authentik 2022.1.5 → 2026.5.0
149 releases · 93 breaking changes · 115 security fixes · 34 advisories fixed
115security93breaking11deprecated434feature512fix
Vulnerabilities fixed by this upgrade
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- medium CVE-2026-41577 SAML source does not validate Conditions, timing, or audience on assertions
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- 9.1 CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- 8.6 CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
- 8.8 CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
- 5.8 CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
- 4.8 CVE-2025-64521 Deactivated service account can authenticate to OAuth
- 7.1 CVE-2025-53942 Insufficient check for account active status when authenticating with OAuth/SAML Sources
- 6.5 CVE-2025-52553 Insufficient Session verification for Remote Access Control endpoint access
- 8.0 CVE-2025-29928 Deletion of sessions did not revoke sessions when using database session storage
- 6.4 CVE-2024-52287 Insufficient validation of OAuth scopes for client_credentials and device_code grants
- 7.9 CVE-2024-52289 Insecure default configuration for OAuth2 Redirect URIs
- 6.3 CVE-2024-52307 Timing attack due to a lack of constant time comparison for metrics view
- 9.0 CVE-2024-47070 Password authentication bypass via X-Forwarded-For HTTP header
- high CVE-2024-47077 Insufficient cross-provider token validation during introspection
- 7.5 CVE-2024-42490 Insufficient Authorization for several API endpoints
- 8.6 CVE-2024-38371 Insufficient access control for OAuth2 Device Code flow
- 8.8 CVE-2024-37905 Improper Authorization for Token modification
- 6.5 CVE-2024-23647 PKCE downgrade attack in authentik
- 7.6 CVE-2024-21637 XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
- high CVE-2023-48228 OAuth2: Insufficient PKCE check
- 9.6 CVE-2023-46249 Potential Installation takeover when default admin user is deleted
- 5.3 CVE-2023-39522 Username enumeration attack
- 8.3 CVE-2023-36456 Lack of Proxy IP headers validation
- 9.1 CVE-2023-26481 Insufficient user check in FlowTokens by Email stage
- 9.6 CVE-2022-23555 Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow
- 6.4 CVE-2022-46172 Existing Authenticated Users can Create Arbitrary Accounts
- high CVE-2022-46145 Unauthorized user creation and potential account takeover
Breaking changes
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.5) in 2026.5.0
- breaking website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) in 2026.5.0
- breaking flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) in 2026.5.0
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
- breaking website/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2) in 2026.2.2
- breaking endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) in 2026.2.2
- breaking providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) in 2026.2.2
- breaking events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) in 2026.2.2
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2) in 2026.2.1
- breaking core: remove superuser check from Token list in 2026.2.0
- breaking website/docs: 2025.12: remove superfluous changes in 2026.2.0
- breaking stages: remove more global state in 2026.2.0
- breaking website/docs: remove duplicates in slo docs in 2026.2.0
- breaking website/docs: remove "beta" tag from 2025.12 in 2026.2.0
- breaking core: remove session migration in 2026.2.0
- breaking web/elements: remove pfbase everywhere in 2026.2.0
- breaking website/docs: Remove stale 2024 version directives in 2026.2.0
- breaking website/docs: remove redundant RC notice in 2026.2.0
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) in 2025.12.5
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12) in 2025.12.3
- breaking website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) in 2025.12.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) in 2025.10.4
- breaking website/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10) in 2025.10.2
- breaking cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) in 2025.10.2
- breaking outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) in 2025.10.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8) in 2025.8.6
- breaking policies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500) in 2025.8.2
- breaking website/docs: remove base providers redirect. (cherry-pick #16576) in 2025.8.2
- breaking tasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504) in 2025.8.2
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.6.2
- breaking website/docs: clarify 2025.4 breaking Reputation changes in 2025.6.0
- breaking website/docs: remove support badge in 2025.6.0
- breaking core: remove OldAuthenticatedSession content type in 2025.6.0
- breaking stages/user_login: remove success message in 2025.6.0
- breaking website/docs: configuration: remove deprecated key for session storage location in 2025.6.0
- breaking website/docs: remove fluff from release notes 2025.6 (cherry-pick #14819) in 2025.6.0
- breaking website/integrations: remove trailing slash from budibase redirect (cherry-pick #14823) in 2025.6.0
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.4.3
- breaking website/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284) in 2025.4.2
- breaking core: remove OldAuthenticatedSession content type (cherry-pick #14507) in 2025.4.1
- breaking website/docs: remove mention of wizard in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs in 2025.4.0
- breaking website/docs: fix missing breaking entry for 2025.2 release notes in 2025.4.0
- breaking website: remove images from integrations index page in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs -- again in 2025.4.0
- breaking stages/authenticator_email: remove flaky assertions in 2025.4.0
- breaking website/docs: backup and restore: remove extra period in 2025.4.0
- breaking website: remove the last updated option from footer in 2025.4.0
- breaking website/docs: dev docs: full: remove note on installing shell plugin in 2025.4.0
- breaking website/docs: Remove enterprise badge from Fleet integration in 2025.4.0
- breaking website integrations: actual budget: remove old header and support_level in 2025.4.0
- breaking website: integrations: apache guacamole: remove redirect URI comments in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs (cherry-pick #13069) in 2025.2.1
- breaking website/docs: remove mention of wizard (cherry-pick #13126) in 2025.2.1
- breaking website/docs: fix missing breaking entry for 2025.2 release notes (cherry-pick #13223) in 2025.2.1
- breaking website: remove RC disclaimer for version 2024.10 (cherry-pick #11871) in 2024.10.1
- breaking website/docs: remove � (cherry-pick #11823) in 2024.10.0
- breaking core: remove html language tag for pages that are translated (cherry-pick #10611) in 2024.6.2
- breaking web/flows: remove continue button from AutoSubmit stage (cherry-pick #10253) in 2024.6.2
- breaking website/docs: remove RC disclaimer from 2024.6 release notes (cherry-pick #10245) in 2024.6.1
- breaking web/flows: remove background image link (cherry-pick #10318) in 2024.6.1
- breaking core: remove transitionary old JS urls (cherry-pick #10317) in 2024.6.1
- breaking website/docs: Remove hyphen in read replica in Release Notes (cherry-pick #10178) in 2024.6.0
- breaking website/docs: remove outdated info in 2024.4.0
- breaking website/docs: remove tenants docs from sidebar for now in 2024.4.0
- breaking website/docs: 2024.2: update comment about upgrading to mention breaking changes in 2024.4.0
- breaking website/docs: config: remove options moved to tenants in 2024.4.0
- breaking web/admin: remove enterprise preview banner in 2024.4.0
- breaking website/docs: config: remove options moved to tenants (cherry-pick #8976) in 2024.2.3
- breaking website/docs: add warning about Helm breaking change in 2024.x in 2023.10.2
- breaking website/docs: add missing breaking change due to APPEND_SLASH in 2023.10.2
- breaking flows: remove need for post() wrapper by using dispatch in 2023.10.0
- breaking core: remove celery's duplicate max_tasks_per_child in 2023.10.0
- breaking web: remove ./element⇢./user references in 2023.10.0
- breaking root: remove outdated sponsorship section on readme in 2023.10.0
- breaking providers/scim: remove preview in 2023.10.0
- breaking website: remove enterprise waitlist in 2023.8.1
- breaking website: fix newsletter signup breaking mobile layout in 2023.6.0
- breaking website/integrations: remove placeholders from AWS setup in 2023.6.0
- breaking stages/authenticator_webauthn: remove credential_id size limit in 2023.5.0
- breaking web: remove more until in 2023.5.0
- breaking website/blog: removed strikethrough text and formatted feature list in 2023.5.0
- breaking providers/ldap: remove deprecated fields in 2023.5.0
- breaking web/admin: remove grouping in 2023.5.0
- breaking web/admin: remove redundant markdown notice in 2023.5.0
- breaking stages/authenticator_webauthn: remove credential_id size limit in 2023.4.0
- breaking web: remove more until in 2023.4.0
- breaking website/blog: removed strikethrough text and formatted feature list in 2023.4.0
- breaking stages/authenticator_webauthn: remove credential_id size limit in 2023.3.1
- breaking web/admin: remove groups and users from users and group form to prevent accidental removal when updating in 2023.2.1
- breaking polices/hibp: remove deprecated in 2023.1.0
Security changes
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) in 2026.5.0
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
- security security: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2) in 2026.2.2
- security security: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2) in 2026.2.2
- security core: Update supported versions in SECURITY.md in 2026.2.0
- security security: CVE-2026-25922 (2026.2) in 2026.2.0
- security security: CVE-2026-25748 (2026.2) in 2026.2.0
- security security: CVE-2026-25227 (2026.2) in 2026.2.0
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) in 2025.12.6
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 in 2025.12.6
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 in 2025.12.5
- security security: CVE-2026-25922 (2025.12) in 2025.12.4
- security security: CVE-2026-25748 (2025.12) in 2025.12.4
- security security: CVE-2026-25227 (2025.12) in 2025.12.4
- security core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) in 2025.12.2
- security security: CVE-2026-25922 (2025.10) in 2025.10.4
- security security: CVE-2026-25748 (2025.10) in 2025.10.4
- security security: CVE-2026-25227 (2025.10) in 2025.10.4
- security security: CVE-2026-25922 (2025.8) in 2025.8.6
- security security: CVE-2026-25748 (2025.8) in 2025.8.6
- security security: CVE-2026-25227 (2025.8) in 2025.8.6
- security root: update security.md with github reporting link (cherry-pick #16332) in 2025.8.2
- security root: fix security.md (cherry-pick #16345) in 2025.8.2
- security security: Bump supported versions (cherry-pick #16261) in 2025.8.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.6.4
- security security: fix CVE-2025-52553 (cherry-pick #15289) in 2025.6.3
- security website/integrations: add push security in 2025.6.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.4.4
- security Fixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access in 2025.4.3
- security security: fix CVE-2025-29928 in 2025.4.0
- security security: fix CVE-2025-29928 (cherry-pick #13695) in 2025.2.3
- security security: fix CVE-2025-29928 (cherry-pick #13695) in 2024.12.4
- security Fixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants in 2024.10.3
- security Fixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view in 2024.10.3
- security Note that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches in 2024.10.3
- security security: fix CVE 2024 52287 (cherry-pick #12114) in 2024.10.3
- security Fixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants in 2024.8.5
- security Fixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view in 2024.8.5
- security Note that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches in 2024.8.5
- security security: fix CVE-2024-47077 (cherry-pick #11535) in 2024.8.3
- security security: fix CVE-2024-47070 (cherry-pick #11536) in 2024.8.3
- security security: fix CVE-2024-47077 (cherry-pick #11535) in 2024.6.5
- security security: fix CVE-2024-47070 (cherry-pick #11536) in 2024.6.5
- security security: fix CVE-2024-42490 (cherry-pick #11022) in 2024.6.4
- security security: update supported versions (cherry-pick #10247) in 2024.6.1
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.6.0
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.6.0
- security security: fix CVE-2024-42490 (cherry-pick #11022) in 2024.4.4
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.4.3
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.4.3
- security Fixes CVE-2024-37905: Improper Authorization for Token modification in 2024.4.2
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.2.4
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.2.4
- security security: fix CVE-2024-23647 (cherry-pick #8345) in 2023.10.7
- security providers/oauth2: fix CVE-2024-21637 (cherry-pick #8104) in 2023.10.6
- security security: fix CVE-2023-48228 (cherry-pick #7666) in 2023.10.4
- security security: fix oobe-flow reuse when akadmin is deleted in 2023.10.2
- security security: fix CVE-2024-23647 (cherry-pick #8345) in 2023.8.7
- security providers/oauth2: fix CVE-2024-21637 (cherry-pick #8104) in 2023.8.6
- security security: fix CVE-2023-48228 (cherry-pick #7666) in 2023.8.5
- security root: Update security policy in 2023.8.0
- security root: set csrf cookie's secure flag same as session in 2023.8.0
- security website/blog: blog about tightrope of security and convenience in 2023.8.0
- security security: fix CVE-2023-39522 in 2023.8.0
- security website/blog: blog draft for Demystifying Security in 2023.6.0
- security security: cure53 fix in 2023.6.0
- security security: fix CVE-2023-36456 in 2023.6.0
- security Fixes CVE-2023-36456: Lack of Proxy IP headers validation in 2023.5.4
- security security: fix CVE-2023-26481 in 2023.5.0
- security outposts: set k8s deployment security context in 2023.5.0
- security Fixes CVE-2023-36456: Lack of Proxy IP headers validation in 2023.4.2
