[dlowenthal18]

Describe your changes

• Update Keycloak from 22.0.1 to 26.8.2-1 and patch its bundled Guava and MariaDB JDBC libraries

Replaced bundled Guava and MariaDB JDBC libraries with temporary fixed versions that will be removed when the Keycloak vender image includes these dependency versions.

These changes resolve 81 coninv findings. The latest scan reports 43 remaining findings, none currently marked fixable or overdue, with no remediation deadlines calculated by coninv.

Notes:

• Token introspection now requires the client requesting the check to appear in the OAuth access token’s audience. This optional EHR path is currently disabled by use_oauth: false.

Issue ticket number and Jira link

N/A

Checklist before requesting a review

• I have performed a self-review of my code
• Ensure the target / base branch for any feature PR is set to dev not main (the only exception to this is releases from dev and hotfix branches)

Checklist for conducting a review

• Review the code changes and make sure they all make sense and are necessary.
• Pull the PR branch locally and test by running through workflow and making sure everything works as it is supposed to.

Workflow

Owner of the Pull Request will be responsible for merge after all requirements are met, including approval from at least one reviewer. Additional changes made after a review will dismiss any approvals and require re-review of the additional updates. Auto merging can be enabled below if additional changes are likely not to be needed. The bot will auto assign reviewers to your Pull Request for you.