJlIGNvbnRyb2xsZWQgd2l0aCB0aGUgc2VydmVyIG9wdGlvbiA8Y29kZT4tLXRydXN0c3RvcmUta3ViZXJuZXRlcy1lbmFibGVkPXRydWV8ZmFsc2U8L2NvZGU+IChkZWZhdWx0OiA8Y29kZT50cnVlPC9jb2RlPikuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+TW9zdCBkZXBsb3ltZW50cyBkbyBub3QgcmVxdWlyZSBhbnkgYWN0aW9uLiBJZiB5b3UgcmVsaWVkIG9uIHRoZSBPcGVyYXRvciB0byBtYW5hZ2UgdGhlc2UgdHJ1c3RzdG9yZSBlbnRyaWVzIHByZXZpb3VzbHksIHRoZSBzZXJ2ZXIgbm93IHBlcmZvcm1zIHRoZSBzYW1lIGZ1bmN0aW9uIGRpcmVjdGx5LjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2NsaWVudF9jZXJ0aWZpY2F0ZV9sb29rdXBfcHJvdmlkZXJzX2Zvcl90cmFlZmlrX2FuZF9lbnZveSI+Q2xpZW50IGNlcnRpZmljYXRlIGxvb2t1cCBwcm92aWRlcnMgZm9yIFRyYWVmaWsgYW5kIEVudm95PC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+WW91IGNhbiBub3cgdXNlIG5ldyBjbGllbnQgY2VydGlmaWNhdGUgbG9va3VwIHByb3ZpZGVycyBmb3IgVHJhZWZpayBhbmQgRW52b3kgcHJveGllcy4KRm9yIGRldGFpbHMsIHNlZSB0aGUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlcnZlci9yZXZlcnNlcHJveHkjX2VuYWJsaW5nX2NsaWVudF9jZXJ0aWZpY2F0ZV9sb29rdXAiPkVuYWJsaW5nIENsaWVudCBDZXJ0aWZpY2F0ZSBMb29rdXA8L2E+IHNlY3Rpb24gb2YgdGhlIGRvY3VtZW50YXRpb24uPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfY29uZmlndXJhYmxlX2t1YmVybmV0ZXNfc2VydmljZV9uYW1lX2FuZF9wb3J0X2luX3RoZV9rZXljbG9ha19vcGVyYXRvciI+Q29uZmlndXJhYmxlIEt1YmVybmV0ZXMgU2VydmljZSBuYW1lIGFuZCBwb3J0IGluIHRoZSBLZXljbG9hayBPcGVyYXRvcjwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlRoZSBLZXljbG9hayBPcGVyYXRvciBub3cgc3VwcG9ydHMgb3ZlcnJpZGluZyB0aGUgbmFtZSBhbmQgcG9ydCBvZiB0aGUgS3ViZXJuZXRlcyBTZXJ2aWNlIGl0IGNyZWF0ZXMgZm9yIGEgS2V5Y2xvYWsgZGVwbG95bWVudC48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5QcmV2aW91c2x5LCB0aGUgU2VydmljZSBuYW1lIHdhcyBhbHdheXMgZGVyaXZlZCBhcyA8Y29kZT4mbHQ7Y3ItbmFtZSZndDstc2VydmljZTwvY29kZT4gYW5kIHRoZSBTZXJ2aWNlIHBvcnQgYWx3YXlzIG1hdGNoZWQgdGhlIGNvbnRhaW5lciBwb3J0LgpZb3UgY2FuIG5vdyB1c2UgdGhlIDxjb2RlPnNwZWMuaHR0cC5zZXJ2aWNlTmFtZTwvY29kZT4sIDxjb2RlPnNwZWMuaHR0cC5zZXJ2aWNlSHR0cHNQb3J0PC9jb2RlPiwgYW5kIDxjb2RlPnNwZWMuaHR0cC5zZXJ2aWNlSHR0cFBvcnQ8L2NvZGU+IGZpZWxkcyB0bwpjb25maWd1cmUgdGhlc2UgaW5kZXBlbmRlbnRseS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBkZXRhaWxzLCBzZWUgdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9vcGVyYXRvci9hZHZhbmNlZC1jb25maWd1cmF0aW9uIj5BZHZhbmNlZCBjb25maWd1cmF0aW9uPC9hPiBndWlkZS48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9zZW5zaXRpdmVfaW5mb3JtYXRpb25faXNfbm90X2Rpc3BsYXllZF9pbl90aGVfaHR0cF9hY2Nlc3NfbG9nIj5TZW5zaXRpdmUgaW5mb3JtYXRpb24gaXMgbm90IGRpc3BsYXllZCBpbiB0aGUgSFRUUCBBY2Nlc3MgbG9nPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+SWYgeW91IGFyZSB1c2luZyB0aGUgSFRUUCBBY2Nlc3MgbG9nZ2luZyBjYXBhYmlsaXR5LCBzZW5zaXRpdmUgaW5mb3JtYXRpb24gaXMgb21pdHRlZC4KVGhpcyBtZWFucyB0aGF0IHRva2VucyBpbiB0aGUgJ0F1dGhvcml6YXRpb24nIEhUVFAgaGVhZGVyIGFuZCBzcGVjaWZpYyBzZW5zaXRpdmUgY29va2llcyBhcmUgbm90IHNob3duLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkZvciBtb3JlIGluZm9ybWF0aW9uLCBzZWUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlcnZlci9sb2dnaW5nI2h0dHAtYWNjZXNzLWxvZ2dpbmciPkNvbmZpZ3VyaW5nIEhUVFAgYWNjZXNzIGxvZ2dpbmc8L2E+LjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2NvbmZpZ3VyYWJsZV9sb2dfZmlsZV9yb3RhdGlvbiI+Q29uZmlndXJhYmxlIGxvZyBmaWxlIHJvdGF0aW9uPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+SXQgaXMgbm93IHBvc3NpYmxlIHRvIGNvbmZpZ3VyZSBsb2cgZmlsZSByb3RhdGlvbiB3aGVuIHVzaW5nIEtleWNsb2FrJiMmIzgyMDM7ODIxNztzIGJ1aWx0LWluIGZpbGUgbG9nZ2luZyBoYW5kbGVyLgpUaGlzIGluY2x1ZGVzIGEgc2ltcGxlIG9wdGlvbiB0byBmdWxseSBkaXNhYmxlIGxvZyByb3RhdGlvbiwgd2hpY2ggaXMgdXNlZnVsIHdoZW4gdXNpbmcgYW4gZXh0ZXJuYWwgbG9nIHJvdGF0aW9uIHNvbHV0aW9uIHN1Y2ggYXMgPGNvZGU+bG9ncm90YXRlPC9jb2RlPi48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5UbyBkaXNhYmxlIGxvZyBmaWxlIHJvdGF0aW9uOjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9Imxpc3RpbmdibG9jayI+CjxkaXYgY2xhc3M9ImNvbnRlbnQiPgo8cHJlIGNsYXNzPSJoaWdobGlnaHQiPjxjb2RlIGNsYXNzPSJsYW5ndWFnZS1iYXNoIiBkYXRhLWxhbmc9ImJhc2giPmJpbi9rYy5zaCBzdGFydCAtLWxvZz0iY29uc29sZSxmaWxlIiAtLWxvZy1maWxlLXJvdGF0aW9uLWVuYWJsZWQ9ZmFsc2U8L2NvZGU+PC9wcmU+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+Rm9yIG1vcmUgaW5mb3JtYXRpb24sIHNlZSB0aGUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlcnZlci9sb2dnaW5nL2ZpbGUiPkZpbGUgbG9nZ2luZzwvYT4gZ3VpZGUuPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfaHR0cF9hY2Nlc3NfbG9nc19pbl9hX2RlZGljYXRlZF9maWxlIj5IVFRQIGFjY2VzcyBsb2dzIGluIGEgZGVkaWNhdGVkIGZpbGU8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5IVFRQIGFjY2VzcyBsb2dzIGNhbiBub3cgYmUgd3JpdHRlbiB0byBhIGRlZGljYXRlZCBmaWxlLCBzZXBhcmF0ZSBmcm9tIHRoZSBzZXJ2ZXIgbG9ncy4KVGhpcyBtYWtlcyBpdCBlYXNpZXIgdG8gcHJvY2VzcyBhbmQgYXJjaGl2ZSBhY2Nlc3MgbG9ncyBpbmRlcGVuZGVudGx5IGZvciBzZWN1cml0eSBhdWRpdGluZyBhbmQgY29tcGxpYW5jZSBtb25pdG9yaW5nLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkZvciBtb3JlIGluZm9ybWF0aW9uLCBzZWUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3NlcnZlci9sb2dnaW5nI2h0dHAtYWNjZXNzLWxvZ2dpbmciPkNvbmZpZ3VyaW5nIEhUVFAgYWNjZXNzIGxvZ2dpbmc8L2E+LjwvcD4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MyI+CjxoNCBpZD0iX2N1c3RvbWl6YWJsZV9zZXJ2aWNlX2ZpZWxkc19pbl9qc29uX2xvZ19vdXRwdXQiPkN1c3RvbWl6YWJsZSBzZXJ2aWNlIGZpZWxkcyBpbiBKU09OIGxvZyBvdXRwdXQ8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5LZXljbG9hayBub3cgcHJvdmlkZXMgbmF0aXZlIG9wdGlvbnMgdG8gY3VzdG9taXplIHRoZSA8Y29kZT5zZXJ2aWNlLm5hbWU8L2NvZGU+IGFuZCA8Y29kZT5zZXJ2aWNlLmVudmlyb25tZW50PC9jb2RlPiBmaWVsZHMgaW4gSlNPTiBsb2cgb3V0cHV0IGFjcm9zcyBhbGwgbG9nIGhhbmRsZXJzIChjb25zb2xlLCBmaWxlLCBhbmQgc3lzbG9nKS48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5QcmV2aW91c2x5LCB3aGVuIHVzaW5nIHRoZSBFQ1MgZm9ybWF0LCA8Y29kZT5zZXJ2aWNlLm5hbWU8L2NvZGU+IGFuZCA8Y29kZT5zZXJ2aWNlLmVudmlyb25tZW50PC9jb2RlPiBjb3VsZCBub3QgYmUgb3ZlcnJpZGRlbiB0aHJvdWdoIEtleWNsb2FrIGNvbmZpZ3VyYXRpb24uClRoaXMgbWFkZSBpdCBkaWZmaWN1bHQgdG8gYWxpZ24gSlNPTiBsb2cgZmllbGRzIHdpdGggT3BlblRlbGVtZXRyeSByZXNvdXJjZSBhdHRyaWJ1dGVzLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPllvdSBjYW4gbm93IHNldCB0aGVzZSBmaWVsZHMgdXNpbmcgPGNvZGU+bG9nLXNlcnZpY2UtbmFtZTwvY29kZT4gYW5kIDxjb2RlPmxvZy1zZXJ2aWNlLWVudmlyb25tZW50PC9jb2RlPi48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBpbmZvcm1hdGlvbiwgc2VlIHRoZSA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvc2VydmVyL2xvZ2dpbmcjY3VzdG9taXplLXNlcnZpY2UtZmllbGRzIj5Db25maWd1cmluZyBsb2dnaW5nPC9hPiBndWlkZS48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9uZXdfYW5kX3VwZGF0ZWRfdHJhbnNsYXRpb25zIj5OZXcgYW5kIHVwZGF0ZWQgdHJhbnNsYXRpb25zPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+TmV3IHRyYW5zbGF0aW9ucyBmb3IgSW5kb25lc2lhbiBhbmQgQXJtZW5pYW4gd2VyZSBhZGRlZC4gQSB3YXJtIHdlbGNvbWUgdG8gdGhlIG5ldyBsYW5ndWFnZSBtYWludGFpbmVycyBmb3IgdGhlc2UgbGFuZ3VhZ2VzIQpUaGVyZSBhcmUgYWxzbyBuZXcgbGFuZ3VhZ2UgbWFpbnRhaW5lcnMgZm9yIHRoZSBTd2VkaXNoIHRyYW5zbGF0aW9uLCB3aG8gdHJhbnNsYXRlZCBhbGwgcmVtYWluaW5nIG1lc3NhZ2Uga2V5cy4gVGhhbmsgeW91IHNvIG11Y2ghPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+Rm9sbG93IHRoZSB0cmFuc2xhdGlvbiBwcm9ncmVzcyBvbiB0aGUgPGEgaHJlZj0iaHR0cHM6Ly93d3cua2V5Y2xvYWsub3JnL3RyYW5zbGF0aW9ucyI+dHJhbnNsYXRpb24gc3RhdHVzIHBhZ2U8L2E+LCBoZWxwIHRyYW5zbGF0ZSwgYW5kIHJlYWQgdGhlIHRyYW5zbGF0aW9uIGd1aWRlIG9uIGhvdyB0byBhZGQgYWRkaXRpb25hbCBsYW5ndWFnZXMuPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfcmlnaHRfdG9fbGVmdF9sYW5ndWFnZV9zdXBwb3J0X2luX3RoZV9hY2NvdW50X3VpIj5SaWdodC10by1sZWZ0IGxhbmd1YWdlIHN1cHBvcnQgaW4gdGhlIEFjY291bnQgVUk8L2g0Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5TdXBwb3J0IGZvciByaWdodC10by1sZWZ0IChSVEwpIGxhbmd1YWdlcyB3YXMgYWRkZWQgdG8gdGhlIExvZ2luIFVJLCBBZG1pbiBVSSwgYW5kIGVtYWlsIHRlbXBsYXRlcyBzZXZlcmFsIHJlbGVhc2VzIGFnby4gVGhpcyByZWxlYXNlIGFkZHMgaW5pdGlhbCBSVEwgc3VwcG9ydCB0byB0aGUgQWNjb3VudCBVSSwgd2hpY2ggY29tcGxldGVzIHRoaXMgZWZmb3J0LjwvcD4KPC9kaXY+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDIiPgo8aDMgaWQ9Il9vYnNlcnZhYmlsaXR5Ij5PYnNlcnZhYmlsaXR5PC9oMz4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il90ZWxlbWV0cnlfY29uZmlndXJhdGlvbl92aWFfdGhlX2tleWNsb2FrX2NyIj5UZWxlbWV0cnkgY29uZmlndXJhdGlvbiB2aWEgdGhlIEtleWNsb2FrIENSPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+S2V5Y2xvYWsgbm93IHN1cHBvcnRzIGNvbmZpZ3VyaW5nIHRoZSBPcGVuVGVsZW1ldHJ5IHByb3BlcnRpZXMgdmlhIHRoZSBLZXljbG9hayBDUiB3aGVuIHVzaW5nIHRoZSBPcGVyYXRvci4KVGhlc2UgcHJvcGVydGllcyBhcmUgc2hhcmVkIGFtb25nIHRoZSBhdmFpbGFibGUgT3BlblRlbGVtZXRyeSBjb21wb25lbnRzIC0gbG9ncywgbWV0cmljcywgYW5kIHRyYWNlcy48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBkZXRhaWxzLCBzZWUgdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9vYnNlcnZhYmlsaXR5L3RlbGVtZXRyeSI+Q2VudHJhbGl6ZSB5b3VyIG9ic2VydmFiaWxpdHkgc3RhY2sgd2l0aCBPcGVuVGVsZW1ldHJ5PC9hPiBndWlkZS48L3A+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9jdXN0b21fcmVxdWVzdF9oZWFkZXJzX2Zvcl9vcGVudGVsZW1ldHJ5Ij5DdXN0b20gcmVxdWVzdCBoZWFkZXJzIGZvciBPcGVuVGVsZW1ldHJ5PC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+SXQgaXMgbm93IHBvc3NpYmxlIHRvIHNldCByZXF1ZXN0IGhlYWRlcnMgZm9yIGV4cG9ydGluZyB0ZWxlbWV0cnkgdmlhIE9wZW5UZWxlbWV0cnkgUHJvdG9jb2wgKE9UTFApLgpUaGlzIGlzIG1haW5seSB1c2VmdWwgZm9yIHByb3ZpZGluZyB0b2tlbnMgaW4gdGhlIHJlcXVlc3QuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+WW91IGNhbiBzcGVjaWZ5IHRoZXNlIGhlYWRlcnMgdmlhIHRoZSA8Y29kZT50ZWxlbWV0cnktaGVhZGVyLSZsdDtoZWFkZXImZ3Q7PC9jb2RlPiB3aWxkY2FyZCBvcHRpb24sIHdoaWNoIGFjY2VwdHMgYW55IGN1c3RvbSBoZWFkZXIgbmFtZS4KQWx0ZXJuYXRpdmVseSwgdXNlIDxjb2RlPnRlbGVtZXRyeS1sb2dzLWhlYWRlci0mbHQ7aGVhZGVyJmd0OzwvY29kZT4gZm9yIE9wZW5UZWxlbWV0cnkgTG9ncyBvciA8Y29kZT50ZWxlbWV0cnktbWV0cmljcy1oZWFkZXItJmx0O2hlYWRlciZndDs8L2NvZGU+IGZvciBPcGVuVGVsZW1ldHJ5IE1ldHJpY3MuPC9wPgo8L2Rpdj4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+Rm9yIG1vcmUgZGV0YWlscywgc2VlIHRoZSA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvb2JzZXJ2YWJpbGl0eS90ZWxlbWV0cnkiPkNlbnRyYWxpemUgeW91ciBvYnNlcnZhYmlsaXR5IHN0YWNrIHdpdGggT3BlblRlbGVtZXRyeTwvYT4gZ3VpZGUuPC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9InNlY3QzIj4KPGg0IGlkPSJfc2VydmljZV9tb25pdG9yX2Fubm90YXRpb25zX2FuZF9sYWJlbHNfdmlhX3RoZV9rZXljbG9ha19jciI+U2VydmljZSBNb25pdG9yIGFubm90YXRpb25zIGFuZCBsYWJlbHMgdmlhIHRoZSBLZXljbG9hayBDUjwvaDQ+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkl0IGlzIG5vdyBwb3NzaWJsZSB0byBjb25maWd1cmUgc2VydmljZSBtb25pdG9yIGxhYmVscyBhbmQgYW5ub3RhdGlvbnMgdmlhIHRoZSBLZXljbG9hayBDUiB3aGVuIHVzaW5nIHRoZSBPcGVyYXRvci48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBkZXRhaWxzLCBzZWUgdGhlIDxhIGhyZWY9Imh0dHBzOi8vd3d3LmtleWNsb2FrLm9yZy9vcGVyYXRvci9hZHZhbmNlZC1jb25maWd1cmF0aW9uI19zZXJ2aWNlbW9uaXRvciI+QWR2YW5jZWQgQ29uZmlndXJhdGlvbiBPcGVyYXRvcjwvYT4gZ3VpZGUuPC9wPgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJzZWN0MiI+CjxoMyBpZD0iX2V4dGVuc2lvbl9kZXZlbG9wbWVudCI+RXh0ZW5zaW9uIERldmVsb3BtZW50PC9oMz4KPGRpdiBjbGFzcz0ic2VjdDMiPgo8aDQgaWQ9Il9rZXljbG9ha190ZXN0X2ZyYW1ld29ya19zdXBwb3J0ZWQiPktleWNsb2FrIFRlc3QgRnJhbWV3b3JrIChzdXBwb3J0ZWQpPC9oND4KPGRpdiBjbGFzcz0icGFyYWdyYXBoIj4KPHA+VGhlIEtleWNsb2FrIFRlc3QgRnJhbWV3b3JrLCBiYXNlZCBvbiBKVW5pdCA2LCBpcyBub3cgZnVsbHkgc3VwcG9ydGVkLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPkl0IHJlcGxhY2VzIHRoZSBwcmV2aW91cyBzb2x1dGlvbiBidWlsdCBvbiB0b3Agb2YgQXJxdWlsbGlhbiBhbmQgSlVuaXQgNC4KQmVoaW5kIHRoZSBzY2VuZXMsIHRoZSBmcmFtZXdvcmsgaGFuZGxlcyB0aGUgbGlmZWN5Y2xlIG9mIEtleWNsb2FrLCB0aGUgZGF0YWJhc2UsIGFuZCBhbnkgaW5qZWN0ZWQgcmVzb3VyY2VzIHN1Y2ggYXMgcmVhbG1zIGFuZCBjbGllbnRzLjwvcD4KPC9kaXY+CjxkaXYgY2xhc3M9InBhcmFncmFwaCI+CjxwPlRlc3RzIHNpbXBseSBkZWNsYXJlIHdoYXQgdGhleSB3YW50LCBpbmNsdWRpbmcgc3BlY2lmaWMgY29uZmlndXJhdGlvbiwgYW5kIHRoZSBmcmFtZXdvcmsgdGFrZXMgY2FyZSBvZiB0aGUgcmVzdC48L3A+CjwvZGl2Pgo8ZGl2IGNsYXNzPSJwYXJhZ3JhcGgiPgo8cD5Gb3IgbW9yZSBpbmZvcm1hdGlvbiwgc2VlIDxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay90cmVlL21haW4vdGVzdC1mcmFtZXdvcmsjcmVhZG1lIj5LZXljbG9hayBUZXN0IEZyYW1ld29yazwvYT4uPC9wPgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8aDI+VXBncmFkaW5nPC9oMj4KPHA+QmVmb3JlIHVwZ3JhZGluZyByZWZlciB0byA8YSBocmVmPSJodHRwczovL3d3dy5rZXljbG9hay5vcmcvZG9jcy9sYXRlc3QvdXBncmFkaW5nLyNtaWdyYXRpb24tY2hhbmdlcyI+dGhlIG1pZ3JhdGlvbiBndWlkZTwvYT4gZm9yIGEgY29tcGxldGUgbGlzdCBvZiBjaGFuZ2VzLjwvcD4KCjxoMj5BbGwgcmVzb2x2ZWQgaXNzdWVzPC9oMj4KCjxoMz5EZXByZWNhdGVkIGZlYXR1cmVzPC9oMz4KPHVsPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTE1NiI+IyYjODIwMzs0NTE1NjwvYT4gRGVwcmVjYXRlIFRva2VuIEV4Y2hhbmdlIHYxIDwvbGk+CjwvdWw+Cgo8aDM+TmV3IGZlYXR1cmVzPC9oMz4KPHVsPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8xMDE1NSI+IyYjODIwMzsxMDE1NTwvYT4gU3RlcC11cCBhdXRoZW50aWNhdGlvbiBmb3IgU0FNTCBjbGllbnRzIDxjb2RlPmF1dGhlbnRpY2F0aW9uPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzEzMTAyIj4jJiM4MjAzOzEzMTAyPC9hPiBBZGQgc3VwcG9ydCBmb3Igc3BlY2lmeWluZyBgY2xpZW50LnNlY3JldGAgdXNpbmcgdmF1bHQgPGNvZGU+Y29yZTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zOTg4OCI+IyYjODIwMzszOTg4ODwvYT4gV29ya2Zsb3dzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQyNjM0Ij4jJiM4MjAzOzQyNjM0PC9hPiBGZWRlcmF0ZWQgY2xpZW50IGF1dGhlbnRpY2F0aW9uIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzMTQ0Ij4jJiM4MjAzOzQzMTQ0PC9hPiBPQXV0aCBJZGVudGl0eSBhbmQgQXV0aG9yaXphdGlvbiBDaGFpbmluZyBBY3Jvc3MgRG9tYWlucyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzE0NiI+IyYjODIwMzs0MzE0NjwvYT4gTmV3IHRlc3QgZnJhbWV3b3JrIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzMTUyIj4jJiM4MjAzOzQzMTUyPC9hPiBBdXRob3JpemF0aW9uIEdyYW50cyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzI1MiI+IyYjODIwMzs0MzI1MjwvYT4gWmVyby1kb3dudGltZSB1cGdyYWRlcyBiZXR3ZWVuIHBhdGNoIHJlbGVhc2VzIG9mIEtleWNsb2FrIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzMjU3Ij4jJiM4MjAzOzQzMjU3PC9hPiBTdXBwb3J0IGEgS3ViZXJuZXRlcyBOYXRpdmUgRGF0YWJhc2UgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDM1MDciPiMmIzgyMDM7NDM1MDc8L2E+IEFkZCBzdXBwb3J0IGZvciBPcmdhbml6YXRpb24tc3BlY2lmaWMgR3JvdXBzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzNTc2Ij4jJiM4MjAzOzQzNTc2PC9hPiBBdXRob3JpemF0aW9uIGdyYW50IGZvciBzb2NpYWwgcHJvdmlkZXJzIDxjb2RlPnRva2VuLWV4Y2hhbmdlL2ZlZGVyYXRlZDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDgzMyI+IyYjODIwMzs0NDgzMzwvYT4gW09JRDRWQ0ldIE1ha2UgbmF0dXJhbF9wZXJzb24gY29uZmlndXJhdGlvbiBhdmFpbGFibGUgaW4gYWxsIGZvcm1hdHMgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1MTA2Ij4jJiM4MjAzOzQ1MTA2PC9hPiBPQXV0aCBDbGllbnQgSUQgTWV0YWRhdGEgRG9jdW1lbnQgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDUyODQiPiMmIzgyMDM7NDUyODQ8L2E+IENJTUQgLSBQZXJzaXN0ZW50IENJTUQgPGNvZGU+b2lkYzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjYzMyI+IyYjODIwMzs0NjYzMzwvYT4ga2V5Y2xvYWsgb3BlcmF0b3I6IGFkZCBzdXBwb3J0IGZvciBkaWZmZXJlbnQgcG9ydCBhbmQgbmFtZSBmb3IgdGhlIGt1YmVybmV0ZXMgc2VydmljZSBkZWZpbml0aW9uIGluIHRoZSBrZXljbG9hayBDUkQgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDcwMTEiPiMmIzgyMDM7NDcwMTE8L2E+IEFkZCBkZWJ1ZyBoZWxwZXIgdXRpbGl0eSB0byB0aGUgdGVzdCBmcmFtZXdvcmsgPGNvZGU+dGVzdC1mcmFtZXdvcms8L2NvZGU+PC9saT4KPC91bD4KCjxoMz5FbmhhbmNlbWVudHM8L2gzPgo8dWw+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzEwNjE4Ij4jJiM4MjAzOzEwNjE4PC9hPiBFbmhhbmNlbWVudHMgdG8gbG9nZ2luZyBjb25maWcgPGNvZGU+ZGlzdC9xdWFya3VzPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzE0NTIzIj4jJiM4MjAzOzE0NTIzPC9hPiBBZGQgc3VwcG9ydCBmb3IgZW5mb3JjZWQgcGFzc3dvcmQgY2hhbmdlIHdpdGggTERBUCBmZWRlcmF0aW9uIDxjb2RlPmxkYXA8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMTc5MDQiPiMmIzgyMDM7MTc5MDQ8L2E+IFN1cHBvcnQgUlRMIFVJIDxjb2RlPmFjY291bnQvdWk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMTkzNzQiPiMmIzgyMDM7MTkzNzQ8L2E+IEFsbG93IGFic29sdXRlIHBhdGggZm9yIGNhY2hlLWNvbmZpZy1maWxlPyA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMTk0NTMiPiMmIzgyMDM7MTk0NTM8L2E+IFRoZSBkZWZhdWx0IGRhdGFiYXNlIHRyYW5zYWN0aW9uIHRpbWVvdXQgc2hvdWxkIG5vdCBiZSBhcHBsaWVkIHRvIExpcXVpYmFzZSBvciBkYXRhIG1pZ3JhdGlvbnMgPGNvZGU+ZGlzdC9xdWFya3VzPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzIwNjE4Ij4jJiM4MjAzOzIwNjE4PC9hPiBTdXBwb3J0IGVuYWJsaW5nIGFjY2VzcyBsb2dzIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8yNzk4NiI+IyYjODIwMzsyNzk4NjwvYT4gUmVtb3ZlIExpcXVpYmFzZSBkZXBlbmRlbmN5IHZlcnNpb24gZnJvbSBLZXljbG9hayByb290IHBvbSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zMzE2MCI+IyYjODIwMzszMzE2MDwvYT4gQWRkIHN1cHBvcnQgZm9yIFg1MDkgY2xpZW50IGNlcnRpZmljYXRlIGxvb2t1cCBmb3IgRW52b3kgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMzMxOTgiPiMmIzgyMDM7MzMxOTg8L2E+IEludHJvZHVjZSBgcmVzb3VyY2VzQ29tbW9uVXJsYCBmb3IgRS1NYWlsIHRlbXBsYXRlcyA8Y29kZT5jb3JlPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzMzODE4Ij4jJiM4MjAzOzMzODE4PC9hPiBSZXF1ZXN0IGZvciBFbmhhbmNlbWVudDogTWFrZSB4NTA5Y2VydC1sb29rdXAgU1BJIHB1YmxpYyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zNDQzNSI+IyYjODIwMzszNDQzNTwvYT4gT1RFTDogQWRkIHRyYWNpbmcgSUQgdG8gdXNlciBmYWNpbmcgZXJyb3IgbWVzc2FnZSA8Y29kZT5vYnNlcnZhYmlsaXR5PC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzM1Mjk4Ij4jJiM4MjAzOzM1Mjk4PC9hPiBSZXZlcnNlIHByb3h5IHByb3ZpZGVkIGNvbnRleHQgcGF0aCBub3Qgd29ya2luZyBkZXNwaXRlIHNldHRpbmcgWC1Gb3J3YXJkZWQtUHJlZml4IGhlYWRlciA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMzYyMjYiPiMmIzgyMDM7MzYyMjY8L2E+IFByb3ZpZGUgYSByZWFkIG9ubHkgdmlldyBvZiBJZGVudGl0eSBQcm92aWRlciBNYXBwZXJzIGNvbmZpZ3VyYXRpb24gc2NyZWVuIHRvIHRoZSBLZXljbG9hayBBZG1pbiBVSSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zNjcxMCI+IyYjODIwMzszNjcxMDwvYT4gSGF2ZSBhIGZpcnN0LWNsYXNzIENMSSBvcHRpb24gdG8gY2hhbmdlIEtleWNsb2FrJ3MgdHJhbnNhY3Rpb24gdGltZW91dCA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMzg4ODQiPiMmIzgyMDM7Mzg4ODQ8L2E+IFVwZ3JhZGUgY29tbWFuZCByb2xsaW5nIHVwZGF0ZXMgZm9yIHBhdGNoIHJlbGVhc2VzIC8gc3RlcCAzOiBJbmZpbmlzcGFuL0pHcm91cHMgc3VwcG9ydCA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zODg4OCI+IyYjODIwMzszODg4ODwvYT4gQXZvaWQgYnJlYWtpbmcgREIgY2hhbmdlcyBkdXJpbmcgcGF0Y2ggcmVsZWFzZXMgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDA5MDIiPiMmIzgyMDM7NDA5MDI8L2E+IE1vcmUgZnVsbHkgZG9jdW1lbnQgb3BlcmF0b3IgdXBncmFkZSBzY2VuYXJpb3MsIGluIHBhcnRpY3VsYXIgd2l0aCBjdXN0b20gaW1hZ2VzIDxjb2RlPmRvY3M8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDEzMzAiPiMmIzgyMDM7NDEzMzA8L2E+IEltcHJvdmUgbG9nZ2luZyBvZiBKcGFVc2VyU2Vzc2lvblBlcnNpc3RlclByb3ZpZGVyI2V4cGlyZSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MTM1MyI+IyYjODIwMzs0MTM1MzwvYT4gUHJvdmlkZSBIVFRQIGFjY2VzcyBsb2dzIHdyaXR0ZW4gdG8gZmlsZSB3aXRoIHJvdGF0aW9uIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MTYyOSI+IyYjODIwMzs0MTYyOTwvYT4gUmVtb3ZlIFRyYWNpbmcgd29ya2Fyb3VuZCBpbiBJbmZpbmlzcGFuL0pHcm91cHMgY2xhc3NlcyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MjI1NiI+IyYjODIwMzs0MjI1NjwvYT4gREIgQ29ubmVjdGlvbiBQb29sIGFjcXVpc2l0aW9uIHRpbWVvdXQgZXJyb3JzIG9uIGRhdGFiYXNlIGZhaWxvdmVyICA8Y29kZT5jb3JlPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQyNjI2Ij4jJiM4MjAzOzQyNjI2PC9hPiBQcm92aWRlIGEgd2F5IHRvIGFkZCBjdXN0b20gbGFiZWxzIHRvIGdlbmVyYXRlZCBTZXJ2aWNlTW9uaXRvciA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80Mjc0NyI+IyYjODIwMzs0Mjc0NzwvYT4gTWFrZSBEUG9QIGRvY3MgbW9yZSBkZXRhaWxlZCA8Y29kZT5vaWRjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQyODc2Ij4jJiM4MjAzOzQyODc2PC9hPiBkZXYgbW9kZSBzaG91bGQgYmluZCBvbmx5IHRvIGxvY2FsaG9zdCBpZiBwb3NzaWJsZSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MjkwMCI+IyYjODIwMzs0MjkwMDwvYT4gTW92ZSB0aGUgbG9naWMgb2Ygc2Nhbm5pbmcgS3ViZXJuZXRlcyBDQSB0byBLZXljbG9hayA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDM1ODkiPiMmIzgyMDM7NDM1ODk8L2E+IEdyYWNlZnVsbHkgc2h1dHRpbmcgZG93biBIVFRQIHN0YWNrIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzNzAxIj4jJiM4MjAzOzQzNzAxPC9hPiBJbXByb3ZlIFNpbXBsZUh0dHAgQVBJIDxjb2RlPmNvcmU8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDM4MjkiPiMmIzgyMDM7NDM4Mjk8L2E+IEFkZCBjcmVhdGVkVGltZXN0YW1wIGZpbHRlciAoYmVmb3JlL2FmdGVyKSB0byAvYWRtaW4vcmVhbG1zL3tyZWFsbX0vdXNlcnMgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQwOTAiPiMmIzgyMDM7NDQwOTA8L2E+IEVycm9ySWQgZm9yIGVycm9yIHNjcmVlbnMgYW5kIGxvZ2dpbmcgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQxMDEiPiMmIzgyMDM7NDQxMDE8L2E+IEFsbG93IHJlLXVzaW5nIHNlcnZlciB3aGVuIHJ1bm5pbmcgdGVzdHMgd2l0aCB0aGUgbmV3IGZyYW1ld29yayA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDM2NCI+IyYjODIwMzs0NDM2NDwvYT4gSW1wcm92ZSBjbGllbnQgY3JlYXRpb24gd2l0aCBQS0NFIGluIGFkbWluIGNvbnNvbGUgPGNvZGU+Y29yZTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDQyNCI+IyYjODIwMzs0NDQyNDwvYT4gZmluZENsaWVudFNlc3Npb25zQ2xpZW50SWRzIHBlcmZvcm1hbmNlIGlzc3VlIDxjb2RlPnN0b3JhZ2U8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ0NTkiPiMmIzgyMDM7NDQ0NTk8L2E+IEFkZGluZyB0aGUgbG9nIHRvIHRoZSByZXF1aXJlZCBhY3Rpb24gdG8gc2hvdyB0aGUgY2F1c2Ugb2Ygc3ludGF4IHZpb2xhdGlvbiBvZiB0aGUgTERBUCBwb2xpY3kgPGNvZGU+bGRhcDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDg0NiI+IyYjODIwMzs0NDg0NjwvYT4gW09JRDRWQ0ldOiBFbnN1cmUgT0lENFZDSSBvcHRpb25hbCBmaWVsZHMgYXJlIHNhdmVkIGNsZWFubHkgYW5kIHVzZSBkZWZhdWx0cyA8Y29kZT5vaWQ0dmM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ4NDkiPiMmIzgyMDM7NDQ4NDk8L2E+IFtPSUQ0VkNJXSBBZGQgVUkgc3VwcG9ydCBmb3IgYHZjLmNyZWRlbnRpYWxfc2lnbmluZ19hbGdgIGluIE9JRDRWQ0kgY2xpZW50IHNjb3BlcyA8Y29kZT5vaWQ0dmM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ5NzMiPiMmIzgyMDM7NDQ5NzM8L2E+IEhpZGUgUmVtZW1iZXIgTWUgc2Vzc2lvbiBzZXR0aW5ncyB3aGVuIFJlbWVtYmVyIE1lIGlzIGRpc2FibGVkIGluIHJlYWxtIGxvZ2luIHNldHRpbmdzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1MDA2Ij4jJiM4MjAzOzQ1MDA2PC9hPiBbT0lENFZDSV0gQWRkIHN1cHBvcnQgZm9yIHVzZXIgZGlkIGFzIHN1YmplY3QgaWQgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1MTg4Ij4jJiM4MjAzOzQ1MTg4PC9hPiBVcGdyYWRlIHRvIHF1YXJrdXMgMy4zMC41IDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1MjIwIj4jJiM4MjAzOzQ1MjIwPC9hPiBPVEVMOiBBYmlsaXR5IHRvIHNwZWNpZnkgaGVhZGVycyBmb3IgZXhwb3J0ZXJzIDxjb2RlPm9ic2VydmFiaWxpdHk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDUyMzEiPiMmIzgyMDM7NDUyMzE8L2E+IFtPSUQ0VkNJXSBHZW5lcmF0ZSBwcmUtYXV0aG9yaXplZCBjb2RlcyB1c2luZyB0aGUgSldUIGZvcm1hdCA8Y29kZT5vaWQ0dmM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDUyNTQiPiMmIzgyMDM7NDUyNTQ8L2E+IEFkbWluIFVJIGphdmFzY3JpcHQgYnVuZGxlIHNob3VsZCBoYXZlIHNvdXJjZSBtYXBwaW5nIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1Mjc4Ij4jJiM4MjAzOzQ1Mjc4PC9hPiBVcGdyYWRlIHRvIFF1YXJrdXMgMy4zMy54IExUUyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTI4MSI+IyYjODIwMzs0NTI4MTwvYT4gQWRkIG1pc3NpbmcgU3dlZGlzaCB0cmFuc2xhdGlvbnMgZm9yIGFkbWluIHRoZW1lIG1lc3NhZ2VzIDxjb2RlPnRyYW5zbGF0aW9uczwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTMyMiI+IyYjODIwMzs0NTMyMjwvYT4gTGlua2luZyB1c2VyIHdpdGggaWRwIGZhaWxzIHdpdGggZ2VuZXJpYyBtZXNzYWdlIGlmIHVzZXIgaXMgYWxyZWFkeSBsaW5rZWQgPGNvZGU+aWRlbnRpdHktYnJva2VyaW5nPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1MzM3Ij4jJiM4MjAzOzQ1MzM3PC9hPiBVcGdyYWRlIHRvIFF1YXJrdXMgMy4zMSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTM0OCI+IyYjODIwMzs0NTM0ODwvYT4gT1RFTDogQWRkIFRlbGVtZXRyeSBvcHRpb25zIHRvIEtleWNsb2FrIENSIDxjb2RlPm9ic2VydmFiaWxpdHk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDUzNjAiPiMmIzgyMDM7NDUzNjA8L2E+IERvY3VtZW50IHRoYXQgdGhlIHRoZSBIQSBhcmNoaXRlY3R1cmVzIGFyZSB0ZXN0ZWQgd2l0aCBPcGVuc2hpZnQgNC4xOCA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTQ2NyI+IyYjODIwMzs0NTQ2NzwvYT4gTWFuYWdlbWVudCBpbnRlcmZhY2UgZW5kcG9pbnQgbGlzdHMgYXZhaWxhYmxlIGVuZHBvaW50cyA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU2MjAiPiMmIzgyMDM7NDU2MjA8L2E+IENoYW5nZSBkZWZhdWx0IG5vdC1iZWZvcmUgdmFsaWRhdGlvbiB0byAxMCBzZWNvbmQgaW5zdGVhZCBvZiAwIDxjb2RlPm9pZGM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU2MjMiPiMmIzgyMDM7NDU2MjM8L2E+IEF2b2lkIHVubmVjZXNzYXJ5IHdhcm5pbmcgbG9ncyBkdXJpbmcgdGhlIG9wZXJhdG9yIHRlc3RzIGV4ZWN1dGlvbiA8Y29kZT50ZXN0c3VpdGU8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU2MjkiPiMmIzgyMDM7NDU2Mjk8L2E+IEhUVFAgYWNjZXNzIGxvZyB3cml0dGVuIHRvIGZpbGUgc2hvdWxkIGJlIGluIGEgc2VwYXJhdGUgZGlyZWN0b3J5IDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTY4OSI+IyYjODIwMzs0NTY4OTwvYT4gV2hlbiBhIHVzZXIgam9pbnMgYSByb2xlIG9yIGdyb3VwLCBpdCBzaG91bGQgbm90IHJlYWQgYWxsIGV4aXN0aW5nIHJvbGVzIGFuZCBncm91cHMgZnJvbSB0aGUgZGF0YWJhc2UgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU3MDQiPiMmIzgyMDM7NDU3MDQ8L2E+IEludml0ZSBleGlzdGluZyB1c2VycyBmcm9tIEFkbWluIFVJIDxjb2RlPm