Skip to main content

TideCloak 0.14.40

Summary​

TideCloak 0.14.40 covers the 0.14.38 → 0.14.40 window (0.14.39 shipped as a submodule bump without separate tagging). It is a substantial release despite looking small on paper: a Keycloak 26.7.0 → 26.7.5 jump pulling in a large upstream CVE batch (the base was pinned at 26.7.0 since 0.14.0), a cross-repo .NET 10 migration, DPoP approval correctness fixes, and IGA quorum/threshold hardening that prevents realm-stranding admin changes. The ORK payer model also removes the 30-day grace period introduced in 0.14.29.

Key Features​

Keycloak 26.7.5 Base + CVE Batch : TideCloak now runs on Keycloak 26.7.5. The base had been pinned at 26.7.0 since 0.14.0; this release moves it through 26.7.4 to 26.7.5 in a single cut (the 26.7.4 bump was in-flight engineering that never shipped as its own tagged release). The jump pulls in a large upstream CVE batch spanning FGAP v2, SAML, OIDC, DPoP, DCR, CIBA, device grant, admin API, and PathMatcher. Includes CVE-2026-14614, -16100, -16072, -16089, -16105, -16108, -17048, -18217, -74909, -79651, -15571, -45292, and -19607. Also bumps Infinispan to 16.0.14, Quarkus to 3.33.4, Apache DS to 2.0.0.AM27, and FreeMarker to 2.3.35. Operators should treat this as a security update.

.NET 10 Migration : Cross-repo migration of the .NET-based components (master-libs, Midgard, tidecloak-override, ORK) from .NET 8 to .NET 10, with Linux x86-64 natives rebuilt for Midgard.

DPoP Approval Correctness : A cluster of DPoP fixes across the stack. Approvals that don't cover the presented key are now refused rather than accepted. DPoP approval notes are persisted only on the session's first mint. A changed DPoP key now triggers re-approval rather than short-circuiting SSO. Re-login no longer clears DPoP keys; the real auth error is surfaced instead. createDpopRoute is now re-exported from @tidecloak/nextjs/server.

IGA Quorum & Threshold Hardening : New safety guards in tidecloak-iga-extensions. A lowering admin threshold is now clamped to the committed holder count. A tide-realm-admin revoke that would strand the realm is refused. The REGEN-last ordering guard now fires only when the threshold rises. Shrink convergence, direction narrowing, and the floor guard are covered. The quorum floor is applied in the bulk-drain path too. Re-approval no longer poisons the multiAdmin doken carrier.

VRK & Provisioning Polish : A provisioned realm with a signed pending VRK is now treated as set up (no longer appears unprovisioned). Switching a VRK surfaces a clearer error, doesn't cancel the task on a manual switch, writes a success log, raises admin events, and uses a stronger lock. Enclave approval now verifies the server actually received the approval before proceeding.

ORK Payer Model Changes : Pending wallets can no longer pay for actions. The 30-day grace period introduced in 0.14.29 has been removed. New Wallet and Customer exception types with error codes expose payer failures more precisely.

Release Tooling : New "Delete Release" workflow in tidecloak-override that deletes branches under the release/* protection rule. release/<ver> branches are now cut from the source branch rather than the previous release, so release branches no longer accumulate drift between cuts.

Enclave SRI : sha256-nv1UjkH8pJnJ5f9vEsLl+Bcne9Uf+H486tKxz/IIzuk=

Upgrade Notes​

  • Security update — this release includes a large upstream Keycloak CVE batch (listed above). Prioritize upgrading.
  • .NET 10 SDK required for consumers that build the .NET components from source. Pre-built images already carry the right runtime.
  • 30-day grace period removed — the grace period introduced in 0.14.29 is gone. Deployments that relied on it (e.g. subscription-expiry tolerance, VRK renewal cadence) should verify behaviour without it before upgrading.
  • DPoP approval tightened — approvals that don't cover the presented key are now refused. Custom DPoP flows that depended on the previous looser check will fail; switch to a flow that re-approves on key change.
  • No separately-tagged 0.14.39 — 0.14.39 shipped as a submodule bump in tidecloak-releases but was never tagged in sub-repos. The 0.14.40 window spans 0.14.38 → 0.14.40 end-to-end.

Detailed changelog​

For a granular per-repository breakdown of changes, see the detailed changelog.