- security security: fix CVE-2023-26481 in 2023.4.0
- security outposts: set k8s deployment security context in 2023.4.0
- security security: fix CVE-2023-26481 in 2023.3.0
- security Fixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage in 2023.2.3
- security Fixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage in 2023.1.3
- security Fixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage in 2022.12.2
- security security: fix CVE 2022 46145 in 2022.12.0
- security security: fix CVE 2022 46172 in 2022.12.0
- security security: fix CVE 2022 23555 in 2022.12.0
- security Fixes CVE-2022-23555: Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow in 2022.11.3
- security Fixes CVE-2022-46172: Existing Authenticated Users can Create Arbitrary Accounts in 2022.11.3
- security Fixes CVE-2022-46145: Unauthorized user creation and potential account takeover in 2022.11.2
- security Fixes CVE-2022-23555: Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow in 2022.10.3
- security Fixes CVE-2022-46172: Existing Authenticated Users can Create Arbitrary Accounts in 2022.10.3
- security Fixes CVE-2022-46145: Unauthorized user creation and potential account takeover in 2022.10.2
Deprecations
- deprecated website/docs: deprecate GCDT auth stage in 2026.2.0
- deprecated web/startup: deprecated theme names break theming in 2026.2.0
- deprecated core: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2) in 2026.2.0
- deprecated web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) in 2025.12.1
- deprecated website/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12) in 2025.12.0
- deprecated internal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10) in 2025.10.1
- deprecated website/integrations: minio: notice about sso deprecation on CE in 2025.6.0
- deprecated website/docs: in developer docs replace deprecated poetry shell command in 2025.4.0
- deprecated core: bump deprecated from 1.2.14 to v1.2.18 in 2025.4.0
- deprecated website: integrations: apache guacamole: Fix deprecated start-of-doc … in 2025.4.0
- deprecated web: replace deprecated terser rollup plugin, remove unused plugin in 2023.8.0
Every release in between
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
featurewebsite/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
featureenterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5)
fixwebsite/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5)
otherwebsite/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
fixwebsite/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5)
featurewebsite/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5)
otherwebsite/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5)
featureproviders/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5)
breakingflows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5)
featurewebsite: Docs and README new screenshots (cherry-pick #22341 to version-2026.5)
otherweb, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5)
otherweb/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5)
otherwebsite/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5)
otherproviders/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5)
featurewebsite/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5)
featurewebsite/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5)
fixroot: fix gitignore binary paths (cherry-pick #22445 to version-2026.5)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5)
otherwebsite/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5)
featurewebsite/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5)
otherproviders/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5)
fixevents: fix certificate typo (cherry-pick #22542 to version-2026.5)
otherwebsite/release: Release notes updates (cherry-pick #22543 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)
otherci: fix reason change in versions repo bump (cherry-pick #20696 to version-2026.2)
otherweb/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2)
otherweb/flows: continuous login (cherry-pick #19862 to version-2026.2)
othercore: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2026.2)
otherlifecycle: make gunicorn --max-requests configurable (cherry-pick #20736 to version-2026.2)
otherpackages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2)
breakingwebsite/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2)
otherwebsite: override DocSearch button colors in light mode (cherry-pick #20770 to version-2026.2)
fixproviders/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2)
otherproviders/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2)
otherweb/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2)
breakingendpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2)
otherwebsite/docs: update agent docs (cherry-pick #20782 to version-2026.2)
breakingproviders/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2)
featurelifecycle/migrate: add flag to skip migrations (cherry-pick #20863 to version-2026.2)
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2)
fixwebsite/docs: fix notification transport etc (cherry-pick #20982 to version-2026.2)
fixwebsite/docs: fix swapped sidebar label (cherry-pick #21011 to version-2026.2)
fixsources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2)
featureenterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2)
breakingevents: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2)
featurewebsite/docs: add missing dependencies for linux dev environment (cherry-pick #21020 to version-2026.2)
featureproviders/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2)
fixendpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2)
featureweb/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2)
featuresources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2)
featurewebsite/docs: ad source: add note about ldap signing (cherry-pick #21274 to version-2026.2)
fixcore: fix provider not nullable (cherry-pick #21275 to version-2026.2)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2026.2)
featurewebsite/docs: entra scim: add note about validator (cherry-pick #21273 to version-2026.2)
securitysecurity: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2026.2)
fixinternal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2)
fixwebsite/docs: fix merge conflict
securitysecurity: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2)
featuretasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2)
+24 more items in the release notesotherwebsite/docs: update supported versions (cherry-pick #20534 to version-2026.2)
fixwebsite/docs: fix upgrade link in 2026.2 release notes (cherry-pick #20539 to version-2026.2)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2)
otherwebsite/docs: revamp enterprise section (cherry-pick #20379 to version-2026.2)
otherdocs: fix typos and wording in docs and integrations (cherry-pick #20550 to version-2026.2)
otherci: add reason change to versions repo bump (cherry-pick #20562 to version-2026.2)
otherinternal: make http timeouts configurable (cherry-pick #20472 to version-2026.2)
otherpackages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2)
fixweb/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2)
fixcrypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2)
featuresources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2)
fixpackages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2)
fixenterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2)
featurewebsite/docs: entra id provider: add custom email domain info (cherry-pick #20444 to version-2026.2)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2026.2)
fixcore: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2)
otherpackages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2)
otheroutpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2)
featurewebsite/docs: add 2025 pentest (cherry-pick #20626 to version-2026.2)
fixweb: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2)
otherproviders/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.1 (cherry-pick #20659 to version-2026.2)
featureroot: Add macOS support for sed in Makefile
featurewebsite/docs: add icon info to style guide
breakingcore: remove superuser check from Token list
featureadmin/files: revert add check for /media existence (#18636)
featurewebsite/docs: add jellyseer integration doc
featurecore: add skip s3_test_server_available to TestResolveFileUrlS3Backend
featurewebsite/docs: Add docs for passkey autofill (WebauthN Conditional UI)
featureweb: add custom message with links for empty data export list
featureweb/admin: endpoint: change wording and add helper text
featurewebsite/docs: added list of Int Guide contributors (also edited frontmatter)
breakingwebsite/docs: 2025.12: remove superfluous changes
featureweb/admin: add UI copy to RBAC modal
breakingstages: remove more global state
featurewebsite/integrations: Add launch URL for Immich
featurewebsite/docs: release notes: add endpoint device links to 2025.12 notes
featurewebsite/docs: add note to active directory source doc
featureblueprints: add InternallyManagedMixin instead of large list
featureenterprise/search: add static autocomplete structure
featurewebsite/integrations: Add Wallos
featuretests/e2e: add endpoint tests
featurewebsite/docs: rel notes .12: add wallos
featurewebsite/docs: endpoint devices: add path to macos setup
featurewebsite/integrations: Add Pulse
featurewebsite/integrations: Add Audiobookshelf
featurewebsite/docs: release notes: Add more integrations
featurewebsite/integrations: vaultwarden: add custom email scope
featureweb/admin: adjust sync threshold, add tooltip
breakingwebsite/docs: remove duplicates in slo docs
deprecatedwebsite/docs: deprecate GCDT auth stage
securitycore: Update supported versions in SECURITY.md
breakingwebsite/docs: remove "beta" tag from 2025.12
breakingcore: remove session migration
deprecatedweb/startup: deprecated theme names break theming
breakingweb/elements: remove pfbase everywhere
breakingwebsite/docs: Remove stale 2024 version directives
breakingwebsite/docs: remove redundant RC notice
securitysecurity: CVE-2026-25922 (2026.2)
securitysecurity: CVE-2026-25748 (2026.2)
securitysecurity: CVE-2026-25227 (2026.2)
deprecatedcore: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2)
+722 more items in the release notessecuritywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12)
otherci: fix docs not having correct js version setup (2025.12)
fixtenants: fix test teardown (version-2025.12)
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12
otherwebsite/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12)
otherwebsite/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12)
otherwebsite/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12)
otherci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12)
featurewebsite/docs: add okta source doc (cherry-pick #20296 to version-2025.12)
otherroot: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12)
otherci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12)
otherwebsite/docs: Custom CSS (cherry-pick #19991 to version-2025.12)
fixweb: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12)
othersources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12)
fixwebsite/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12)
otherci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12)
otherwebsite/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12)
fixwebsite/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12)
featureenterprise: add ES384 to enterprise license algorithms (cherry-pick #20507 to version-2025.12)
fixendpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12)
fixwebsite/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12)
fixpolicies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12)
fixweb/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12)
featureweb/flows: add continuous flow 2025.12
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12)
fixweb: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12)
fixinternal: fix lint (cherry-pick #22263 to version-2025.12)
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12
+23 more items in the release notesfeaturewebsite/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12)
fixweb/admin: fix default binding order (cherry-pick #19943 to version-2025.12)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.12)
othercore: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12)
fixoutposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12)
fixwebsite/docs: fix typos (cherry-pick #20000 to version-2025.12)
otherwebsite/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12)
otherwebsite/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12)
fixwebsite/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12)
otherwebsite: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12)
otherwebsite/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12)
otheroutpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)
otherwebsite/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12)
otherwebsite/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12)
fixsources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12)
otherwebsite/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12)
securitysecurity: CVE-2026-25922 (2025.12)
securitysecurity: CVE-2026-25748 (2025.12)
securitysecurity: CVE-2026-25227 (2025.12)
otherweb: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12)
feature2025.12: Revert bulk revoke added by accident in release branch
fixweb/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12)
fixweb: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12)
otherci: always generate API clients (#19906)
otherlifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12)
featurelifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12)
otherwebsite/docs: Update location of media storage and outdated references (cherry-pick #19885 to version-2025.12)
fixcore: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12)
otherwebsite/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12)
featuresources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12)
featuretests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12)
otherwebsite/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12)