9yZ2FuaXphdGlvbnM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU3MTgiPiMmIzgyMDM7NDU3MTg8L2E+IEltcHJvdmUgZXJyb3IgbWVzc2FnZSB3aGVuIG9yZ2FuaXphdGlvbiBuYW1lIGNhbm5vdCBiZSB1c2VkIGFzIGFsaWFzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1Nzk1Ij4jJiM4MjAzOzQ1Nzk1PC9hPiBQcm9tb3RlIEtleWNsb2FrIGFuZCBLZXljbG9ha1JlYWxtSW1wb3J0IENSRHMgdG8gdjJiZXRhMSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTg0MSI+IyYjODIwMzs0NTg0MTwvYT4gQWRkIHJldmVydCBidXR0b24gdG8gY2xpZW50IGNyZWRlbnRpYWxzIHBhZ2UgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU4ODAiPiMmIzgyMDM7NDU4ODA8L2E+IFNBTUxFbmRwb2ludCAtIGluY3JlYXNlIGV4dGVuc2liaWxpdHkgYnkgaW5jcmVhc2luZyBhY2Nlc3NpYmlsaXR5IG9mIHNvbWUgcHJpdmF0ZSBmaWVsZHMvbWV0aG9kcyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTg4MiI+IyYjODIwMzs0NTg4MjwvYT4gVXNlIEdyb3VwUmVzb3VyY2UgY29udGV4dCBpbiBHcm91cHMgc28gdGhhdCBHcm91cCBjb21wb25lbnRzIGNhbiBiZSByZXVzZWQgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU4ODQiPiMmIzgyMDM7NDU4ODQ8L2E+IFRlc3RmcmFtZXdvcmsgY29yZSBoYXMgZGVwZW5kZW5jeSBvbiB0ZXN0Y29udGFpbmVycyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTg5OCI+IyYjODIwMzs0NTg5ODwvYT4gU3VwcG9ydGVkIENvbmZpZ3VyYXRpb25zIGd1aWRlIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1OTA5Ij4jJiM4MjAzOzQ1OTA5PC9hPiBBZGQgdGhlbWUgY2xhcmlmaWNhdGlvbiBibHVyYiB0byBSZWFsbSBTZXR0aW5ncyA8Y29kZT5hZG1pbi91aTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTk0MSI+IyYjODIwMzs0NTk0MTwvYT4gRG8gbm90IHVzZSBkZXByZWNhdGVkIHRlc3QgY29udGFpbmVycyBpbiB0ZXN0cyA8Y29kZT50ZXN0c3VpdGU8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU5NDQiPiMmIzgyMDM7NDU5NDQ8L2E+IE9URUw6IFVzZSBzdWdnZXN0ZWQgJ2NvZGUuZnVuY3Rpb24ubmFtZScgZm9yIHNwYW4gYXR0cmlidXRlcyA8Y29kZT5vYnNlcnZhYmlsaXR5PC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1OTY1Ij4jJiM4MjAzOzQ1OTY1PC9hPiBbT0lENFZDSV0gUmV2aXNpdCBhbmQgZml4IE9BdXRoQ2xpZW50LmNyZWRlbnRpYWxSZXF1ZXN0KCkgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ1OTkyIj4jJiM4MjAzOzQ1OTkyPC9hPiBDbGFyaWZ5IG9wZXJhdG9yIGluc3RydWN0aW9ucyBpbnZvbHZpbmcgV2lsZGNhcmQgY2VydGlmaWNhdGVzIGFuZCBPcGVuU2hpZnQgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU5OTYiPiMmIzgyMDM7NDU5OTY8L2E+IEVuZm9yY2UgYExGYCBsaW5lIGVuZGluZ3Mgb24gYCoudHN4YCBmaWxlcyB3aXRoIGAuZ2l0YXR0cmlidXRlc2AgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDU5OTkiPiMmIzgyMDM7NDU5OTk8L2E+IFtPSUQ0VkNJXSBSZXZpc2l0IGFuZCBmaXggT0F1dGhDbGllbnQuY3JlZGVudGlhbE9mZmVyVXJpUmVxdWVzdCgpIDxjb2RlPm9pZDR2YzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjAwMSI+IyYjODIwMzs0NjAwMTwvYT4gW09JRDRWQ0ldIFJldmlzaXQgYW5kIGZpeCBPQXV0aENsaWVudC5jcmVkZW50aWFsT2ZmZXJSZXF1ZXN0KCkgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2MDQzIj4jJiM4MjAzOzQ2MDQzPC9hPiBVcGdyYWRlIHRvIFF1YXJrdXMgMy4zMS4yIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjA1NSI+IyYjODIwMzs0NjA1NTwvYT4gW09JRDRWQ0ldIENvbmZpbmUgdGVzdCByZWFsbSBzZXR1cCB0byBUZXN0Q2FzZS5jb25maWd1cmVUZXN0UmVhbG0oKSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjE1NiI+IyYjODIwMzs0NjE1NjwvYT4gQWRkIG5vZGUgY291bnQgYW5kIG5leHQtbm9kZSBzZWxlY3Rpb24gdG8gTG9hZEJhbGFuY2VyIEFQSSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjE2NCI+IyYjODIwMzs0NjE2NDwvYT4gU2VwYXJhdGUgcGFzc3dvcmQgYW5kIE9UUCBicnV0ZSBmb3JjZSBwcm90ZWN0aW9uIHRvIHByZXZlbnQgT1RQIGJ5cGFzcyBhdHRhY2tzIGJ5IGRlZmF1bHQgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDYyNTUiPiMmIzgyMDM7NDYyNTU8L2E+IFVwZ3JhZGUgdG8gUXVhcmt1cyAzLjMyLjAuQ1IxIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjI5MiI+IyYjODIwMzs0NjI5MjwvYT4gQWxsb3cgdG8gZXhwb3NlIFdlbGxLbm93biBwcm92aWRlciB2aWEgU2VydmVyTWV0YWRhdGFSZXNvdXJjZSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjMwNCI+IyYjODIwMzs0NjMwNDwvYT4gU1BJRkZFIElkZW50aXR5IFByb3ZpZGVyIGRlZmF1bHQgVFRMIHRvbyBsb3cgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDYzNTUiPiMmIzgyMDM7NDYzNTU8L2E+IFtPSUQ0VkNJXSBBZGQgc3VwcG9ydCBmb3IgQ3JlZGVudGlhbFNjb3BlUmVwcmVzZW50YXRpb24gPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2Mzk1Ij4jJiM4MjAzOzQ2Mzk1PC9hPiBYNTA5IENlcnRpZmljYXRlcyBwYXNzZWQgZnJvbSBUcmFlZmlrIFBhc3NUbHNDbGllbnRDZXJ0IG1pZGRsZXdhcmUgYnJva2VuIHNpbmNlIDI2LjUuMCA8Y29kZT5hdXRoZW50aWNhdGlvbjwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjQyMSI+IyYjODIwMzs0NjQyMTwvYT4gUmV2aXNpdCBJbmZpbmlzcGFuIHNlc3Npb24gaWRsZSBhbmQgbGlmZXRpbWUgc2V0dGluZ3MgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY0MjkiPiMmIzgyMDM7NDY0Mjk8L2E+IEFkZCB1c2VybmFtZSB0byBCcm9rZXJlZElkZW50aXR5Q29udGV4dCBjcmVhdGVkIGZyb20gSldUQmVhcmVyIEdyYW50IDxjb2RlPnRva2VuLWV4Y2hhbmdlL2ZlZGVyYXRlZDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjQ3MSI+IyYjODIwMzs0NjQ3MTwvYT4gQWdncmVnYXRlIGNsaWVudC1pZCBmaWVsZCBmb3IgaW1wcm92ZWQgSW5maW5pc3BhbiBxdWVyeSA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjQ5NCI+IyYjODIwMzs0NjQ5NDwvYT4gQWxsb3cgY3VzdG9taXppbmcgZmVkZXJhdGVkIGlkZW50aXR5IGxvb2t1cCBpbiBKV1RBdXRob3JpemF0aW9uR3JhbnRUeXBlIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NTMxIj4jJiM4MjAzOzQ2NTMxPC9hPiBDb25zaWRlciBleHBvc2luZyBVVUlEIGZvciBhZG1pbiBhcGkgdjIgcmVzb3VyY2VzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NTU2Ij4jJiM4MjAzOzQ2NTU2PC9hPiBGb3IgTVNTUUwgU2VydmVyLCBzZXQgYHNlbmRTdHJpbmdQYXJhbWV0ZXJzQXNVbmljb2RlYCB0byBgZmFsc2VgIGJ5IGRlZmF1bHQgPGNvZGU+c3RvcmFnZTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjU1NyI+IyYjODIwMzs0NjU1NzwvYT4gS2V5Y2xvYWsgc2hvdWxkIGNoZWNrIHRoZSBVbmljb2RlIHNldHVwIG9mIHRoZSBkYXRhYmFzZSBvbiBzdGFydHVwIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NjAzIj4jJiM4MjAzOzQ2NjAzPC9hPiBBZGQgRGF0YWJhc2UgQ0xJIG9wdGlvbnMgZm9yIFRMUyBlbmNyeXB0aW9uIGZvciBkYXRhYmFzZXMgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY2MTciPiMmIzgyMDM7NDY2MTc8L2E+IE1DUCBEb2N1bWVudGF0aW9uIGZvciAyNi42IDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NjI2Ij4jJiM4MjAzOzQ2NjI2PC9hPiBBbGxvdyB0byBjb25maWd1cmUgQ2xpZW50IEFzc2VydGlvbiBtYXggZXhwaXJhdGlvbiBmb3IgS3ViZXJuZXRlcyBJZGVudGl0eSBQcm92aWRlciA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjYyNyI+IyYjODIwMzs0NjYyNzwvYT4gQWxsb3cgdG8gY29uZmlndXJlIENsaWVudCBBc3NlcnRpb24gbWF4IGV4cGlyYXRpb24gZm9yIE9JREMgSWRlbnRpdHkgUHJvdmlkZXIgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY2NTciPiMmIzgyMDM7NDY2NTc8L2E+IFBhc3N3b3JkcyBjb250YWluaW5nIGAkJGAgb3IgYCR7YCBwYXR0ZXJucyBhcmUgbWFuZ2xlZCB3aGVuIHNldCB2aWEgZW52aXJvbm1lbnQgdmFyaWFibGVzIChTbWFsbFJ5ZSBleHByZXNzaW9uIGV2YWx1YXRpb24pIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjY3MSI+IyYjODIwMzs0NjY3MTwvYT4gQWxsb3cgY3VzdG9tIHRpbWVvdXRzIGluIERCTG9ja1Byb3ZpZGVyIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2Njg5Ij4jJiM4MjAzOzQ2Njg5PC9hPiBSZW1vdmUgdXNlciBpbnB1dCByZWZsZWN0aW9uIGluIFRva2VuIEludHJvc3BlY3Rpb24gZXJyb3IgcmVzcG9uc2VzIDxjb2RlPm9pZGM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY2OTMiPiMmIzgyMDM7NDY2OTM8L2E+IEdyb3VwLWxldmVsIGRlbnkgcG9saWNpZXMgZG8gbm90IGJsb2NrIGBtYW5hZ2UtZ3JvdXAtbWVtYmVyc2hpcGAgb24gZ3JvdXAgbWVtYmVycyA8Y29kZT5hZG1pbi9maW5lLWdyYWluZWQtcGVybWlzc2lvbnM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY2OTkiPiMmIzgyMDM7NDY2OTk8L2E+IENJTUQgLSBQZXJmb3JtYW5jZTogQXZvaWQgcmVwZWF0ZWQgY29udmVydENvbnRlbnRGaWxsZWRMaXN0KCkgaW4gdmVyaWZ5VXJpKCkgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY3MDEiPiMmIzgyMDM7NDY3MDE8L2E+IENJTUQgLSBQZXJmb3JtYW5jZTogU2luZ2xlLXBhc3MgSFRUUCBDYWNoZS1Db250cm9sIGhlYWRlciBsb29rdXAgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY3MDMiPiMmIzgyMDM7NDY3MDM8L2E+IENJTUQgLSBQZXJmb3JtYW5jZTogRWxpbWluYXRlIGRvdWJsZSBVUkkgcGFyc2luZyBpbiBDbGllbnRJZFVyaVNjaGVtZUNvbmRpdGlvbi5hcHBseVBvbGljeSgpIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NzA4Ij4jJiM4MjAzOzQ2NzA4PC9hPiBDSU1EIC0gUGVyZm9ybWFuY2U6IEF2b2lkIHN0cmVhbWluZyB0aGUgZGlyZWN0aXZlIGxpc3QgbXVsdGlwdWwgdGltZXMgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY3MTEiPiMmIzgyMDM7NDY3MTE8L2E+IFVwZ3JhZGUgdG8gUXVhcmt1cyAzLjMyLjEgPGNvZGU+ZGlzdC9xdWFya3VzPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NzI4Ij4jJiM4MjAzOzQ2NzI4PC9hPiBVc2UgcXVhcmt1cyBwcm9wZXJ0aWVzIGFoZWFkIG9mIGtleWNsb2FrIGRlZmF1bHRzIG9yIG1hcCBmcm9tIHZhbHVlcyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80Njc1NyI+IyYjODIwMzs0Njc1NzwvYT4gVXBncmFkZSB0byBqYWNrc29uLWNvcmUgMi4yMS4xIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NzY1Ij4jJiM4MjAzOzQ2NzY1PC9hPiBBZGRpbmcgbWlzc2luZyBxdWVzdGlvbiBtYXJrIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2NzgxIj4jJiM4MjAzOzQ2NzgxPC9hPiBJZFAgYWxpYXMgaXMgbm90IGNsaWNrYWJsZSBpbiBvcmdhbml6YXRpb24ncyBJZGVudGl0eSBQcm92aWRlcnMgdGFiIDxjb2RlPmFkbWluL3VpPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2Nzk2Ij4jJiM4MjAzOzQ2Nzk2PC9hPiBEb2N1bWVudCB0aGF0IGV4cG9ydCBpcyBub3QgYSBiYWNrdXAgPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY4MDkiPiMmIzgyMDM7NDY4MDk8L2E+IFNldCBhIGRlZmF1bHQgY29ubmVjdGlvbiB0aW1lb3V0IGZvciBhbGwgZGF0YWJhc2VzIHR5cGVzIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2ODcyIj4jJiM4MjAzOzQ2ODcyPC9hPiBCZSBtb3JlIGV4cGxpY2l0IG9uIGhvdyB0byBlbmFibGUgT1RlbCBMb2dzIGFuZCBNZXRyaWNzIGluIE9wZXJhdG9yIDxjb2RlPm9ic2VydmFiaWxpdHk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDY4NzQiPiMmIzgyMDM7NDY4NzQ8L2E+IEJlIG1vcmUgZXhwbGljaXQgaW4gdXNpbmcgdGhlIE9UZWwgTG9ncyBsZXZlbCA8Y29kZT5vYnNlcnZhYmlsaXR5PC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2ODkwIj4jJiM4MjAzOzQ2ODkwPC9hPiBVcGdyYWRlIHRvIFF1YXJrdXMgMy4zMi4yIDxjb2RlPmRpc3QvcXVhcmt1czwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NjkzNiI+IyYjODIwMzs0NjkzNjwvYT4gUmVkdWNlIHRpZ2h0bHkgY291cGxpbmcgYmV0d2VlbiBjbGllbnQgcG9saWN5IGNvbnRleHRzIGFuZCBjb25kaXRpb25zL2V4ZWN1dG9ycyA8Y29kZT5vaWRjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2OTY0Ij4jJiM4MjAzOzQ2OTY0PC9hPiBBZGRpbmcgbW9yZSBIdW5nYXJpYW4gdHJhbnNsYXRpb25zIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ2OTcyIj4jJiM4MjAzOzQ2OTcyPC9hPiBDbGFyaWZ5IGNyZWRlbnRpYWxzIGZpZWxkIGF2YWlsYWJpbGl0eSBpbiBHRVQgL2FkbWluL3JlYWxtcy97cmVhbG19L3VzZXJzIGRvY3VtZW50YXRpb24gPC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDcwMzgiPiMmIzgyMDM7NDcwMzg8L2E+IFRyYW5zbGF0aW9uIHN1cHBvcnQgZm9yIFVJIHRoZW1lIGRlc2NyaXB0aW9ucyA8Y29kZT50cmFuc2xhdGlvbnM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDcwODEiPiMmIzgyMDM7NDcwODE8L2E+IFVwZ3JhZGUgdG8gUXVhcmt1cyAzLjMyLjMgPGNvZGU+ZGlzdC9xdWFya3VzPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ3MTMwIj4jJiM4MjAzOzQ3MTMwPC9hPiBVcGdyYWRlIHRvIFF1YXJrdXMgMy4zMy4wLkNSMSA8Y29kZT5kaXN0L3F1YXJrdXM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDcxNDAiPiMmIzgyMDM7NDcxNDA8L2E+IEFkZCBDTEkgb3B0aW9uIGZvciBkYXRhYmFzZSBjb25uZWN0aW9uIHRpbWVvdXQgYW5kIHByb3ZpZGUgaXQgaW50byBxdWFya3VzLmRhdGFzb3VyY2UuamRiYy5sb2dpbi10aW1lb3V0IDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ3MTQ2Ij4jJiM4MjAzOzQ3MTQ2PC9hPiBLZXljbG9hazogbm8gbmF0aXZlIG9wdGlvbiB0byBjdXN0b21pemUgSlNPTiBsb2cgc2VydmljZS5uYW1lIGFuZCBzZXJ2aWNlLmVudmlyb25tZW50IGZpZWxkcyA8Y29kZT5vYnNlcnZhYmlsaXR5PC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ3MTYzIj4jJiM4MjAzOzQ3MTYzPC9hPiBFbmhhbmNlbWVudDogUGFzc3dvcmQgZGVueWxpc3QgZmlsZSBjaGFuZ2VzIHNob3VsZCBub3QgcmVxdWlyZSBzZXJ2ZXIgcmVzdGFydCA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NzE4NyI+IyYjODIwMzs0NzE4NzwvYT4gQXN5bmNocm9ub3VzIHNlcnZlciBpbml0aWFsaXphdGlvbiA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NzIyOSI+IyYjODIwMzs0NzIyOTwvYT4gSWRlbnRpdHkgUHJvdmlkZXIgcmVkaXJlY3Rpb24gdmlhIGtjX2lkcF9oaW50IGluIFB1c2hlZCBBdXRob3JpemF0aW9uIFJlcXVlc3QgPGNvZGU+b2lkYzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NzQxNiI+IyYjODIwMzs0NzQxNjwvYT4gQXN5bmMgc3RhcnR1cCBkb2Vzbid0IGJlIGVuYWJsZWQgd2hlbiB0aGUgaGVhbHRoIGNoZWNrIGlzIG5vdCBlbmFibGVkIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ3NTM1Ij4jJiM4MjAzOzQ3NTM1PC9hPiBQb2xpc2hpbmcgQ05QRyBpbnN0YWxsYXRpb24gZG9jcyA8L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NzY2NyI+IyYjODIwMzs0NzY2NzwvYT4gVXBkYXRlIHJlbGVhc2Utbm90ZXMgZm9yIENJTUQgPC9saT4KPC91bD4KCjxoMz5CdWdzPC9oMz4KPHVsPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8yMjU2OSI+IyYjODIwMzsyMjU2OTwvYT4gUHJvdmlkZSBkZXNjcmlwdGlvbnMgZm9yIGRlZmF1bHQgcmVhbG0tbWFuYWdlbWVudCByb2xlcyA8Y29kZT5hZG1pbi91aTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