diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 68f4155fe..e3dd6a89a 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,12 +1,13 @@
 {
     "name": "Java",
-    "image": "mcr.microsoft.com/vscode/devcontainers/java:1-17",
+    "image": "mcr.microsoft.com/vscode/devcontainers/java:1-21",
     "runArgs": ["--env-file", ".env"],
     "features": {
         "ghcr.io/devcontainers/features/java:1": {
             "installMaven": "true"
         },
-        "ghcr.io/devcontainers/features/docker-in-docker:2": {}
+        "ghcr.io/devcontainers/features/docker-in-docker:2": {},
+        "ghcr.io/devcontainers/features/node:1": {}
     },
     "customizations": {
         "vscode": {
diff --git a/.env b/.env
index 56fdd6bd4..5c9da9d27 100644
--- a/.env
+++ b/.env
@@ -1,4 +1,4 @@
-KEYCLOAK_VERSION=24.0.5
+KEYCLOAK_VERSION=25.0.0
 KEYCLOAK_ADMIN=root
 KEYCLOAK_ADMIN_PASSWORD=test
 KEYCLOAK_BASE_URL=http://auth.openfoodfacts.localhost:5600
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b2e947ba7..5729c7f56 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,10 +44,10 @@ jobs:
         with:
           envFile: '.env'
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: "17"
+          java-version: "21"
           distribution: "temurin"
           cache: maven
 
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 340421e00..7ab8899a9 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -17,10 +17,10 @@ jobs:
         with:
           envFile: '.env'
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: "17"
+          java-version: "21"
           distribution: "temurin"
           cache: maven
 
diff --git a/Dockerfile b/Dockerfile
index 6f556aaa6..bbb86f53b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 ARG KEYCLOAK_VERSION
 
 # build a custom extensions for keycloak using maven
-FROM maven:3-eclipse-temurin-17 AS builder
+FROM maven:3-eclipse-temurin-21 AS builder
 
 ARG KEYCLOAK_VERSION
 WORKDIR /build
diff --git a/docker-compose-run.yml b/docker-compose-run.yml
index c25477b9d..bdd08e8e4 100644
--- a/docker-compose-run.yml
+++ b/docker-compose-run.yml
@@ -25,7 +25,7 @@ services:
         condition: service_started
 
   keycloak_postgres:
-    image: postgres:12-alpine
+    image: postgres:16-alpine
     environment:
       - POSTGRES_USER=${KC_DB_USERNAME}
       - POSTGRES_PASSWORD=${KC_DB_PASSWORD}
@@ -40,7 +40,7 @@ services:
       - redisdata:/data
 
   smtp:
-    image: rnwood/smtp4dev:3.3.4-ci20240323113
+    image: rnwood/smtp4dev:latest
     volumes:
       - smtpdata:/smtp4dev
     ports:
diff --git a/docker-compose.yml b/docker-compose.yml
index 3d49daf10..e86da79dc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,7 +32,7 @@ services:
         condition: service_started
 
   keycloak_postgres:
-    image: postgres:12-alpine
+    image: postgres:16-alpine
     environment:
       - POSTGRES_USER=${KC_DB_USERNAME}
       - POSTGRES_PASSWORD=${KC_DB_PASSWORD}
@@ -47,7 +47,7 @@ services:
       - redisdata:/data
 
   smtp:
-    image: rnwood/smtp4dev:3.3.4-ci20240323113
+    image: rnwood/smtp4dev:latest
     volumes:
       - smtpdata:/smtp4dev
     ports:
diff --git a/pom.xml b/pom.xml
index c29a256c3..1d53fbc07 100644
--- a/pom.xml
+++ b/pom.xml
@@ -9,7 +9,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <java.version>17</java.version>
+    <java.version>21</java.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
     <maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
diff --git a/src/test/java/openfoodfacts/github/keycloak/events/Utils.java b/src/test/java/openfoodfacts/github/keycloak/events/Utils.java
index 338d12b76..8f816daef 100644
--- a/src/test/java/openfoodfacts/github/keycloak/events/Utils.java
+++ b/src/test/java/openfoodfacts/github/keycloak/events/Utils.java
@@ -35,6 +35,7 @@
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RealmProvider;
+import org.keycloak.models.RequiredActionConfigModel;
 import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
@@ -1555,6 +1556,44 @@ public void setMaxTemporaryLockouts(final int arg0) {
                         throw new UnsupportedOperationException("Unimplemented method 'setMaxTemporaryLockouts'");
                     }
 