fixadmin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12)
fixadmin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12)
securitycore: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12)
featurewebsite/docs: add s3 perms (cherry-pick #19579 to version-2025.12)
otherweb: update @goauthentik/api (cherry-pick #19542 to version-2025.12)
fixweb/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12)
fixendpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12)
fixpolicies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12)
fixproviders/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12)
featureproviders/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12)
fixsources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12)
othertests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12)
otherlib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12)
otherwebsite/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12)
fixweb/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12)
fixweb/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12)
otherwebsite/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12)
otherwebsite/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.12)
fixweb/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12)
fixweb/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12)
featuresources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12)
fixwebsite/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12)
fixwebsite/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12)
fixproviders/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12)
fixsources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12)
featurewebsite/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12)
featurewebsite/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12)
featureadmin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12)
fixweb/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12)
fixweb/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12)
featurewebsite/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12)
+14 more items in the release notesbreakingwebsite/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12)
fixoutposts/ldap: fix build
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.12)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.12)
deprecatedweb/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12)
otherci: fix checkout stable (for 2025.12) (#19448)
featureproviders/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12)
othercore: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12)
otherendpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12)
featureendpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12)
otherweb: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12)
fixweb/admin: fix switches (cherry-pick #19493 to version-2025.12)
otherendpoints: include license status in agent config (cherry-pick #19227 to version-2025.12)
otherwebsite/docs: revisit endpoint docs the nth (cherry-pick #19116 to version-2025.12)
otherwebsite/glossary: improve (cherry-pick #18969 to version-2025.12)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.12)
otherstages/authenticator_static: set max token length to 100 chars (cherry-pick #19162 to version-2025.12)
fixwebsite: Fix typos. (cherry-pick #19243 to version-2025.12)
otherstages/prompt: optimize API endpoints (cherry-pick #19251 to version-2025.12)
otherstages/password: replace session-based retries with reputation (cherry-pick #18643 to version-2025.12)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.12)
othercore: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #19287 to version-2025.12)
othercore: bump django from v5.2.9 to 5.2.10 (cherry-pick #19290 to version-2025.12)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.12)
deprecatedwebsite/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.12)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.12)
featurewebsite/docs: add flow import warnings (cherry-pick #19307 to version-2025.12)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.12)
fixweb: Fix flow inspector advancement event. (cherry-pick #19309 to version-2025.12)
otherwebsite/docs: update github social login script example (cherry-pick #19246 to version-2025.12)
otherwebsite/docs: update unique email policy (cherry-pick #19305 to version-2025.12)
otherweb: Images styles, theming (cherry-pick #19233 to version-2025.12)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.12)
otherpackages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #19340 to version-2025.12)
otherweb/admin: always retrieve selected provider when editing the application (cherry-pick #19341 to version-2025.12)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.12)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.12)
otherwebsite/docs: update location for logs on windows (cherry-pick #19371 to version-2025.12)
otherinternal/outpost: improve PostgreSQL connection options parsing (cherry-pick #19118 to version-2025.12)
otherweb: Flow info, localization, back button. (cherry-pick #19234 to version-2025.12)
otherstages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #19378 to version-2025.12)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.12)
otherweb: UI Locale Fixes (cherry-pick #19235 to version-2025.12)
fixweb/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10)
featurewebsite/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10)
otherwebsite/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10)
fixweb/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10)
fixweb/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10)
othercore: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10)
otherinternal: update TLS Suite (cherry-pick #19076 to version-2025.10)
fixwebsite/docs: fix build (cherry-pick #19148 to version-2025.10)
fixweb: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.10)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.10)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.10)
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.10)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10)
othercore: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.10)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10)
othercore: bump django from v5.2.8 to 5.2.11 (version-2025.10)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10)
securitysecurity: CVE-2026-25922 (2025.10)
securitysecurity: CVE-2026-25748 (2025.10)
securitysecurity: CVE-2026-25227 (2025.10)
+4 more items in the release notesfixwebsite/docs: fix broken link in source switching doc (cherry-pick #18317 to version-2025.10)
otherwebsite/docs: further improvments to source switch doc (cherry-pick #18320 to version-2025.10)
otherwebsite/docs: enhance blueprint docs (cherry-pick #15984 to version-2025.10)
featurewebsite/docs: added missed edits on Blueprints docs (cherry-pick #18321 to version-2025.10)
featurewebsite/docs: add high availability doc (cherry-pick #18182 to version-2025.10)
otherwebsite/docs: update info about docker socket mount (cherry-pick #18344 to version-2025.10)
otheroutposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10)
featureweb/admin: add entitlement search (cherry-pick #18291 to version-2025.10)
otherlib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10)
fixweb/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10)
fixweb: Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherweb: revert Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherstages/prompt: set allow_blank for _read_only fields (cherry-pick #18297 to version-2025.10)
fixpackages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10)
otherwebsite/docs: improve creds recovery docs (cherry-pick #18385 to version-2025.10)
fixweb/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10)
otherwebsite/docs: update certificate doc (cherry-pick #18295 to version-2025.10)
otherproviders/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10)
fixweb/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10)
fixwebsite/docs: expressions: fix markdown (cherry-pick #18613 to version-2025.10)
featurewebsite/docs: adds note about ak_create_jwt function (cherry-pick #18614 to version-2025.10)
otherflows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10)
fixroot: fix missing authentik_device cookie causing error (cherry-pick #18642 to version-2025.10)
fixenterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10)
fixweb: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10)
fixweb/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10)
othersources/ldap: make server info optional (cherry-pick #18648 to version-2025.10)
fixwebsite/docs: install-config: fix dump_config command (cherry-pick #18659 to version-2025.10)
otherroot: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10)
otherweb: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10)
otherweb: Improved table selection behavior (cherry-pick #18622 to version-2025.10)
featurewebsite/docs: background tasks: add more detail about "next run" (cherry-pick #18660 to version-2025.10)
otheroutpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10)
othercore: optimize list applications (cherry-pick #18330 to version-2025.10)
othercore: list applications fix (cherry-pick #18798 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10)
featurewebsite/docs: add icon info to style guide (cherry-pick #18832 to version-2025.10)
otherwebsite/docs: 2025.10.3 release notes (cherry-pick #18868 to version-2025.10)
featurebrands: add more matching tests (cherry-pick #16185 to version-2025.10)
otherbrands: sort matched brand by match length (cherry-pick #17920 to version-2025.10)
fixtasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10)
featurewebsite/docs: added Note about email_verified scope mapping is set to false by default (cherry-pick #17942 to version-2025.10)
breakingwebsite/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10)
othercore: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10)
otherwebsite/docs: updates img-src csp (cherry-pick #18010 to version-2025.10)
otherci: fix migrate-from-stable for old versions (#18019)
fixwebsite/release notes: fix broken urls (cherry-pick #18041 to version-2025.10)
otherwebsite/docs: update discord social login script example (cherry-pick #18026 to version-2025.10)
otherci: attempt to fix integration tests using dind (cherry-pick #18066 to version-2025.10)
otherci: revert to upstream GHA for release (#18058)
fixevents: fix timezone not set for log events (cherry-pick #18067 to version-2025.10)
featureproviders/scim: allow custom schema data (cherry-pick #18073 to version-2025.10)
othercore: improve app launch URL formatting (cherry-pick #18076 to version-2025.10)
breakingcmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10)
fixweb: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10)
fixweb: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10)
fixwebsite/docs: fix wording in stages overview (cherry-pick #18061 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10)
otherweb/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10)
otherweb/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10)
fixpackages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10)
otherweb: Disable library on Firefox. (cherry-pick #18103 to version-2025.10)
otherweb/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10)
featurewebsite/docs: Add instructions for installing RC versions (cherry-pick #18099 to version-2025.10)
otherwebsite/docs: update application description (cherry-pick #18125 to version-2025.10)
fixstages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10)
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.10)
fixwebsite/docs: fix placeholder leftover (cherry-pick #17737 to version-2025.10)
featureroot: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10)
fixproviders/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10)
othersources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10)
fixproviders/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10)
otherproviders/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10)
otherpackages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10)
othertasks: delay startup signals (cherry-pick #17769 to version-2025.10)
otherroot: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10)
deprecatedinternal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10)
otherci: rework internal repo (#17797)
fixinternal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10)
fixweb/admin: fix scim provider form (cherry-pick #17831 to version-2025.10)
othercore: bump astral-sh/uv from 0.9.5 to 0.9.6 (cherry-pick #17820 to version-2025.10)
othertasks: sanitize log attributes (cherry-pick #17833 to version-2025.10)
otheroutposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10)
breakingoutpost: revert breaking signals change (cherry-pick #17847 to version-2025.10)
otherinternal: full openssl path (cherry-pick #17856 to version-2025.10)
otherweb: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10)
fixweb/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10)
fixproviders/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10)
otherproviders/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10)
fixproviders/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10)
otherwebsite/docs: 2025.10.1 release notes (cherry-pick #17918 to version-2025.10)
featureenterprise: add prometheus metrics for license usage and expiry (cherry-pick #17606 to version-2025.10)
featurewebsite/docs: rel notes 2025.10: add 3 more integration guides (cherry-pick #17641 to version-2025.10)
otherproviders/proxy: drop headers with underscores (cherry-pick #17650 to version-2025.10)
featurewebsite/docs: add note about invite link not bound (cherry-pick #17657 to version-2025.10)
featurewebsite/docs: eap add info about custom validation (cherry-pick #17642 to version-2025.10)
featurewebsite/docs: release notes: Add Zot integration (cherry-pick #17700 to version-2025.10)
featurewebsite/docs: add short-lived certificate recommendation (cherry-pick #17628 to version-2025.10)
featurewebsite/docs: blueprints: add a bit more info (cherry-pick #17704 to version-2025.10)
otherenterprise: handle cached naive timezone (cherry-pick #17695 to version-2025.10)
