/
FOLIO Infrastructure Updates

FOLIO Infrastructure Updates

Overview

Eureka introduced new infrastructure components which are updated frequently. Due to the nature of these components, it’s often desired/required to release and deploy them in between flower/CSP releases. The Technical Council classifies these as “Fast moving infrastructure”. See Umbrellaleaf for additional details.

The purpose of this document is to capture release notes for these components in a single place, so that flower/CSP release notes can then refer back to this page as needed. A change documented here may be applicable to several flower or CSP releases. This page allow us to avoid duplicating information over and over again.

folio-kong (API Gateway)

The Eureka platform’s API gateway for Sunflower and Trillium. A wrapper around the OSS Kong image, providing FOLIO-specific customizations, configurations, additions, etc. Umbrellaleaf will have dual support for folio-kong and it’s successor folio-apisix. Support for folio-kong will eventually end (in Vetch?)

Regarding Versions

The versions of folio-kong and the underlying OSS kong base image will often NOT completely align. This is because we need to allow for changes to the FOLIO-specific customizations independent of OSS kong changes. The Major and Minor version components will always align between the two, but the Patch version will not. See Versioning approach for folio-kong and folio-keycloak for additional details.

v3.9.7 (2026-08-04)

Compatibility: No breaking compatibility changes

Configuration Changes: None

Security-Related Changes

  • KONG-52 upgrades to the Kong 3.9.3 base image which patches a vulnerability in nginx.

Changes Affecting Existing Functionality

  • NA

Other Notable Fixes

  • NA

v3.9.6 (2026-06-26)

Compatibility: Default behavior is backwards compatible. If an allow list is not specified via environment variable, there will be no change in behavior.

Configuration Changes: See https://github.com/folio-org/folio-kong#environment-variables (CORS_ORIGINS) and https://github.com/folio-org/folio-kong#cors-configuration for CORS-related configuration notes/instructions.

Security-Related Changes

  • KONG-48/KONG-53: Introduces the ability to specify an origin allow-list for CORS (Cross-Origin Resource Sharing).

    • What's changing
      We are tightening a security setting that controls which websites are allowed to talk to FOLIO system from a browser. Today, the system is configured to accept requests from any website. We're changing this so that only specifically approved websites are allowed to connect.

    • Why we are making this change
      This is a proactive security hardening measure. FOLIO relies on browser cookies to keep users securely logged in, which means the system needs to trust the websites it is communicating with. The current "allow any website" setting is broader than it should be for a system that handles authenticated, cookie-based sessions — it is a common security best practice to restrict this to a known, approved list rather than allowing all origins. This change reduces the system's exposure to potential cross-site attacks without affecting normal day-to-day use of FOLIO.

    • What this means for customers

      • If you access FOLIO through the standard, supported interface, you don't need to do anything — this change is invisible to you.

      • If you or your institution have built a custom integration or custom front-end that calls FOLIO APIs directly from a browser (i.e., your own web address, separate from the standard FOLIO UI), that address will need to be added to our approved list, or requests from it may be blocked after the change goes live.

Changes Affecting Existing Functionality

  • NA

Other Notable Fixes

  • NA

folio-keycloak (Identity & Access Management)

Responsible for identity and access management on the Eureka platform. A wrapper around the OSS keycloak image, providing FOLIO-specific customizations, additions, etc.

Regarding Versions

The versions of folio-keycloak and the underlying OSS keycloak base image will often NOT completely align. This is because we need to allow for changes to the FOLIO-specific customizations independent of OSS keycloak changes. The Major and Minor version components will always align between the two, but the Patch version will not. See Versioning approach for folio-kong and folio-keycloak for additional details.

v26.7.0 (2026-07-28)

Compatibility: No breaking changes for FOLIO. Minor Keycloak version bump (26.6.3 → 26.7.0); FOLIO plugin SPI surface, KC_FEATURES, and the two OIDC compatibility flags are unchanged.

After upgrading, check the Keycloak startup logs for CREATE INDEX warnings on login_failure, single_use_object, or root_auth_session (26.7.0 adds indexes on these tables, skipped automatically if a table has 300k+ rows). If you see one, plan to run that SQL manually - Keycloak won't retry it on its own later.

While this should be compatible with Trillium, and the latest Sunflower CSP, as of Aug 4, 2026 neither of these configurations have been tested. This page will be updated once testing has been done.

See https://github.com/folio-org/folio-keycloak#version-compatibility

Configuration Changes:

  • NA

Security-Related Changes

Changes Affecting Existing Functionality

  • NA — no FOLIO-visible behavior changes identified

Other Notable Fixes

  • NA

v26.6.0 (2026-06-15)

Compatibility: Default behavior is backwards compatible. If an allow list is not specified via environment variable, there will be no change in behavior.

See https://github.com/folio-org/folio-keycloak#version-compatibility

Configuration Changes: NA

Security-Related Changes

  • KEYCLOAK-112: Upgrade to Keycloak 26.6.2

    • Includes many security-related fixes. See keycloak release notes linked in KEYCLOAK-112 for full details.

Changes Affecting Existing Functionality

  • KEYCLOAK-51: "Return to tenant..." link is missing after mistyping credentials

    • Provides the ability to return to the login screen for the selected tenant if incorrect credentials were entered. Previously this required using the back button or manual navigation.

    • Only applies to the “explicit tenant selection” login flow for ECS-based consortia setups.

      • Clarification: The “explicit tenant selection” login flow refers to the setup where FOLIO users are presented with a drop-down where they select their home tenant they log into. They are then taken to the appropriate login screen (for that tenant).

Other Notable Fixes

  • NA

folio-apisix (API Gateway)

The Eureka platform’s new API gateway introduced in Umbrellaleaf. A wrapper around the OSS Apache APISIX image, providing FOLIO-specific customizations, configurations, additions, etc. Umbrellaleaf will have dual support for folio-apisix and it’s predecessor folio-kong. Support for folio-kong will eventually end (in Vetch?)

Regarding Versions

The versions of folio-apisix and the underlying Apache APISIX base image will often NOT completely align. This is because we need to allow for changes to the FOLIO-specific customizations independent of OSS Apache APISIX changes. The Major and Minor version components will always align between the two, but the Patch version will not. See Versioning approach for folio-kong and folio-keycloak for additional details.

v3.17.0 (Placeholder - not yet released)

This placeholder is included only to show what the page structure would look like as additional versions are released. We typically would not add placeholders here.

Compatibility: This is the first release of folio-apisix.

Configuration Changes: Being the first release of folio-apisix, configuration here is net-new. See https://github.com/folio-org/folio-apisix/blob/master/README.md for details.

Security-Related Changes

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.

Changes Affecting Existing Functionality

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.

Other Notable Fixes

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.

TBD (Template)

short description of the infrastructure component, provide links or other important notes as needed.

v#.#.# (YYYY-MM-DD)

Compatibility: compatibility notes - are there breaking changes here? Does this need to be deployed along with a certain CSP/flower release/etc.

Configuration Changes: brief notes and links pointing to documentation describing configuration changes, or NA if there are no configuration changes.

Security-Related Changes

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.

Changes Affecting Existing Functionality

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.

Other Notable Fixes

  • [JIRA link] - or NA if not applicable.

    • short description

    • other relevant notes, links, etc.

  • [JIRA link]

    • short description

    • other relevant notes, links, etc.