+                    @Override
+                    public boolean isOrganizationsEnabled() {
+                        throw new UnsupportedOperationException("Unimplemented method 'isOrganizationsEnabled'");
+                    }
+
+                    @Override
+                    public void setOrganizationsEnabled(boolean organizationsEnabled) {
+                        throw new UnsupportedOperationException("Unimplemented method 'setOrganizationsEnabled'");
+                    }
+
+                    @Override
+                    public RequiredActionConfigModel getRequiredActionConfigById(String id) {
+                        throw new UnsupportedOperationException("Unimplemented method 'getRequiredActionConfigById'");
+                    }
+
+                    @Override
+                    public RequiredActionConfigModel getRequiredActionConfigByAlias(String alias) {
+                        throw new UnsupportedOperationException(
+                                "Unimplemented method 'getRequiredActionConfigByAlias'");
+                    }
+
+                    @Override
+                    public void removeRequiredActionProviderConfig(RequiredActionConfigModel model) {
+                        throw new UnsupportedOperationException(
+                                "Unimplemented method 'removeRequiredActionProviderConfig'");
+                    }
+
+                    @Override
+                    public void updateRequiredActionConfig(RequiredActionConfigModel model) {
+                        throw new UnsupportedOperationException("Unimplemented method 'updateRequiredActionConfig'");
+                    }
+
+                    @Override
+                    public Stream<RequiredActionConfigModel> getRequiredActionConfigsStream() {
+                        throw new UnsupportedOperationException(
+                                "Unimplemented method 'getRequiredActionConfigsStream'");
+                    }
+
                 };
 
                 return new RealmProvider() {
@@ -2124,6 +2163,11 @@ public ClientPolicyManager clientPolicy() {
                 throw new UnsupportedOperationException("Unimplemented method 'clientPolicy'");
             }
 
+            @Override
+            public boolean isClosed() {
+                throw new UnsupportedOperationException("Unimplemented method 'isClosed'");
+            }
+
         };
     }
 
diff --git a/theme/base/email/messages/messages_ca.properties b/theme/base/email/messages/messages_ca.properties
index 99ee8a29b..ddf9c3bf4 100644
--- a/theme/base/email/messages/messages_ca.properties
+++ b/theme/base/email/messages/messages_ca.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Genera codis de recuperació
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be ''{0,choice,0#minut|1#minuta|2#minuty|2<minut}''
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#segons|1#segon|1<segons}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minuts|1#minut|1<minuts}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#hores|1#hora|1<hores}
diff --git a/theme/base/email/messages/messages_cs.properties b/theme/base/email/messages/messages_cs.properties
index 81ed905b4..c2776830b 100644
--- a/theme/base/email/messages/messages_cs.properties
+++ b/theme/base/email/messages/messages_cs.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generování kódů pro obnovu
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#sekund|1#sekunda|2#sekundy|4<sekund}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minut|1#minuta|2#minuty|4<minut}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#hodin|1#hodina|2#hodiny|4<hodin}
diff --git a/theme/base/email/messages/messages_en.properties b/theme/base/email/messages/messages_en.properties
index bd7a1935d..a477cf3b3 100644
--- a/theme/base/email/messages/messages_en.properties
+++ b/theme/base/email/messages/messages_en.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generate Recovery Codes
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#seconds|1#second|1<seconds}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minutes|1#minute|1<minutes}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#hours|1#hour|1<hours}
diff --git a/theme/base/email/messages/messages_es.properties b/theme/base/email/messages/messages_es.properties
index f41b033a6..e418ce372 100644
--- a/theme/base/email/messages/messages_es.properties
+++ b/theme/base/email/messages/messages_es.properties
@@ -39,8 +39,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generar códigos de recuperación
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#segundos|1#segundo|1<segundos}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minutos|1#minuto|1<minutos}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#horas|1#hora|1<horas}
diff --git a/theme/base/email/messages/messages_hu.properties b/theme/base/email/messages/messages_hu.properties
index 00bc29a1b..2b265be4d 100644
--- a/theme/base/email/messages/messages_hu.properties
+++ b/theme/base/email/messages/messages_hu.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Biztonsági kódok generálása
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds=másodperc
 linkExpirationFormatter.timePeriodUnit.minutes=perc
 linkExpirationFormatter.timePeriodUnit.hours=óra
diff --git a/theme/base/email/messages/messages_sk.properties b/theme/base/email/messages/messages_sk.properties
index e35cb07bb..8b7612a12 100644
--- a/theme/base/email/messages/messages_sk.properties
+++ b/theme/base/email/messages/messages_sk.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generovanie kódov obnovy
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#sekúnd|1#sekunda|2#sekundy|4<sekúnd}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minút|1#minúta|2#minúty|4<minút}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#hodín|1#hodina|2#hodiny|4<hodín}
diff --git a/theme/base/email/messages/messages_th.properties b/theme/base/email/messages/messages_th.properties
index dc3d181f3..e501afd05 100644
--- a/theme/base/email/messages/messages_th.properties
+++ b/theme/base/email/messages/messages_th.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=สร้างรหัสกา
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#วินาที|1#วินาที|1<วินาที}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#นาที|1#นาที|1<นาที}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#ชั่วโมง|1#ชั่วโมง|1<ชั่วโมง}
diff --git a/theme/base/email/messages/messages_uk.properties b/theme/base/email/messages/messages_uk.properties
index f5487ac78..c00f4846c 100644
--- a/theme/base/email/messages/messages_uk.properties
+++ b/theme/base/email/messages/messages_uk.properties
@@ -38,8 +38,8 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Генерувати коди ві
 
 # units for link expiration timeout formatting
 # for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
-# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#секунд|1#секунди|1<секунд}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#хвилин|1#хвилини|1<хвилин}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#годин|1#години|1<годин}