otherwebsite/docs: update flow context ref (cherry-pick #17723 to version-2025.10)
otherwebsite/docs: finalise 2025.10 release notes (cherry-pick #17728 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.8)
securitysecurity: CVE-2026-25922 (2025.8)
securitysecurity: CVE-2026-25748 (2025.8)
securitysecurity: CVE-2026-25227 (2025.8)
otherwebsite/docs: developer docs: adjust sentence for writing docs (cherry-pick #17137 to version-2025.8)
otherbuild(deps): bump django from 5.1.12 to 5.1.13 (cherry-pick #17198 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix task expiration (cherry-pick #17178 to version-2025.8)
fixpackages/django-dramatiq-postgres: fix error when updating task with no changes (cherry-pick #16728 to version-2025.8)
othertasks/middlewares/messages: make sure exceptions are always logged (cherry-pick #17237 to version-2025.8)
fixcore: fix absolute and relative path file uploads (cherry-pick #17269 to version-2025.8)
fixweb: Fix behavior for modals configured with closeAfterSuccessfulSubmit (cherry-pick #17277 to version-2025.8)
otherlib/sync/outgoing: revert reduce number of db queries made (revert #14177) (cherry-pick #17306 to version-2025.8)
otherblueprints: ensure tasks retry on database errors (cherry-pick #17333 to version-2025.8)
fixweb/admin: fix incorrect placeholder for scim provider (cherry-pick #17308 to version-2025.8)
featurewebsite/docs: add entra id scim source (cherry-pick #17357 to version-2025.8)
featurewebsite/docs: add email config section (cherry-pick #16727 to version-2025.8)
featurewebsite: add powershell syntax highlighting and bump package (cherry-pick #16683)
otherwebsite/docs: update SAML provider docs (cherry-pick #15887 to version-2025.8)
otherci: rework internal repo (#17797)
otherci: fix migrate-from-stable for old versions
othercore: bump Django from 5.1.13 to 5.1.14 for 2025.8
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.8
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.8)
otherwebiste/docs: improve user ref doc (cherry-pick #16779)
fixproviders/scim: fix string formatting for SCIM user filter (cherry-pick #16465)
fixwebsite/docs: 2025.8: fix worker concurrency setting rename (cherry-pick #16946)
fixwebsite/docs: fix capitalization (cherry-pick #16944)
otherwebsite/docs: random typo fixes (cherry-pick #16956)
featurewebsite/docs: add docs for source switch expression policy (cherry-pick #16878)
otherwebsite/docs: update url to docker-compose.yml (cherry-pick #16901)
otherwebsite/developer docs: What domain for what doc version (cherry-pick #16987)
featureproviders/ldap: add include_children parameter to cached search mode (cherry-pick #16918)
featurewebsite/docs: oauth provider: Add device and introspect to reserved slugs (cherry-pick #16994)
featurewebiste/docs: add missing oauth endpoints (cherry-pick #16995)
otherwebsite/docs: improve discord policies when also bound to non-oauth sources (cherry-pick #17008)
fixrbac: fix typo (cherry-pick #16476)
featurecore: add index on Group.is_superuser (cherry-pick #17011)
otherlib: match exception_to_dict locals behaviour (cherry-pick #17006)
otherwebsite/docs: Update Github expression to handle non-OAuth sources gracefully (cherry-pick #17014)
fixlib/config: fix listen settings (cherry-pick #17005)
other*/bindings: order by pk (cherry-pick #17027)
fixtasks: fix logger name (cherry-pick #17009 to version-2025.8)
fixweb/admin: fix federation sources automatically selected (cherry-pick #17069 to version-2025.8)
otherrbac: optimize rbac assigned by users query (cherry-pick #17015 to version-2025.8)
fixweb: Fix layout class for row in LibraryPage (cherry-pick #16752 to version-2025.8)
othercmd/server/healthcheck: info log success instead of debug (cherry-pick #17093 to version-2025.8)
featureoutposts/ldap: add pwdChangeTime attribute (cherry-pick #17010 to version-2025.8)
fixstages/identification: fix mismatched error messages (cherry-pick #17090 to version-2025.8)
fixproviders/oauth2: fix authentication error with identical app passwords (cherry-pick #17100 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (cherry-pick #17106 to version-2025.8)
othertasks: reduce default number of retries and max backoff (cherry-pick #17107 to version-2025.8)
otherwebsite/docs: 2025.8.4 release notes (cherry-pick #17119 to version-2025.8)
fixwebsite/docs: fix docker tabs not rendering properly (cherry-pick #16799)
fixlifecycle: fix permission error when running worker as root (cherry-pick #16735)
otherwebsite/docs: update create oauth provider page (cherry-pick #16617)
fixstages/email_authenticator: Fix email mfa loop (cherry-pick #16579)
otherwebsite/docs: 2025.8.3 release notes (cherry-pick #16809)
otherwebsite/docs: 2025.8.1 release notes (cherry-pick #16343)
otherproviders/oauth2: avoid deadlock during session migration (cherry-pick #16361)
otherwebsite: cherry-pick 2025.8/client side redirects
securityroot: update security.md with github reporting link (cherry-pick #16332)
fixlifecycle: fix PROMETHEUS_MULTIPROC_DIR missing suffix (cherry-pick #16401)
fixtasks/schedules: fix api search fields (cherry-pick #16405)
featurewebsite/docs: adds details to certificates doc (cherry-pick #16335)
securityroot: fix security.md (cherry-pick #16345)
fixproviders/rac: fix AuthenticatedSession migration (cherry-pick #16400)
otherwebsite/docs: update internal vs external user information (cherry-pick #16359)
fixlib/sync: fix missing f for string (cherry-pick #16423)
otherwebsite/docs: capitalized proper name of stages, removed old version references. (cherry-pick #16414)
othercore: bump h2 from 4.2.0 to 4.3.0 (cherry-pick #16446)
fixlib/sync/outgoing: fix single object sync timeout (cherry-pick #16447)
fixcore: fix client-side only validation allowing admin to set blank user password (cherry-pick #16467)
otherwebsite: Unify Netlify redirects with Docusaurus's client-side router. (backport of #16430)
otherwebsite: Page redirect guide, documentation (backport of #16466)
breakingpolicies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500)
fixwebsite/integrations: bitwarden: fix ent notice (cherry-pick #16502)
otherwebsite/docs: update how to rac and outpost landing page (cherry-pick #16442)
otherwebsite/docs: improve customize your instance page layout (cherry-pick #16367)
otherwebsite/docs: update external user information (cherry-pick #16493)
otherwebsite/docs: changes all -> arrows to > (cherry-pick #16569)
breakingwebsite/docs: remove base providers redirect. (cherry-pick #16576)
featurewebsite: Add text copy of license (cherry-pick #16559)
otherroot: clean up README (cherry-pick #16286)
fixsources/ldap: fix malformed filter error with special characters in group DN (cherry-pick #16243)
othercore: bump django from 5.1.11 to v5.1.12 (cherry-pick #16584)
otherwebsite: Update license text to use "directory" (cherry-pick #16589)
otherweb/flows: only disable login button when interactive captcha is configured and not loaded (cherry-pick #16586)
featureproviders/oauth2: add missing exp claim for logout token (cherry-pick #16593)
otherproviders/scim: improve error message when object fails to sync (cherry-pick #16625)
breakingtasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504)
fixwebsite/docs: fix typo (cherry-pick #16681)
featurewebsite/docs: add rate limiting info to Email stage docs (cherry-pick #16668)
featurewebsite: Redirect Azure to Entra. Add tags for search indexing. (cherry-pick #16474)
featurewebsite/docs: add missing notification rule example doc to sidebar (cherry-pick #16478)
otherwebsite/docs: clarify docker compose install (cherry-pick #16696)
otherwebsite/docs: moves display source notes (cherry-pick #16704)
fixwebsite/docs: fix typos (cherry-pick #16716)
+7 more items in the release notesfix*: Fix dead doc link (cherry-pick #16288)
fixweb: fix "Explore integrations" link in Quick actions (cherry-pick #16274)
fixweb: Fix hidden textarea required attribute. (cherry-pick #16168)
fixproviders/oauth2: fix logout token missing sid, fix wrong sub mode used (cherry-pick #16295)
otherlifecycle: set PROMETHEUS_MULTIPROC_DIR as early as possible (cherry-pick #16298)
fixweb: Fix issue where clicking a list item scrolls container (cherry-pick #16174)
otherweb: Improvements to ReCaptcha resizing (cherry-pick #16171)
fixweb: Fix form group slots (cherry-pick #16276)
otherweb: Username truncation, field alignment. (cherry-pick #16283)
featurewebsite/docs: add link in 2025.8 rel notes to back-channel logout doc (cherry pick #16306)
othercore: use email backend for test_email management command (cherry-pick #16311)
fixpackages/django-dramatiq-postgres: middleware: fix listening on hosts where ipv6 is not supported (cherry-pick #16308)
fixoutposts: fix service connection update task arguments (cherry-pick #16312)
featureoutposts: allow ingress path type configuration (cherry-pick #16339)
otherwebsite: Hotfix version 2025.8/website versioning
fixpackages/django-dramatiq-postgres: broker: fix various timing issues (cherry-pick #16340)
featurewebsite/docs: update Advanced Queries docs and Rel Notes with new Int Guide (cherry-pick #16191)
otherwebsite/docs: sys-mgmt/s3: Clean up and improve (cherry-pick #16242)
securitysecurity: Bump supported versions (cherry-pick #16261)
otherwebsite/docs: update 2025.8 release notes (cherry-pick #16269)
featuretasks: add rel_obj to system task exception event (cherry-pick #16270)
securityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
fixweb/elements: fix table search not resetting page when query changes (cherry-pick #15324)
featurewebsite/docs: re-add gtag (cherry-pick #15334)
fixcore: fix missing serializer on AuthenticatedSession (cherry-pick #15323)
otherwebsite: Mark all URLs as external. (cherry-pick #15363)
fixcore: fix set_token_key permission not declared (cherry-pick #15384)
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
otherwebsite/docs: improve the docs about our Events and logging (cherry-pick #15270)
otherwebsite/docs: Cherry pick events docs (cherry-pick #15457)
otherwebsite/docs: postgres troubleshooting: get PGPASSWORD from POSTGRES_PASSWORD_FILE (cherry-pick #15039)
fixwebsite/docs: troubleshooting: Fix variable for postgres database in k8s (cherry-pick #15503)
fixproviders/proxy: fix ingress-nginx proxy buffer size annotations (cherry-pick #15506)
featurewebsite/docs: add noun for SSO (cherry-pick #15509)
featurewebsite/docs: Add FIDO2 references to the documentation (cherry-pick #14826)
featurewebsite/docs: add use case, move diagram, link to ABM (cherry-pick #15491)
fixwebsite/docs: fix a typo in SSF docs (cherry-pick #15554)
featurewebsite/docs: added enterprise label to new Logging docs (cherry-pick #15556)
fixwebsite/docs: fix user ref typos (cherry-pick #15653)
otherproviders/radius: set message authenticator (cherry-pick #15635)
featurewebsite/docs: add more to style guide (cherry-pick #14797)
otherci: fix post-release e2e builds failing (cherry-pick #15082)
featureweb/elements: Add light mode custom css handling (cherry-pick #14944)
othercore: bump tornado from 6.4.2 to v6.5.1 (cherry-pick #15100)
othercore: bump requests from 2.32.3 to v2.32.4 (cherry-pick #15129)
fixsources/ldap: fix sync on empty groups (cherry-pick #15158)
othercore: bump urllib3 from 2.4.0 to v2.5.0 (cherry-pick #15131)
othercore: bump protobuf from 6.30.2 to v6.31.1 (cherry-pick #14894)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixweb/user: fix infinite loop when no user settings flow is set (cherry-pick #15188)
otherci: fix CodeQL failing on cherry-pick PRs (cherry-pick #15205)
featurewebsite/docs: add credentials prompt for rac doc (cherry-pick #14840)
fixwebsite/docs: fix note at end of rac credentials prompt (cherry-pick #14909)
featurewebsite/docs: Add steps to troubleshoot /initial-setup/ (cherry-pick #15011)
otherweb/elements: typing error when variables are not converted to string (cherry-pick #15169)
othercore: bump goauthentik/fips-python from 3.13.3-slim-bookworm-fips to 3.13.5-slim-bookworm-fips in 2025.6
securitysecurity: fix CVE-2025-52553 (cherry-pick #15289)
featurewebsite/docs: add 2025.6.1 release notes (cherry-pick #14948)
otherstages/email: Only attach logo to email if used (cherry-pick #14835)
fixweb/elements: fix dual select without sortBy (cherry-pick #14977)
fixinternal/outpost: fix incorrect usage of golang SHA API (cherry-pick #14981)
fixbrands: fix custom_css being escaped (cherry-pick #14994)
othercore: bump django from 5.1.9 to 5.1.10 (cherry-pick #14951)
othercore: bump django from 5.1.10 to 5.1.11 (cherry-pick #14997)
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
fixproviders/rac: fixes prompt data not being merged with connection_settings (cherry-pick #15037)
fixweb/elements: fix typo in localeComparator (cherry-pick #15054)
otherwebsite/docs: correct minor version in release notes (cherry-pick #15012)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixcore: fix transaction test case (cherry-pick #15021)
otherwebsite/docs: release notes for 2025.6.2 (cherry-pick #15065)
featurewebsite/releases: order new integrations alphabetically (cherry-pick #14850)
featurewebsite/release notes: add tailscale to new integrations (cherry-pick #14859)
otherwebsite/integrations: tailscale (cherry-pick #14499)
otherwebsite/docs: rotate supported versions: 2025.6 (cherry-pick #14856)
fixweb/user: fix user settings flow not loading (cherry-pick #14911)
featureproviders/proxy: add option to override host header with property mappings (cherry-pick #14927)
fixlifecycle: fix test-all in docker
featurewebsite/integrations: adds missing trailing slash in homarr doc
fixweb: fix bug that was causing charts to be too tall
featurewebsite/docs: add device code flow instructions
featurerbac: add name to Permissions search
featurewebsite/docs: add postgres pool configuration
featurewebsite/docs: add LDAP 'Lookup using user attribute' docs
featurewebsite/docs: add gateway API to release notes and documentation
fixwebsite/docs: initial permissions: fix usage of term admin
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes
fixbrands: fix CSS Migration not updating brands
featurewebsite/docs: adds webfinger doc under oauth provider
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group
fixwebsite/docs: fix dry-run release highlight
breakingwebsite/docs: remove support badge
fixweb: Clean up browser-only module imports that crash WebDriverIO.
