Last checked and updated on April 19, 2026What Is New in Keycloak 10.0
Keycloak 10.0 is a maintenance release focused on stability and incremental improvements. It lays the groundwork for future features while addressing a significant number of bugs from previous versions.
| Category | Summary |
|---|---|
| New Features | Initial OpenShift 4 support, new JavaScript adapter, and early access to a new account console. |
| Improvements | Enhanced performance for admin console and login pages, updated dependencies, and better metrics. |
| Bug Fixes | Over 150 issues resolved across the server, adapters, and documentation. |
| Deprecations | The legacy keycloak.js adapter is deprecated in favor of the new JavaScript adapter. |
What are the major new features in this release?
The headline addition is the new keycloak-js adapter, which is a ground-up rewrite to support modern JavaScript applications. It uses a Promise-based API, making it much easier to integrate with frameworks like React or Vue.
This release also introduces initial technical support for deploying on Red Hat OpenShift 4. In practice, this means the container images and configuration are better optimized for the OpenShift environment out of the box.
An early version of a new account management console is included. It's not the default yet, but it gives a preview of the modernized user interface that's coming.
How does the performance get better in 10.0?
Several under-the-hood optimizations reduce the load time of the admin console and login pages. The team focused on speeding up page rendering and reducing the number of required round-trips.
Metrics collection saw improvements, making it more reliable to monitor your Keycloak instance. This matters because accurate metrics are crucial for diagnosing performance bottlenecks in a production environment.
What should I know about the JavaScript adapter change?
The old keycloak.js adapter is now deprecated. You should start planning a migration to the new keycloak-js package for any new projects. The new library is available on npm and uses a completely different, more modern API.
For existing applications, the old adapter still works, but you won't get new features or performance improvements. The upgrade path isn't trivial because the API changed significantly, so budget time for testing.
Is upgrading to Keycloak 10.0 a complex process?
As a maintenance release, the upgrade from 9.x should be straightforward for most deployments. The database schema hasn't changed, so a simple roll-and-restart of the server is typically all that's needed.
The main complexity comes if you heavily use the deprecated JavaScript adapter. In that case, the upgrade is a two-part process: upgrading the server and then separately updating your client application code to use the new JS library.
FAQ
Is the new account console ready for production?
No, it's marked as an early preview. It's included for feedback and testing, but you should not enable it for production users yet. The classic console remains the default.
Does OpenShift 4 support mean the old OpenShift 3 template is gone?
No, support for OpenShift 3.x via the legacy template is still present. The 10.0 release adds new, parallel support specifically for OpenShift 4.
Were there any major security vulnerability fixes?
The release notes do not highlight any Common Vulnerabilities and Exposures (CVEs). This was primarily a bug fix and improvement release, not a security patch.
Can I use the new keycloak-js adapter with my Angular app?
Absolutely. The new Promise-based adapter is designed to work seamlessly with modern front-end frameworks like Angular, React, and Vue.js.
Where can I find the full list of changes?
The complete details for all 150+ fixes and changes are in the official Keycloak 10.0.0 release notes.