8yNjk0NiI+IyYjODIwMzsyNjk0NjwvYT4gTXVsdGlwbGUgcHJvdG9jb2xNYXBwZXJzIHdpdGggdGhlIHNhbWUgbmFtZS4gPGNvZGU+YWRtaW4vYXBpPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzI4OTcwIj4jJiM4MjAzOzI4OTcwPC9hPiBEb2N1bWVudGlvbiBhYm91dCB0aGUgZGVmYXVsdCBkYi1zY2hlbWEgaXMgYW1iaWd1b3VzIDxjb2RlPmRvY3M8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMzY1OTMiPiMmIzgyMDM7MzY1OTM8L2E+IEJ1aWx0LWluIGF1dGhlbnRpY2F0aW9uIGZsb3dzIGFyZSBub3QgdXBkYXRlZCBmb3IgS0MgMjYgPGNvZGU+b3JnYW5pemF0aW9uczwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zNzIzMSI+IyYjODIwMzszNzIzMTwvYT4gU2V0IE5ldyBQYXNzd29yZCBNdWx0aXBsZSBUaW1lcyB2aWEgUGFzc3dvcmQgUmVzZXQgRnVuY3Rpb24gPGNvZGU+bG9naW4vdWk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvMzg5OTEiPiMmIzgyMDM7Mzg5OTE8L2E+IFtUZXN0IGZyYW1ld29ya10gRW1iZWRkZWQgc2VydmVyIC0+IGRlcGVuZGVuY3kgZG93bmxvYWQgZXJyb3Igd2hlbiBubyB2ZXJzaW9uIGlzIHNwZWNpZmllZCA8Y29kZT50ZXN0LWZyYW1ld29yazwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy8zOTEyNyI+IyYjODIwMzszOTEyNzwvYT4gSW5jb3JyZWN0IHJldHVybiBjb2RlIHdpdGggSldUIGFsZ29yaXRobSBzZXQgdG8gbm9uZSA8Y29kZT5hdXRoZW50aWNhdGlvbjwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MDUxMCI+IyYjODIwMzs0MDUxMDwvYT4gT3JnYW5pemF0aW9uIGZsb3cgZG8gbm90IHJlZGlyZWN0IHdoZW4gY3JlZGVudGlhbHMgZXhpc3QgPGNvZGU+b3JnYW5pemF0aW9uczwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MDc1MyI+IyYjODIwMzs0MDc1MzwvYT4gUmVzb3VyY2UgbGVhazogRmlsZUlucHV0U3RyZWFtIGluIFV0aWwucmVhZFByb3BlcnRpZXMoRmlsZSkgaXMgbmV2ZXIgY2xvc2VkIC5TQVNUIDxjb2RlPmNvcmU8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDA5MjEiPiMmIzgyMDM7NDA5MjE8L2E+IFJlamVjdCBpbnZhbGlkIHJlc291cmNlIElEcyBpbiBwZXJtaXNzaW9uIGNyZWF0aW9uIDwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQxMTY1Ij4jJiM4MjAzOzQxMTY1PC9hPiBGZWlzaHUgbG9naW4gaGFzIGJlZW4gY29udGludW91c2x5IGZhaWxpbmcgYXMgYW4gaWRlbnRpdHkgcHJvdmlkZXIgPGNvZGU+aWRlbnRpdHktYnJva2VyaW5nPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQxNjMwIj4jJiM4MjAzOzQxNjMwPC9hPiBXYXJuaW5nIGxvZyBtZXNzYWdlIFNSQ0ZHMDEwMDg6IFRoZSB2YWx1ZSBkZWZhdWx0IGhhcyBiZWVuIGNvbnZlcnRlZCBieSBhIEJvb2xlYW4gQ29udmVydGVyIHRvICJmYWxzZSIgPGNvZGU+ZGlzdC9xdWFya3VzPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQxOTI0Ij4jJiM4MjAzOzQxOTI0PC9hPiBJbnRlcm5hbCBzZXJ2ZXIgZXJyb3IgYWZ0ZXIgY2hhbmdpbmcgQWRtaW4gVUkgdGhlbWUgdG8gImJhc2UiIC0gQW4gb2xkLCBwZXJzaXN0ZWQgcHJvYmxlbSA8Y29kZT5hZG1pbi91aTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MjIyMiI+IyYjODIwMzs0MjIyMjwvYT4gRmVkZXJhdGlvbiBDYWNoZSBQb2xpY3kgZGV0YWlscyBub3Qgc2hvd24gd2hlbiBlZGl0aW5nIHByb3ZpZGVyIGluIEtleWNsb2FrIDI2LjMrIDxjb2RlPmFkbWluL3VpPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQyODM2Ij4jJiM4MjAzOzQyODM2PC9hPiBPcmdhbml6YXRpb24gc2VsZWN0aW9uIGNoYW5nZXMgYWZ0ZXIgdG9rZW4gcmVmcmVzaCA8Y29kZT5vcmdhbml6YXRpb25zPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQyODM5Ij4jJiM4MjAzOzQyODM5PC9hPiBVc2VySW5mbyBlbmRwb2ludCByZXR1cm5zIGluY29ycmVjdCBvcmdhbml6YXRpb24gY2xhaW0gPGNvZGU+b3JnYW5pemF0aW9uczwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzE5OCI+IyYjODIwMzs0MzE5ODwvYT4gT3BlcmF0b3Igc3RhdHVzIHBhdGNoaW5nIG9mIGtleWNsb2FrIGZhaWxlZCA8Y29kZT5vcGVyYXRvcjwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzIwMSI+IyYjODIwMzs0MzIwMTwvYT4gZW50aXR5IG1hcHBpbmdzIG5vdCB3b3JraW5nIG9uIDI2LjQgPGNvZGU+Y29yZTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzM1NiI+IyYjODIwMzs0MzM1NjwvYT4gS2V5Y2xvYWsgdGVzdHMgZnJhbWV3b3JrIC0gaXNzdWUgdG8gaWRlbnRpZnkgZGlzdHJpYnV0aW9uIGRpcmVjdG9yeSBpbnNpZGUgWklQIGZpbGUgd2hlbiB2ZXJzaW9uIHN0cmluZyB1c2VzIHN1ZmZpeCA8Y29kZT50ZXN0LWZyYW1ld29yazwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80MzYxMyI+IyYjODIwMzs0MzYxMzwvYT4gY2FzZSBpbnNlbnNpdGl2ZSBtYXRjaCBvbiBvcmdhbml6YXRpb24gaWRlbnRpdHkgcHJvdmlkZXIgZG9tYWluIC0gSW4gY2FzZSAnQU5ZJyBvcHRpb24gaXMgY2hvc2VuIDxjb2RlPm9yZ2FuaXphdGlvbnM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDM3MjYiPiMmIzgyMDM7NDM3MjY8L2E+IFNsb3cgZXZhbHVhdGlvbiBvZiBjbGllbnQgcm9sZXMgd2l0aCBkb3RzIGZvciByb2xlIG1hcHBlciBhbmQgb3RoZXJzIDxjb2RlPmlkZW50aXR5LWJyb2tlcmluZzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80Mzc1NyI+IyYjODIwMzs0Mzc1NzwvYT4gQ29kZSBFeGFtcGxlcyBpbiBBdXRoZW50aWNhdGlvbiBTUEkgRG9jdW1lbnRhdGlvbiBEb24ndCBNYXRjaCBRdWlja3N0YXJ0cyBSZXBvc2l0b3J5IDxjb2RlPmF1dGhlbnRpY2F0aW9uPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQzODU0Ij4jJiM4MjAzOzQzODU0PC9hPiBPSUQ0VkNJIGNyZWRlbnRpYWxzIGhhdmUgaW52YWxpZCBzdWJqZWN0IGlkIHZhbHVlIDxjb2RlPm9pZDR2YzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80Mzk0OSI+IyYjODIwMzs0Mzk0OTwvYT4gTXVsdGl2YWx1ZWRTdHJpbmcgaW4gbWFwcGVycyBpcyBub3Qgc2F2ZWQgdG8gYmFja2VuZCB3aXRoIHNob3duIGRlZmF1bHQgdmFsdWUgPGNvZGU+YWRtaW4vdWk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDM5OTEiPiMmIzgyMDM7NDM5OTE8L2E+IEtleWNsb2FrIG9wZXJhdG9yIC0gUmVjb25jaWxpYXRpb24gZmFpbHVyZSA8Y29kZT5vcGVyYXRvcjwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDA5OSI+IyYjODIwMzs0NDA5OTwvYT4gT3V0IG9mIG1lbW9yeSBhZnRlciAzLTQgcmVzdGFydHMgb2YgZW1iZWRkZWQgc2VydmVyIDxjb2RlPnRlc3RzdWl0ZTwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDEwMCI+IyYjODIwMzs0NDEwMDwvYT4gSXNzdWUgd2l0aCBzdGFydGluZyBzZXJ2ZXIgcmVzdWx0cyBpbiBjb25uZWN0aW9uIHJlZnVzZWQgZXhjZXB0aW9uIGluIHRlc3QgPGNvZGU+dGVzdHN1aXRlPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0MTMyIj4jJiM4MjAzOzQ0MTMyPC9hPiBCdWcgLT4gS2V5Y2xvYWsgcHJldmlldyBmZWF0dXJlICJzY3JpcHRzIiBpcyBlbmFibGVkIGJ5IGRlZmF1bHQgPGNvZGU+YXV0aGVudGljYXRpb248L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQyODMiPiMmIzgyMDM7NDQyODM8L2E+IEZsYWt5IHRlc3Q6IG9yZy5rZXljbG9hay50ZXN0c3VpdGUuZmVkZXJhdGlvbi5sZGFwLkxEQVBHcm91cE1hcHBlclRlc3QjdGVzdDA2X2FkZGluZ1VzZXJUb05ld0tleWNsb2FrR3JvdXAgPGNvZGU+Y2k8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ0MDMiPiMmIzgyMDM7NDQ0MDM8L2E+IERDUiBlbmRwb2ludCBpZ25vcmVzIGNsaWVudCdzIHJlcXVlc3RlZCB0b2tlbl9lbmRwb2ludF9hdXRoX21ldGhvZCA8Y29kZT5vaWRjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0NDI1Ij4jJiM4MjAzOzQ0NDI1PC9hPiBbS2V5Y2xvYWsgSlMgQ0ldIEFkbWluIFVJIEUyRSBGaXJlZm94IGZhaWx1cmUgPGNvZGU+Y2k8