featurewebsite/integrations: add atlassian
featurewebsite/docs: Add pkg-config to the brew dependencies
featurewebsite/docs: add one more reference and link about can view Admin interface
featuretests/e2e: Add E2E tests for Flow SFE
breakingcore: remove OldAuthenticatedSession content type
featuretests/e2e: add test for authentication flow in compatibility mode
featureenterprise/stages: Add MTLS stage
securitywebsite/integrations: add push security
deprecatedwebsite/integrations: minio: notice about sso deprecation on CE
featurewebsite/docs: add login page source note to all source docs
featureweb: Add specific Storybook dependency.
featuresources/ldap: add forward deletion option
featurewebsite/integrations: add stripe
featurewebsite/integrations: add filerise
featurewebsite/integrations: add pangolin
featurewebsite/docs: add docs for MTLS Stage
featuresources/ldap: add user_membership_attribute
breakingstages/user_login: remove success message
breakingwebsite/docs: configuration: remove deprecated key for session storage location
featurewebsite/integrations: add komodo
featureproviders/scim: allow for specifying custom SCIM schemas for users and groups
breakingwebsite/docs: remove fluff from release notes 2025.6 (cherry-pick #14819)
breakingwebsite/integrations: remove trailing slash from budibase redirect (cherry-pick #14823)
featurewebsite/docs: add LDAP docs for forward deletion and memberUid (cherry-pick #14814)
+281 more items in the release notessecurityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
securityFixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixlifecycle: fix arguments not being passed to worker command (cherry-pick #14574)
fixsources/scim: fix all users being added to group when no members are given (cherry-pick #14645)
otherci: fix broken cache (cherry-pick #14725)
othercore: Migrate permissions before deleteing OldAuthenticatedSession (cherry-pick #14788)
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284)
fixwebsite/docs: fix dry-run release highlight (cherry-pick #14337)
fixwebsite/docs: fix leftover placeholder in release notes (cherry-pick #14377)
otherwebsite/docs: release notes for 2025.4.1 (cherry-pick #14526)
otherwebsite/docs: release notes for 2025.4.2 (cherry-pick #14868)
featurewebsite/docs: add gateway API to release notes and documentation (cherry-pick #14278)
otherci: cleanup post uv migration (cherry-pick #13538)
fixwebsite/docs: initial permissions: fix usage of term admin (cherry-pick #14300)
fixbrands: fix CSS Migration not updating brands (cherry-pick #14306)
otherwebsite/docs: docs about initial perms (cherry-pick #14263)
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group (cherry-pick #14312)
fixoutposts: fix tmpdir in containers not being set (cherry-pick #14444)
fixlifecycle: fix ak dump_config (cherry-pick #14445)
fixweb/flows/sfe: fix global background image not being loaded (cherry-pick #14442)
othercore: bump h11 from 0.14.0 to v0.16.0 (cherry-pick #14352)
fixcore: fix session migration when old session can't be loaded (cherry-pick #14466)
otherroot: temporarily deactivate database pool option (cherry-pick #14443)
otherroot: backport SFE Build fix
fixenterprise: fix expired license's users being counted (cherry-pick #14451)
breakingcore: remove OldAuthenticatedSession content type (cherry-pick #14507)
fixcore: fix unable to create group if no enable_group_superuser permission is given (cherry-pick #14510)
featurewebsite/docs: add 2025.2 release notes
featuresources/oauth: add group sync for azure_ad
featureroot: allow configuring session cookie age
featurecore: add darkreader-lock
featurewebsite/docs: add new SSF provider docs
featurewebsite/docs: add info about new perms for super-user in groups
breakingwebsite/docs: remove mention of wizard
breakingwebsite/docs: remove Enterprise badge from RAC docs
featurewebsite/docs: add paragraph about impossible travel
breakingwebsite/docs: fix missing breaking entry for 2025.2 release notes
featurewebsite/docs: Add Passkeys reference where WebAuthn is mentioned
breakingwebsite: remove images from integrations index page
featurelifecycle: add warning regarding supported installation methods
featurecore: add pre-hydrated relative URL
featurewebsite/integrations: add plesk
featurewebsite/docs: add enterprise label to SSF docs
breakingwebsite/docs: remove Enterprise badge from RAC docs -- again
featurewebsite/integrations: Add documentation for Drupal
featurewebsite/docs: enterprise: add instructions to cancel license renewal
featurelib/sync/outgoing: add dry run
breakingstages/authenticator_email: remove flaky assertions
featurewebsite/integrations: gravity: add
featureweb/admin: add button to clear application cache
featureweb/admin: allow user lists to show active only
featurewebsite: add a better edit this page element
featurewebsite/integrations: zipline: add
breakingwebsite/docs: backup and restore: remove extra period
deprecatedwebsite/docs: in developer docs replace deprecated poetry shell command
featurewebsite/integrations: add Mautic
featurewebsite/docs: ops/backup-restore: add "pending emails" to lost redis data
featurewebsite: edit the new footer with links
featureproviders/scim: add compatibility mode for AWS & Slack
breakingwebsite: remove the last updated option from footer
breakingwebsite/docs: dev docs: full: remove note on installing shell plugin
securitysecurity: fix CVE-2025-29928
deprecatedcore: bump deprecated from 1.2.14 to v1.2.18
breakingwebsite/docs: Remove enterprise badge from Fleet integration
breakingwebsite integrations: actual budget: remove old header and support_level
deprecatedwebsite: integrations: apache guacamole: Fix deprecated start-of-doc …
breakingwebsite: integrations: apache guacamole: remove redirect URI comments
+538 more items in the release notesfixstages/email: fix for newlines in emails
fixproviders/scim: fix group membership check failing (cherry-pick #13644)
fixRevert "core: fix non-exploitable open redirect (#13696)" (cherry-pick #13824)
fixadmin: fix system API when using bearer token (cherry-pick #13651)
otherstages/email: Clean newline characters in TemplateEmailMessage (cherry-pick #13666)
fixoutposts/ldap: fix paginator going into infinite loop (cherry-pick #13677)
otherweb/admin: reworked sync status card (cherry-pick #13625)
fixcore: fix core/user is_superuser filter (cherry-pick #13693)
fixcore: fix non-exploitable open redirect (cherry-pick #13696)
otherstages/identification: refresh captcha on failure (cherry-pick #13697)
securitysecurity: fix CVE-2025-29928 (cherry-pick #13695)
otherwebsite/docs: prepare for 2025.2.1 (cherry-pick #13277)
fixenterprise/stages/source: fix dispatch method signature (cherry-pick #13321)
fix*: fix stage incorrectly being inserted instead of appended (cherry-pick #13304)
otherwebsite/docs: update the 2025.2 rel notes (cherry-pick #13213)
fixproviders/proxy: kubernetes outpost: fix reconcile when only annotations changed (cherry-pick #13372)
fixwebsite/docs: fix build
otherweb/user: ensure modal container on user-settings page is min-height: 100% (cherry-pick #13402)
fixstages/authenticator_email: Fix Enroll dropdown in the MFA Devices page (cherry-pick #13404)
fixlib/config: fix conn_max_age parsing (cherry-pick #13370)
fixweb/admin: fix display bug for assigned users in application bindings in the wizard (cherry-pick #13435)
othersources/oauth: ignore missing well-known keys (cherry-pick #13468)
fixweb/flows: fix missing padding on authenticator_validate card (cherry-pick #13420)
otherweb/user: show admin interface button on mobile (cherry-pick #13421)
fixproviders/rac: fix signals and Endpoint caching (cherry-pick #13529)
fixsources/oauth: fix duplicate authentication (cherry-pick #13322)
otherstages/identification: check captcha after checking authentication (cherry-pick #13533)
otherwebsite/docs: prepare for 2025.2.2 (cherry-pick #13552)
breakingwebsite/docs: remove Enterprise badge from RAC docs (cherry-pick #13069)
featurewebsite/docs: add new SSF provider docs (cherry-pick #13102)
featurewebsite/docs: add info about new perms for super-user in groups (cherry-pick #13188)
breakingwebsite/docs: remove mention of wizard (cherry-pick #13126)
featurewebsite/docs: add paragraph about impossible travel (cherry-pick #13125)
otherstages/authenticator_email: Email Authenticator Stage Documentation (cherry-pick #12853)
breakingwebsite/docs: fix missing breaking entry for 2025.2 release notes (cherry-pick #13223)
featurecore: add pre-hydrated relative URL (cherry-pick #13243)
fixstages/email: Fix email stage serialization (cherry-pick #13256)
fixstages/authenticator_email: fix session cleanup test b (cherry-pick #13264)
fixweb/flow: fix translate extract (cherry-pick #13208)
fixweb/user: fix display for RAC tile (cherry-pick #13211)
fixRevert "core: fix non-exploitable open redirect (#13696)"
fixcore: fix generic sources not being fetchable by pk
fixflows: fix inspector permission check
securitysecurity: fix CVE-2025-29928 (cherry-pick #13695)
otherenterprise/rac: Improve client connection status & bugfixes (cherry-pick #12684)
otherci: release: fix AWS cfn template permissions (cherry-pick #12576)
fixstages/redirect: fix query parameter when redirecting to flow (cherry-pick #12750)
fixlifecycle: fix cryptography's OpenSSL path (cherry-pick #12753)
otherci: fix missing build args for dev and release (cherry-pick #12760)
featuresources: allow uuid or slug to be used for retrieving a source (2024.12 fix)
fixcore: fix application entitlements not createable with blueprints (cherry-pick #12673)
otherlifecycle: update python to 3.12.8 (cherry-pick #12783)
fixcore: fix permissions for admin device listing (cherry-pick #12787)
otherflows: clear flow state before redirecting to final URL (cherry-pick #12788)
otherrbac: exclude permissions for internal models (cherry-pick #12803)
otherlifecycle: better pre release test (cherry-pick #12806)
otherci: fix test_docker.sh failing due to missing .env (cherry-pick #12873)
otherci: fix test_docker.sh failing due to empty .env (cherry-pick #12876)
otherci: fix test_docker.sh (cherry-pick #12878)
otherci: fix test_docker.sh (cherry-pick #12880)
fixinternal: fix missing trailing slash in outpost websocket (cherry-pick #12470)
othersources/kerberos: authenticate with the user's username instead of the first username in authentik (cherry-pick #12497)
featurerbac: permissions endpoint: allow authenticated users (cherry-pick #12608)
fixcore: fix error when creating new user with default path (cherry-pick #12609)
fixproviders/saml: fix invalid SAML Response when assertion and response are signed (cherry-pick #12611)
featurewebsite/docs: add new section about impersonation (cherry-pick #12328)
featurewebsite/docs: add content about bindings (cherry-pick #11787)
fixinternal: fix URL generation for websocket connection (cherry-pick #12439)
othertranslate: Updates for file web/xliff/en.xlf in zh-Hans (cherry-pick #12401)
othertranslate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (cherry-pick #12400)
othertranslate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (cherry-pick #12399)
othertranslate: Updates for file web/xliff/en.xlf in zh_CN (cherry-pick #12402)
otherevents: notification_cleanup: avoid unnecessary loop (cherry-pick #12417)
