provider-keycloak v0.21.1

What's Changed

• feat(client): experimental Admin API v2 support (Keycloak 26.8+) by @rossigee in #57
• Allow the Go patent-license SPDX ref in dependency review by @rossigee in #58
• chore: bump Go to 1.27.2 to fix govulncheck standard-library vulnerabilities by @rossigee in #59
• chore: build with Go 1.27.3 and pin the scanner actions by @rossigee in #60
• chore: bump crossplane-runtime to v2.5.1 by @rossigee in #61

Full Changelog: v0.21.0...v0.21.1

provider-keycloak v0.21.0

What's Changed

• test(clients): verify the read wrappers build the right Keycloak paths by @rossigee in #40
• test: cover realm Update's read-modify-write, and the provider flag surface by @rossigee in #42
• test(identityprovider): cover the controller, not just its mock by @rossigee in #41
• fix(ci): reconsider auto-merge when a draft is promoted to ready by @rossigee in #39
• test(clients): verify the write wrappers build the right Keycloak paths by @rossigee in #43
• test(user): cover group membership sync, and fix two tests that covered nothing by @rossigee in #44
• test(clientoptionalscopes): cover Update and scopeDiff by @rossigee in #45
• test(role,group,protocolmapper): cover the Update paths that resolve IDs by @rossigee in #46
• fix(clients): reset a client secret with POST, not PUT by @rossigee in #47
• test(realm): cover SMTP config and the realm number coercion by @rossigee in #48
• test(realmkeys,tracing): cover the no-op lifecycle and tracing Init by @rossigee in #49
• docs: add operator remediation for the ClientInitialAccess token backlog by @rossigee in #50
• fix(cmd/provider): wire --cache-init-timeout to the manager, and make main testable by @rossigee in #51
• test(controller): cover Connect and Disconnect for all 23 connectors by @rossigee in #52
• test(controller): cover the Groups connector and the remaining Disconnects by @rossigee in #53
• test(realm,user): cover realm drift detection and group ref resolution by @rossigee in #54
• fix(client): gate Client reconciliation on ProviderConfig readiness by @rossigee in #55
• chore(release): v0.21.0 by @rossigee in #56

Full Changelog: v0.20.1...v0.21.0

provider-keycloak v0.20.1

What's Changed

• fix(lint): correct the yamllint indentation exclusion by @rossigee in #30
• style: clear the last yamllint errors by @rossigee in #31
• fix(clients): stop debug HTTP logging leaking credentials by @rossigee in #33
• test: cover setupRBAC and three untested controllers by @rossigee in #34
• test(clients): cover UpdateRealmRaw rate-limit handling by @rossigee in #35
• test: cover authz, userfederation, component, authorizationpolicy by @rossigee in #36
• Potential fix for code scanning alert no. 6: Log entries created from user input by @rossigee in #32
• fix(clientinitialaccess): read the access ID back from the annotation by @rossigee in #37
• chore(release): v0.20.1 - token-minting and credential-leak fixes by @rossigee in #38

Full Changelog: v0.20.0...v0.20.1

What's Changed

• fix(lint): correct the yamllint indentation exclusion by @rossigee in #30
• style: clear the last yamllint errors by @rossigee in #31
• fix(clients): stop debug HTTP logging leaking credentials by @rossigee in #33
• test: cover setupRBAC and three untested controllers by @rossigee in #34
• test(clients): cover UpdateRealmRaw rate-limit handling by @rossigee in #35
• test: cover authz, userfederation, component, authorizationpolicy by @rossigee in #36
• Potential fix for code scanning alert no. 6: Log entries created from user input by @rossigee in #32
• fix(clientinitialaccess): read the access ID back from the annotation by @rossigee in #37
• chore(release): v0.20.1 - token-minting and credential-leak fixes by @rossigee in #38

Full Changelog: v0.20.0...v0.20.1

provider-keycloak v0.20.0

What's Changed

• fix: IdentityProvider could never be created; scope controllers could not be deleted by @rossigee in #27
• fix(rolemappings, scopes): make client mapping sets additive by @rossigee in #28
• chore(release): v0.20.0 - additive client mapping semantics (breaking) by @rossigee in #29

Full Changelog: v0.19.9...v0.20.0

provider-keycloak v0.19.9

What's Changed

• chore(release): v0.19.8 - Groups finalizer fix by @rossigee in #23
• fix(groups): let a deleted resource release its finalizer by @rossigee in #21
• fix: let a deleted resource release its finalizer, provider-wide by @rossigee in #24
• chore(release): v0.19.9 - Groups finalizer fix across 10 controllers by @rossigee in #25
• fix(protocolmapper): let a mapper left behind by a decommissioned client be deleted by @rossigee in #26

Full Changelog: v0.19.7...v0.19.9

provider-keycloak v0.19.7

What's Changed

• fix: respect rate limit backoff deadline in RateLimitError by @rossigee in #12
• fix: rate limit backoff deadline + 100% test coverage by @rossigee in #13
• chore: normalize CI/release workflows + xpkg publishing overrides by @rossigee in #14
• fix(ci): remove nonexistent make docker.build from build-validation by @rossigee in #15
• chore(deps): bump Crossplane APIs fork by @rossigee in #16
• chore: apply standardized release workflow template by @rossigee in #17
• fix(groups): refuse to sync when two resources claim one user's membership by @rossigee in #18
• chore(release): v0.19.7 - Groups membership conflict fix + ProviderConfig RBAC group fix by @rossigee in #20

Full Changelog: v0.19.5...v0.19.7

provider-keycloak v0.19.6

Full Changelog: v0.19.5...v0.19.6

provider-keycloak v0.19.5

Full Changelog: v0.19.4...v0.19.5

provider-keycloak v0.19.4

Full Changelog: v0.19.3...v0.19.4

provider-keycloak v0.19.3

What's Changed

• fix: standardize release.yml on canonical single-job template by @rossigee in #9
• fix: add missing build step to release.yml by @rossigee in #10
• fix(ci): add explicit xpkg.build step before publish by @rossigee in #11

Full Changelog: v0.19.2...v0.19.3