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ0OTgiPiMmIzgyMDM7NDQ0OTg8L2E+IFtxdWljay10aGVtZV0gTG9nbyBhbmQgRmF2aWNvbiBwcm9ibGVtIDxjb2RlPmxvZ2luL3VpPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0NTc0Ij4jJiM4MjAzOzQ0NTc0PC9hPiBVbmFibGUgdG8gZmluZCBjb250ZXh0dWFsIGRhdGEgb2YgdHlwZTogb3JnLmtleWNsb2FrLm1vZGVscy5LZXljbG9ha1Nlc3Npb24gPGNvZGU+dGVzdHN1aXRlPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0NTk4Ij4jJiM4MjAzOzQ0NTk4PC9hPiBTQU1MIHVzZXIgY3JlYXRlZCB3aXRoIG51bGwgdXNlcm5hbWUgd2hlbiBtYXBwZWQgYXR0cmlidXRlIG1pc3NpbmcgPGNvZGU+c2FtbDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDYyMiI+IyYjODIwMzs0NDYyMjwvYT4gT0lENFZDSSBmdW5jdGlvbmFsaXR5IHNob3VsZCBiZSBkaXNhYmxlZCBmb3IgdGhlIHJlYWxtIHdoZW4gIlZlcmlmaWVkIENyZWRlbnRpYWxzIiBzd2l0Y2ggaXMgZGlzYWJsZWQgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0NjM3Ij4jJiM4MjAzOzQ0NjM3PC9hPiBGYWlsIHRvIGltcG9ydCB0aGUgcmVhbG0gd2l0aCBPSUQ0VkNJIGVuYWJsZWQgPGNvZGU+aW1wb3J0LWV4cG9ydDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDY3MCI+IyYjODIwMzs0NDY3MDwvYT4gQ3JlZGVudGlhbEVuZHBvaW50IGNhbiBiZSBpbnZva2VkIHdpdGggaW5jb3JyZWN0IGFjY2VzcyB0b2tlbiA8Y29kZT5vaWQ0dmM8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ2NzgiPiMmIzgyMDM7NDQ2Nzg8L2E+IEluY29uc2lzdGVudCBzZWFyY2ggd2hlbiB1c2luZyB3aWxkY2FyZHMgPGNvZGU+YWRtaW4vYXBpPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0Njk5Ij4jJiM4MjAzOzQ0Njk5PC9hPiBOb3QgYWJsZSB0byBmaW5kIGtleSBmb3IgY3JlZGVudGlhbCBzaWduYXR1cmUgaWYgY2xpZW50IHNjb3BlIHdhcyBzYXZlZCBmcm9tIGFkbWluIGNvbnNvbGUgPGNvZGU+YWRtaW4vdWk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ3MzciPiMmIzgyMDM7NDQ3Mzc8L2E+IENyZWRlbnRpYWxSZXF1ZXN0IHJlcXVpcmVzIHRoYXQgY2xpZW50IHNjb3BlIGlzIGFzc2lnbmVkIGFzICdPcHRpb25hbCcgPGNvZGU+b2lkNHZjPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0Nzg0Ij4jJiM4MjAzOzQ0Nzg0PC9hPiBsaW5rIHRvIHJlc2V0LWNyZWRlbnRpYWxzIGlnbm9yZXMgZGVmYXVsdCBsb2NhbGUgQU5EIHVpX2xvY2FsZXMgPGNvZGU+bG9naW4vdWk8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ4MDMiPiMmIzgyMDM7NDQ4MDM8L2E+IFVuaGFuZGxlZCBJbGxlZ2FsQXJndW1lbnRFeGNlcHRpb24gaW4gU0FNTFJlcXVlc3RQYXJzZXIgPGNvZGU+c2FtbDwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDgwNyI+IyYjODIwMzs0NDgwNzwvYT4gW09JRDRWQ0ldIERlZmF1bHQgdmFsdWVzIGFyZSBub3Qgc2V0IGZvciBDbGllbnRTY29wZSA8Y29kZT5jb3JlPC9jb2RlPjwvbGk+CjxsaT48YSBocmVmPSJodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va2V5Y2xvYWsva2V5Y2xvYWsvaXNzdWVzLzQ0ODE5Ij4jJiM4MjAzOzQ0ODE5PC9hPiBNaXNzaW5nIHZhbGlkYXRpb24gZXJyb3IgbGFiZWwgb24gVUkgd2hlbiBlZGl0aW5nIGEgdXNlciA8Y29kZT51c2VyLXByb2ZpbGU8L2NvZGU+PC9saT4KPGxpPjxhIGhyZWY9Imh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9rZXljbG9hay9rZXljbG9hay9pc3N1ZXMvNDQ4MjQiPiMmIzgyMDM7NDQ4MjQ8L2E+IEtleWNsb2FrIHJldGFpbnMgbWFwcGVkIGZpcnN0TmFtZSB2YWx1ZSBhbmQgZG9lcyBub3QgbnVsbGlmeSBpdCB3aGVuIHVwc3RyZWFtIGlkZW50aXR5IHByb3ZpZGVyIHN0b3BzIHNlbmRpbmcgdGhlIGNsYWltIDxjb2RlPmlkZW50aXR5LWJyb2tlcmluZzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDg3NSI+IyYjODIwMzs0NDg3NTwvYT4gW09JRDRWQ0ldIENyZWRlbnRpYWxTaWduZXJFeGNlcHRpb246IFByb29mIFR5cGUgbnVsbCBpcyBub3Qgc3VwcG9ydGVkIGZvciBmb3JtYXQgbGRwX3ZjIDxjb2RlPm9pZDR2YzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDkwNSI+IyYjODIwMzs0NDkwNTwvYT4gRW1haWwgaXMgbm90IHVwZGF0ZWQgYmFzZWQgb24gdXBzdHJlYW0gSWRQIGVtYWlsIDxjb2RlPmlkZW50aXR5LWJyb2tlcmluZzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NDk2MSI+IyYjODIwMzs0NDk2MTwvYT4gQXV0aG9yaXphdGlvbl9kZXRhaWxzIGFkZGVkIHRvIHRva2VuLXJlc3BvbnNlIGV2ZW4gd2hlbiBzaG91bGQgbm90IGJlIDxjb2RlPm9pZDR2YzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTAwNSI+IyYjODIwMzs0NTAwNTwvYT4gW09JRDRWQ0ldIFJldmlzaXQgYW5kIGZpeCAvY3JlZGVudGlhbF9vZmZlcl91cmkgZW5kcG9pbnQgIDxjb2RlPm9pZDR2YzwvY29kZT48L2xpPgo8bGk+PGEgaHJlZj0iaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tleWNsb2FrL2tleWNsb2FrL2lzc3Vlcy80NTA1OCI+IyYjODIwMzs0NTA1ODwvYT4gQmFzZSB0aGVtZTogInVzZXIgcHJvcGVydGllcyIgYW5kICJyZWdpc3RlciIgcmVxdWlyZWQgbWFyayBpcwoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IChVVEMpCgotIEJyYW5jaCBjcmVhdGlvbgogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCi0gQXV0b21lcmdlCiAgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkKCvCfmqYgKipBdXRvbWVyZ2UqKjogRW5hYmxlZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGlzIGJlaGluZCBiYXNlIGJyYW5jaCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL1lBS0VjbG91ZC95YWtlLWFuc2libGUpLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTXk0eE1ESXVNVEVpTENKMWNHUmhkR1ZrU1c1V1pYSWlPaUkwTXk0eE1UQXVNaUlzSW5SaGNtZGxkRUp5WVc1amFDSTZJbTFoYVc0aUxDSnNZV0psYkhNaU9sc2ljbVZ1YjNaaGRHVWlYWDA9LS0+Cg==
      patchset: 054a7bf99c3e0ea7629e79dcedcd5cac0008dbcb
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/YAKEcloud/zuul-config:
            canonical_name: github.com/YAKEcloud/zuul-config
            checkout: main
            commit: 187ca9c93783cf78b5778e0c84c687f3aefbe0a7
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: a01eed06dffe368c1d01819193bfadccb137414d
          untrusted/project_1/github.com/YAKEcloud/zuul-config:
            canonical_name: github.com/YAKEcloud/zuul-config
            checkout: main
            commit: 187ca9c93783cf78b5778e0c84c687f3aefbe0a7
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/YAKEcloud/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/YAKEcloud/yake-ansible
        name: YAKEcloud/yake-ansible
        short_name: yake-ansible
        src_dir: src/github.com/YAKEcloud/yake-ansible
      projects:
        github.com/YAKEcloud/yake-ansible:
          canonical_hostname: github.com
          canonical_name: github.com/YAKEcloud/yake-ansible
          checkout: main
          checkout_description: zuul branch
          commit: 2df751e052eba0ef75ac7ece3ad80ca5db6d2299
          name: YAKEcloud/yake-ansible
          required: false
          short_name: yake-ansible
          src_dir: src/github.com/YAKEcloud/yake-ansible
      ref: refs/pull/582/head
      resources: {}
      tenant: yakecloud
      timeout: 1800
      topic: null
      voting: true