otherroot: expose CONN_MAX_AGE, CONN_HEALTH_CHECKS and DISABLE_SERVER_SIDE_CURSORS for PostgreSQL config (cherry-pick #10159)
otherwebsite/docs: prepare for 2024.12.0 (cherry-pick #12420)
fixroot: fix database ssl options not set correctly (cherry-pick #12180)
otherweb: backport fix impersonate api
otherweb/flows: resize captcha iframes (cherry-pick #12260)
fixstages/identification: fix invalid challenge warning when no captcha stage is set (cherry-pick #12312)
otherenterprise/stages/authenticator_endpoint_gdtc: don't set frame options globally (cherry-pick #12311)
otherflows: better test stage's challenge responses (cherry-pick #12316)
fixproviders/proxy: fix redirect_uri (cherry-pick #12121)
fixproviders/oauth2: fix redirect uri input (cherry-pick #12122)
otherweb: bump API Client version (cherry-pick #12129)
fixproviders/oauth2: fix migration dependencies (cherry-pick #12123)
fixproviders/oauth2: fix migration (cherry-pick #12138)
securityFixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants
securityFixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view
securityNote that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches
fixproviders/ldap: fix global search_full_directory permission not being sufficient (cherry-pick #12028)
fixrbac: fix incorrect object_description for object-level permissions (cherry-pick #12029)
fixweb/flows: fix invisible captcha call (cherry-pick #12048)
fixcore: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080)
otherproviders/scim: accept string and int for SCIM IDs (cherry-pick #12093)
fixroot: fix activation of locale not being scoped (cherry-pick #12091)
otherroot: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094)
otherwebsite/docs: group CVEs by year (cherry-pick #12099)
featureinternal: add CSP header to files in /media (cherry-pick #12092)
featurewebsite/docs: add CSP to hardening (cherry-pick #11970)
securitysecurity: fix CVE 2024 52287 (cherry-pick #12114)
fixwebsite/docs: fix slug matching redirect URI causing broken refresh (cherry-pick #11950)
otherstages/password: use recovery flow from brand (cherry-pick #11953)
otherstages/captcha: Run interactive captcha in Frame (cherry-pick #11857)
featureblueprints: add default Password policy (cherry-pick #11793)
fixproviders/proxy: fix Issuer when AUTHENTIK_HOST_BROWSER is set (cherry-pick #11968)
othercrypto: validate that generated certificate's name is unique (cherry-pick #12015)
fixproviders/oauth2: fix manual device code entry (cherry-pick #12017)
othercore: use versioned_script for path only (cherry-pick #12003)
otherwebsite/docs: 2024.10.2 release notes (cherry-pick #12025)
otherwebsite: update supported versions (cherry-pick #11841)
fixproviders/oauth2: fix size limited index for tokens (cherry-pick #11879)
featurecore: add None check to a device's extra_description (cherry-pick #11904)
fixenterprise/rac: fix API Schema for invalidation_flow (cherry-pick #11907)
fixwebsite/docs: fix release notes to say Federation (cherry-pick #11889)
fixwebsite: fix docs redirect (cherry-pick #11873)
featurewebsite/docs: add info about invalidation flow, default flows in general (cherry-pick #11800)
breakingwebsite: remove RC disclaimer for version 2024.10 (cherry-pick #11871)
otherwebsite/docs: 2024.10.1 Release Notes (cherry-pick #11926)
otherwebsite/docs: Update social-logins github (cherry-pick #11822)
breakingwebsite/docs: remove � (cherry-pick #11823)
otherwebsite: 2024.10 Release Notes (cherry-pick #11839)
featuresources/kerberos: add kiprop to ignored system principals (cherry-pick #11852)
fixweb/admin: fix code-based MFA toggle not working in wizard (cherry-pick #11854)
otherroot: bumpversion 2024.10
fixproviders/proxy: fix redirect_uri (cherry-pick #12121)
fixproviders/oauth2: fix redirect uri input (cherry-pick #12122)
otherweb: bump API Client version (cherry-pick #12129)
fixproviders/oauth2: fix migration (cherry-pick #12138)
securityFixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants
securityFixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view
securityNote that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches
otherinternal: restore /ping behaviour for embedded outpost (cherry-pick #11568)
fixcore: fix permission check for scoped impersonation (cherry-pick #11603)
fixblueprints: fix validation error when using internal storage (cherry-pick #11654)
fixproviders/saml: fix incorrect ds:Reference URI (cherry-pick #11699)
otherproviders/oauth2: don't overwrite attributes when updating service acccount (cherry-pick #11709)
fixweb/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728)
fixpolicies/event_matcher: fix inconsistent behaviour (cherry-pick #11724)
fixweb/admin: fix sync single button throwing error (cherry-pick #11727)
featureproviders/scim: add comparison with existing group on update and delta update users (cherry-pick #11414)
otherproviders/scim: clamp batch size for patch requests (cherry-pick #11797)
otherproviders/scim: handle no members in group in consistency check (cherry-pick #11801)
otherevents: always use expiry from current tenant for events, not only when creating from HTTP request (cherry-pick #11415)
fixproviders/proxy: fix traefik label generation (cherry-pick #11460)
fixweb/admin: fix Authentication flow being required (cherry-pick #11496)
fixsources/ldap: fix mapping check, fix debug endpoint (cherry-pick #11442)
fixsources/ldap: fix ms_ad userAccountControl not checking for lockout (cherry-pick #11532)
securitysecurity: fix CVE-2024-47077 (cherry-pick #11535)
securitysecurity: fix CVE-2024-47070 (cherry-pick #11536)
othercore: ensure proxy provider is correctly looked up (cherry-pick #11267)
fixroot: fix ensure outpost_connection_discovery runs on worker startup (cherry-pick #11260)
othercore: ensure all providers have correct priority (cherry-pick #11280)
otherevents: optimise marking events as seen (cherry-pick #11297)
fixweb/admin: fix notification property mapping forms (cherry-pick #11298)
fixcore: fix permission check for scoped impersonation (cherry-pick #11315)
otherenterprise: show specific error if Install ID is invalid in license (cherry-pick #11317)
fixsources/ldap: fix missing search attribute (cherry-pick #11125)
fixenterprise: fix API mixin license validity check (cherry-pick #11331)
fixproviders/proxy: fix URL path getting lost when partial URL is given to rd= (cherry-pick #11354)
fixproviders/ldap: fix migration assuming search group is set (cherry-pick #11170)
fixweb/admin: fix error in Outpost creation form (cherry-pick #11173)
fixcore: fix change_user_type always requiring usernames (cherry-pick #11177)
otherroot: backport s3 storage changes (cherry-pick #11181)
othercore: bump cryptography from 43.0.0 to 43.0.1 (cherry-pick #11185)
featurewebsite/docs: add note about terraform provider (cherry-pick #11206)
fixweb/admin: fix missing Sync object button SCIM Provider (cherry-pick #11211)
fixproviders/ldap: fix incorrect permission check for search access (cherry-pick #11217)
otherweb/admin: improve error handling (cherry-pick #11212)
otherproviders/ldap: rework search_group migration to work with read replicas (cherry-pick #11228)
fixcore: fix missing argument name escaping for property mapping (cherry-pick #11231)
fixinternal: fix go paginator not setting page correctly (cherry-pick #11253)
otherweb/users: show - if device was registered before we started saving the time (cherry-pick #11256)
otherwebsite/docs: 2024.8 release notes: reword group sync disable and fix typo (cherry-pick #11103)
fixenterprise: fix incorrect comparison for latest validity date (cherry-pick #11109)
otherci: fix failing release attestation (cherry-pick #11107)
fixweb: fix dual-select with dynamic selection (cherry-pick #11133)
securitysecurity: fix CVE-2024-47077 (cherry-pick #11535)
securitysecurity: fix CVE-2024-47070 (cherry-pick #11536)
fixweb/admin: fix selectable card colour in dark theme (cherry-pick #10794)
featuresources/ldap: Add enabled filter for ldap_password_validate signal (cherry-pick #10823)
securitysecurity: fix CVE-2024-42490 (cherry-pick #11022)
fixweb: fix theme not applying to document correctly (cherry-pick #10721)
fixsources/scim: fix duplicate service account users and changing token (cherry-pick #10735)
otherweb: replace all occurences of the theme placeholder (cherry-pick #10749)
fixenterprise/rac: fix error when listing connection tokens as non-superuser (cherry-pick #10771)
othercore: improve error handling on ASGI level (cherry-pick #10547)
otherlib/sync: handle SkipObject in direct triggered tasks (cherry-pick #10590)
fixstages/prompt: fix prompt not editable with invalid expression (cherry-pick #10603)
fixevents: fix race condition (cherry-pick #10602)
breakingcore: remove html language tag for pages that are translated (cherry-pick #10611)
fixweb/admin: fix missing SAML Provider ECDSA options (cherry-pick #10612)
otherlifecycle: only create tenant media root if needed (cherry-pick #10616)
breakingweb/flows: remove continue button from AutoSubmit stage (cherry-pick #10253)
otherevents: associate login_failed events to a user if possible (cherry-pick #10270)
otherweb/admin: show matching user reputation scores in user details (cherry-pick #10276)
otheroutposts: make refresh interval configurable (cherry-pick #10138)
otheroutposts: ensure minimum refresh interval (cherry-pick #10701)
fixtests/e2e: fix ldap tests following #10270 (cherry-pick #10288)
otherwebsite/docs: update 2024.6 release notes with latest changes (cherry-pick #10228)
breakingwebsite/docs: remove RC disclaimer from 2024.6 release notes (cherry-pick #10245)
securitysecurity: update supported versions (cherry-pick #10247)
otherwebsite/docs: update geoip and asn example to use the proper syntax (cherry-pick #10249)
otherwebsite/docs: update geoip and asn documentation following field changes (cherry-pick #10265)
fixstages/user_login: fix ?next parameter not carried through broken session binding (cherry-pick #10301)
breakingweb/flows: remove background image link (cherry-pick #10318)
breakingcore: remove transitionary old JS urls (cherry-pick #10317)
fixprovider/scim: Fix exception handling for missing ServiceProviderConfig (cherry-pick #10322)
fixproviders/saml: fix metadata import error handling (cherry-pick #10349)
fixsources/saml: fix pickle error, add saml auth tests (cherry-pick #10348)
fixsources/oauth: fix link not being saved (cherry-pick #10374)
fixstages/authenticator_validate: fix friendly_name being required (cherry-pick #10382)
fixcore: fix migrations missing using db_alias (cherry-pick #10409)
fixweb/admin: fix access token list calling wrong API (cherry-pick #10434)
fixcore: fix source flow_manager not resuming flow when linking (cherry-pick #10436)
othercore: revert backchannel only filtering (cherry-pick #10455)
featurewebsite/docs: add 2024.6.1 release notes (cherry-pick #10456)
breakingwebsite/docs: Remove hyphen in read replica in Release Notes (cherry-pick #10178)
othercore: rework base for SkipObject exception to better support control flow exceptions (cherry-pick #10186)
otherweb/flows: update flow background (cherry-pick #10206)
securitysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
otherwebsite/docs: update 2024.4 release notes with latest changes (cherry-pick #10231)
securitysecurity: fix CVE-2024-42490 (cherry-pick #11022)
