Enhancing Community Contributions in Keycloak Releases

[Vinod Anandan]

Hi Core Team,

I would like to share some thoughts that I recently discussed with Marek regarding community and SIG contributions, particularly in relation to OID4VCI. Currently, the SIG and community have limited visibility and influence over release timelines and milestones.

We fully understand the importance of the new release process. However, we would also like to ensure that community-contributed features are integrated into Keycloak as soon as possible, without affecting velocity. Many of the innovations emerging from the SIG are already managed through feature flags, such as experimental and preview, which means they should not impact users unless explicitly enabled.

Additionally, many organisations, especially end-users, rely on automated procurement processes, making it challenging for them to consume non-versioned packages (e.g., nightly builds or snapshots). Given this, it would be highly beneficial if the core team could consider introducing ad-hoc minor versions to incorporate SIG/community contributions or, alternatively, include them in patch releases ("Enhancements").

If there are other possible approaches, we would love to hear your suggestions.

I am looking forward to hearing from you.

Regards,

Vinod

[Stian Thorgersen]

Doing releases based on individual features like OID4VCI is not going to happen. Many people work on many different things, as such we need to stick to fixed release schedules for better predictably both for contributors and users.

How frequently we do minor releases is a tradeoff between getting features out quickly, how often people should need to upgrade, and the ability to properly support a given release with bug fixes. In that regard a new release every 3 months is already pretty aggressive, and I don't see the wider community being better served by more frequent releases.

With regards to backporting enhancements to patch releases that is also not something we should do as that increases the risk of regressions, breaks semver semantics, and is also a significant additional effort to do.