# What changed in keycloak-js

> 3 changes in keycloak-js 26 from its official release notes, upgrade guides and advisories. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/keycloak-js/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## keycloak-js 26

### Fixes and other changes

- The Cordova in-app browser closes immediately after the redirect URI is captured, preventing a brief “Web page not available” error on Android during token exchange. (26.2.4) — [release notes](https://github.com/keycloak/keycloak-js/releases/tag/26.2.4)
- Hash fragments are preserved in redirect URIs, restoring fragment-based navigation after authentication; unexpected trailing slashes are also addressed. (26.2.2) — [release notes](https://github.com/keycloak/keycloak-js/releases/tag/26.2.2)
- Redirect URLs on a different domain than the application origin no longer cause navigation to fail with a security error. (26.2.2) — [release notes](https://github.com/keycloak/keycloak-js/releases/tag/26.2.2)