fixcore: fix source flow_manager not always appending save stage (cherry-pick #9659)
fixweb: fix value handling inside controlled components (cherry-pick #9648)
fixsources/saml: fix FlowPlanner error due to pickle (cherry-pick #9708)
securitysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
securityFixes CVE-2024-37905: Improper Authorization for Token modification
fixsources/oauth: fix OAuth Client sending token request incorrectly (cherry-pick #9474)
fixflows: fix execute API endpoint (cherry-pick #9478)
otherevents: ensure all models' str can be called without any further lookups (cherry-pick #9480)
fixweb/flows: fix missing fallback for flow logo (cherry-pick #9487)
othercore: only prefetch related objects when required (cherry-pick #9476)
featureweb: Add missing integrity hashes to package-lock.json
otherlifecycle: close database connection after migrating (cherry-pick #9516)
fixproviders/saml: fix ecdsa support (cherry-pick #9537)
fixweb/flows: fix error when enrolling multiple WebAuthn devices consecutively (cherry-pick #9545)
fixproviders/scim: fix time_limit not set correctly (cherry-pick #9546)
fixenterprise/audit: fix audit logging with m2m relations (cherry-pick #9571)
fixcore: fix source_flow_manager saving user-source connection too early (cherry-pick #9559)
fixproviders/scim: fix SCIM ID incorrectly used as primary key (cherry-pick #9557)
fixtenants: fix scheduled tasks not running on default tenant (cherry-pick #9583)
fixcore: fix task clean_expiring_models removing valid sessions with using database storage (cherry-pick #9598)
fixcore: fix condition in task clean_expiring_models (cherry-pick #9603)
fixsources/scim: fix duplicate groups and invalid schema (cherry-pick #9466)
otherwebsite/docs: prepare 2024.4.2 release notes (cherry-pick #9555)
otherweb: markdown: display markdown even when frontmatter is missing (cherry-pick #9404)
othersources/oauth: ensure all UI sources return a valid source (cherry-pick #9401)
otherstages/identification: don't check source component (cherry-pick #9410)
featureweb: Add resolved and integrity fields back to package-lock.json (cherry-pick #9419)
fixcore: fix logic for token expiration (cherry-pick #9426)
otherci: fix ci pipeline (cherry-pick #9427)
fixweb/common: fix locale detection for user-set locale (cherry-pick #9436)
otherlifecycle: always try custom redis URL (cherry-pick #9441)
otherwebsite/docs: prepare 2024.4.1 (cherry-pick #9459)
otherweb/admin: show user internal service account as disabled (cherry-pick #9464)
fixweb/admin: fix disabled button color with dark theme (cherry-pick #9465)
fixsources/scim: fix service account user path (cherry-pick #9463)
otherwebsite/docs: update release notes for 2024.4.1 again (cherry-pick #9471)
breakingwebsite/docs: remove outdated info
breakingwebsite/docs: remove tenants docs from sidebar for now
featurewebsite/docs: added a new template for "combo" topics
featurewebsite/blog: add draft for blog about fletcher joining
breakingwebsite/docs: 2024.2: update comment about upgrading to mention breaking changes
featurewebsite: add solve gitea group does not take effect
featurewebsite/docs: Add documentation for Glitchtip
featureAdd missing commas, correction of spelling errors
featurewebsite/integrations: add documentation for OIDC setup with Paperless-ngx
featuresources/oauth: add gitlab type [AUTH-323]
featurewebsite/integrations: Add description for custom enrollment to azure ad
featurewebsite/docs: new landing page for Providers
featurewebsite/docs: add link to CRUD docs
featurewebsite/docs: add new name "Microsft Entra ID" for Azure AD
breakingwebsite/docs: config: remove options moved to tenants
breakingweb/admin: remove enterprise preview banner
featurewebsite/docs: add example policy to enforce unique email address
featurewebsite/deverlop-docs website/integrations: add links to integrations template
featuresources/ldap: add ability to disable password write on login
featurewebsite/docs: maintenance, re-add system settings
featurewebsite/integrations: add documentation for OIDC setup with Xen Orchestra
featureweb/admin: allow custom sorting for bound* tables
featurewebsite/integrations: add outline knowledge base
featurewebsite/docs: add procedural docs for RAC
featurestages/authenticator_webauthn: add MDS support
featureevents: add context manager to ignore/modify audit events being written
featurewebsite/docs: add note for flow compatibility mode
featurecore: add user settable token durations
featurestages/authenticator_validate: add ability to limit webauthn device types
featurewebsite/docs: add more info and links about enforciing unique email addresses
featurewebsite/integrations: nextcloud: add tip to solve hashed groups configuring OAuth2
featureinternal: add tests to go flow executor
featurewebsite/docs: add websocket support to nginx snippets
featurewebsite/integrations: add pfSense search scope
featureproviders/scim: allow custom user and group schemas
featuresources: add SCIM source
featureevents: add indexes
featurewebsite/docs: system settings: add default token duration and length
featureroot: make redis settings more consistent and allow TLS CA
featurebrands: add indexes to brand domain and default
+403 more items in the release notessecuritysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
otherenterprise: only check for valid license existing for creating Enterprise objects (cherry-pick #8813)
otherstages/email: Disable autoescape for text templates (cherry-pick #8812)
fixstages/email: fix issue when sending emails to users with same display as email (cherry-pick #8850)
othertenants: really ensure default tenant cannot be deleted (cherry-pick #8875)
otherapi: capabilities: properly set can_save_media when s3 is enabled (cherry-pick #8896)
fixenterprise/rac: fix connection token management (cherry-pick #8909)
otherstages/user_write: ensure user data is json-serializable (cherry-pick #8926)
otherevents: discard notification if user has empty email (cherry-pick #8938)
breakingwebsite/docs: config: remove options moved to tenants (cherry-pick #8976)
otherlifecycle: migrate: ensure template schema exists before migrating (cherry-pick #8952)
fixproviders/oauth2: fix inconsistent sub value when setting via mapping (cherry-pick #8677)
fixcore: fix blueprint export (cherry-pick #8695)
fixenterprise: fix read_only activating when no license is installed (cherry-pick #8697)
fixwebsite/docs: s3: fix environment variables (cherry-pick #8722)
otherenterprise: force license usage update after change to license (cherry-pick #8723)
fixroot: fix container build (cherry-pick #8727)
otherci: fix missing DOCKER_USERNAME secret (cherry-pick #8730)
fixproviders/oauth2: fix offline_access requests when prompt doesn't include consent (cherry-pick #8731)
fixwebsite/docs: s3: fix migration docs (cherry-pick #8735)
fixstages/authenticator_webauthn: fix error when enrolling new device (cherry-pick #8738)
otherci: fix missing output on composite action (cherry-pick #8741)
otherweb/admin: don't mark property mappings as required anywhere (cherry-pick #8752)
otherweb/admin: don't mark remaining property mappings as required (cherry-pick #8772)
otherroot: ensure consistent install_id (cherry-pick #8775)
fixwebsite/docs: installation: kubernetes: fix values (cherry-pick #8783)
fixproviders/oauth2: fix validation ordering (cherry-pick #8793)
fixflows: fix mismatched redirect behaviour for invalid and valid flows (cherry-pick #8794)
fixstages/authenticator_validate: fix error with get_webauthn_challenge_without_user (cherry-pick #8625)
otherci: fix missing tags from release (cherry-pick #8645)
otherevents: sanitize args and kwargs saved in system tasks (cherry-pick #8644)
fixbrands: fix context processor when request doesn't have a tenant (cherry-pick #8643)
otherwebsite/docs: kubernetes installation: update values (cherry-pick #8575)
fixrbac: fix permission decorator for global permissions (cherry-pick #8591)
otherweb: spell customization with a Z (cherry-pick #8596)
fixweb/flows: fix webauthn retry (cherry-pick #8599)
othersources/oauth: revert azure_ad profile URL change (cherry-pick #8139)
fixweb/flows: fix icon for generic oauth source with dark theme (cherry-pick #8148)
fixsources/oauth: fix azure_ad user_id and add test and fallback (cherry-pick #8146)
fixsources/oauth: fix URLs being overwritten by OIDC urls (cherry-pick #8147)
fixrbac: fix invitations listing with restricted permissions (cherry-pick #8227)
otherstages/authenticator_validate: use friendly_name for stage selector when enrolling (cherry-pick #8255)
securitysecurity: fix CVE-2024-23647 (cherry-pick #8345)
otherproviders/oauth2: remember session_id from initial token (cherry-pick #7976)
fixoutposts: fix Outpost reconcile not re-assigning managed attribute (cherry-pick #8014)
otherproviders/proxy: use access token (cherry-pick #8022)
otheroutposts: disable deployment and secret reconciler for embedded outpost in code instead of in config (cherry-pick #8021)
fixrbac: fix error when looking up permissions for now uninstalled apps (cherry-pick #8068)
fixweb/flows: fix device picker incorrect foreground color (cherry-pick #8067)
securityproviders/oauth2: fix CVE-2024-21637 (cherry-pick #8104)
othertests: fix flaky tests (cherry-pick #7676)
otherproviders/scim: change familyName default (cherry-pick #7904)
fixweb: fix overflow glitch on ak-page-header (cherry-pick #7883)
fixroot: Fix cache related image build issues (cherry-pick #7831)
fixweb/user: fix search not updating app (cherry-pick #7825)
otherblueprints: improve file change handler (cherry-pick #7813)
otherroot: don't show warning when app has no URLs to import (cherry-pick #7765)
otherstages/email: improve error handling for incorrect template syntax (cherry-pick #7758)
otherevents: include user agent in events (cherry-pick #7693)
featureevents: add better fallback for sanitize_item to ensure everything can be saved as JSON (cherry-pick #7694)
fixproviders/proxy: Fix duplicate cookies when using file system store. (cherry-pick #7541)
otherstages/email: use uuid for email confirmation token instead of username (cherry-pick #7581)
otherevents: sanitize functions (cherry-pick #7587)
fixproviders/scim: fix missing schemas attribute for User and Group (cherry-pick #7477)
fixevents: fix missing model_* events when not directly authenticated (cherry-pick #7588)
otherci: fix permissions for release pipeline to publish binaries (cherry-pick #7512)
othercore: bump golang from 1.21.3-bookworm to 1.21.4-bookworm (cherry-pick #7483)
otherevents: don't update internal service accounts unless needed (cherry-pick #7611)
securitysecurity: fix CVE-2023-48228 (cherry-pick #7666)
otherroot: Improve multi arch Docker image build speed (cherry-pick #7355)
otherproviders/oauth2: set auth_via for token and other endpoints (cherry-pick #7417)
fixstages/email: fix duplicate querystring encoding (cherry-pick #7386)
fixweb/admin: fix html error on oauth2 provider page (cherry-pick #7384)
otherci: explicitly give write permissions to packages (cherry-pick #7428)
fixproviders/proxy: fix closed redis client (cherry-pick #7385)
fixsources/oauth: fix patreon (cherry-pick #7454)
otherweb/flows: attempt to fix bitwareden android compatibility (cherry-pick #7455)
fixevents: fix gdpr compliance always running (cherry-pick #7491)
fixWeb: bugfix: broken backchannel selector (cherry-pick #7480)
fixcore: fix worker beat toggle inverted (cherry-pick #7508)
otherwebsite/docs: update release notes for 2023.10.1
otherweb: bump API Client version
fixstages/email: fix sending emails from task
otherproviders/proxy: attempt to fix duplicate cookie
otherwebsite/blogs: Blog dockers
othercore: bump pydantic-scim from 0.0.7 to 0.0.8
othercore: bump ruff from 0.1.2 to 0.1.3
othercore: bump goauthentik.io/api/v3 from 3.2023083.10 to 3.2023101.1
othercore: bump github.com/google/uuid from 1.3.1 to 1.4.0
fixweb/admin: fix role form reacting to enter
featurewebsite/docs: add warning about upgrading to 2023.10
otherrbac: handle lookup error
fixweb/admin: fix @change handler for ak-radio elements
fixblueprints: fix entries with state: absent not being deleted if their serializer has errors
fixcrypto: fix race conditions when creating self-signed certificates on startup
breakingwebsite/docs: add warning about Helm breaking change in 2024.x
othertranslate: Updates for file web/xliff/en.xlf in zh_CN
othertranslate: Updates for file web/xliff/en.xlf in zh-Hans
otherlifecycle: rework otp_merge migration
breakingwebsite/docs: add missing breaking change due to APPEND_SLASH
otherwebsite/docs: prepare 2023.10.2 release notes
securitysecurity: fix oobe-flow reuse when akadmin is deleted
otherweb: bump API Client version
fixroot: fix pylint errors
fixlifecycle: fix otp merge migration
fixweb/admin: fix application icon size
fixweb/admin: fix circular dependency
fixroot: fix broken celery dependency
fixsources/ldap: fix FreeIPA nsaccountlock sync
featurewebsite/docs: enterprise: add note about upgrading the amount of users
fixstages/password: fix failed_attempts_before_cancel allowing one too m…
breakingflows: remove need for post() wrapper by using dispatch
fixweb/admin: fix not being able to unset certificates
featurewebsite/dev-docs: add raw markdown template
fixsources/ldap: fix task timeout for ldap_sync_all and ldap_sync_single
featurewebsite/docs: add missing word to index.mdx
fixweb/admin: fix flow-search not being able to unset
breakingcore: remove celery's duplicate max_tasks_per_child
fixroot: fix dumb-init
fixroot: fix gunicorn not starting
featureroot: add option to disable beat when running worker
breakingweb: remove ./element⇢./user references
featuresources/ldap: add warning when a property mapping returns None or bytes
featurewebsite/blogs: added emm dashes
featuresources/ldap: add lock to sync
featurewebsite/docs: add info about our docs
featureroot: Add setting to adjust database config for pgpool
breakingroot: remove outdated sponsorship section on readme
featuresources/ldap: add default property mapping to mirror directory structure
featurewebsite/blog: add info-block to blog about m2m
featurewebsite/docs: add notice for nginx ingress configuration requirement
featureweb: add webdriverIO testing layer
featureAdd meta description to black box blog post
featureproviders/saml: add default RelayState value for IDP-initiated requests
featurecore/api: add uuid field to core api user http response
featureproviders/ldap: add windows adsi support
featureweb/admin: add additional Flow info
breakingproviders/scim: remove preview
featurewebsite/docs: added Note in Beta docs
featurestage/deny: add custom message
featurewebsite/integrations: grafana: add Helm and Terraform config examples
featurewebsite/blogs: edited to add 1Password
featureweb/admin: add preview banner to RBAC pages
featurestages/user_write: allow setting user type when creating new user
featurewebsite/docs: add 2023.10 release notes
+318 more items in the release notessecuritysecurity: fix CVE-2024-23647 (cherry-pick #8345)
securityproviders/oauth2: fix CVE-2024-21637 (cherry-pick #8104)
securitysecurity: fix CVE-2023-48228 (cherry-pick #7666)
otherproviders/saml: set WantAuthnRequestsSigned in metadata (cherry-pick #6851)
fixsources/ldap: fix inverted interpretation of FreeIPA nsaccountlock (cherry-pick #6877)
otherweb: bump API Client version
otherweb: bump pyright from 1.1.324 to 1.1.325 in /web
othercore: bump sentry-sdk from 1.29.2 to 1.30.0
otherwebsite: bump postcss from 8.4.28 to 8.4.29 in /website
otherwebsite: bump prettier from 3.0.2 to 3.0.3 in /website
othercore: bump goauthentik.io/api/v3 from 3.2023061.13 to 3.2023081.1
fixevents: fix missing application names from most used applications
fixweb/admin: fix ak-toggle-group for policy and blueprint uses
fixproviders/oauth2: fix incorrect scope permissions shown
fixwebsite: fix reference to flow stage binding option
othercore: make groups' parent_name nullable as it might not be set
otherweb/admin: clear other options depending on what the binding targets
otherweb: bump the sentry group in /web with 2 updates
otherweb: bump the babel group in /web with 1 update
otherweb: bump @lit-labs/task from 3.0.1 to 3.0.2 in /web
othercore: bump goauthentik.io/api/v3 from 3.2023081.1 to 3.2023081.2
othertranslate: Updates for file web/xliff/en.xlf in zh_CN on branch main
othertranslate: Updates for file web/xliff/en.xlf in zh-Hans on branch main
fixpolicies/reputation: fix reputation not expiring
otherroot: expand exception logging
othertranslate: Updates for file web/xliff/en.xlf in nl on branch main
othercore: bump celery from 5.3.1 to 5.3.3
othercore: bump selenium from 4.11.2 to 4.12.0
othercore: bump goauthentik.io/api/v3 from 3.2023081.2 to 3.2023081.3
fixcrypto: fix has_key filter
fixwebsite: fix sidebar text color on smaller viewports
fixproviders/saml: fix SAML metadata import API requiring flow slug inst…
otherwebsite/docs: prepare 2023.8.2 release
otherwebsite/blog: Blog about enterprise release
otherwebsite: update subtext
otherweb: bump API Client version
breakingwebsite: remove enterprise waitlist
otherweb: bump prettier from 3.0.2 to 3.0.3 in /web
fixwebsite/docs: fix typos
fixweb: fix notification drawer scrolling
fixweb/admin: fix version link to release notes
fixblueprints: fix policy exception causing password stage to be skipped after upgrade
otherroot/revert persistent connections
otherwebsite: bump 2023.8.1 release notes
featureweb: add required esbuild optional packages
fixsources/ldap: fix page size
fixsources/ldap: fix more errors
featureoutposts/ldap: add more tests
featureoutposts/ldap: add test for attribute filtering
fixcore: fix UUID filter field for users api
fixweb/admin: fix admin overview layout
securityroot: Update security policy
fixwebsite/blog: fixed wrong date
fixevents: fix authentik_system_tasks metric status label
featurewebsite/docs: re-add goauthentik.io/user/can-change-*
fixwebsite/blog: fixed bad link
featureenterprise: add more info to enterprise forecast
featurewebsite/blog: Ken blog, add graphic
featurewebsite/blog: added image to header
fixroot: fix config env var resolution
fixwebsite/blog: fixed grammatical error in blog
fixsources/ldap: fix ldap_sync cli command not running in foreground
fixproviders/oauth2: fix grant_type password raising an exception
fixenterprise: fix license check not using DER as spec specifies
fixoutposts: fix patch processing
fixoutposts: Fix infinite self-recursion in traefik reconciler.
securityroot: set csrf cookie's secure flag same as session
fixenterprise: fix license check not using the proper JWT algorithm
fixweb/user: fix background alignment
fixsources/ldap: fix syncing large LDAP directories
fixevents: fix monitored task not removing state
featurewebsite: add tooltips to comparison table
featurewebsite/docs: add architecture and persistence
featureroot: add generated Source docs
featureroot: add get_int to config loader instead of casting to int everywhere
featureroot: replace builtin psycopg libpq binary implementation with distro…
featureweb/flows: add more stories
featurewebsite/developer-docs: add new template for procedures
featurewebsite/blog: add github user name links
securitywebsite/blog: blog about tightrope of security and convenience
featurewebsite/docs: added conceptual template
featurewebsite/docs: new reference template
deprecatedweb: replace deprecated terser rollup plugin, remove unused plugin
securitysecurity: fix CVE-2023-39522
+293 more items in the release notesfeaturewebsite: automatically add PR links to release notes
fixblueprints: fix check for file path not being run on worker
featurelib: add tests for ak_create_event
featureroot: add install ID
fixwebsite/integrations: Update discord integration role check expression - fix errors.
featureweb/user: refactor LibraryPage for testing, add CTA
fixoutposts: fix missing radius outpost controller
fixevents: fix ak_create_event using wrong request for event creation
fixweb/user: fix broken search on application library
fixweb/user: fix MFA enroll dropdown broken when password stage has no configuration flow
fixweb/user: fix search input styling
featurewebsite/integrations: add google workspace integration
featureroot: add method to get install_id without django being loaded
breakingwebsite: fix newsletter signup breaking mobile layout
fixwebsite: fix go-get function (always fallback to authentik repo except hardcoded values)
featurelifecycle: Add depends_on for worker and server container
fixweb/flows: fix RedirectStage not detecting absolute URLs correctly
fixweb: fix build
featureproviders/proxy: add support for traefik.io API and CRD
featureblueprints: allow setting user's passwords from blueprints
fixstages/deny: fix typos
fixproviders/ldap: fix LDAP Outpost application selection
fixblueprints: fix API validation with OCI blueprint path
fixwebsite/integrations: fix snipe-it typo
fixoutposts/ldap: fix race condition when refreshing the provider
featurewebsite/docs: add Note about wget command
featureproviders/ldap: add StartTLS support
featureweb: Add storybook
featurewebsite/integrations: add account linking note for WriteFreely
featuresources/ldap: add support for cert based auth
featurepolicies/event_matcher: add model filter
featurewebsite: add b2c pricing
breakingwebsite/integrations: remove placeholders from AWS setup
securitywebsite/blog: blog draft for Demystifying Security
featurewebsite: add Firezone integration
securitysecurity: cure53 fix
featureroot: add version and commit to container labels
featurewebsite/integrations: add Netbox integration
featureflows: allow empty value in AutosubmitChallenge
securitysecurity: fix CVE-2023-36456
+264 more items in the release notessecurityFixes CVE-2023-36456: Lack of Proxy IP headers validation
featurewebsite/docs: add 2023.5 to release sidebar
otherweb: bump API Client version
fixlib: fix fallback_names migration not working when multiple objects n…
otherweb/flows: update flow background
fixweb/flows: fix authenticator_validate device select not sent to backend
otherproviders/scim: default to None for fields instead of empty list
othercore: bump goauthentik.io/api/v3 from 3.2023041.12 to 3.2023050.1
othercore: bump github.com/sirupsen/logrus from 1.9.0 to 1.9.1
otherci: bump helm/kind-action from 1.5.0 to 1.6.0
fixweb/admin: fix radius provider page
othersources/ldap: improve error message
otherproviders/SCIM: improve backchannel signalling
featureproviders/radius: add warning message when radius provider is not used with outpost
otherweb: bump @lingui/core from 4.1.0 to 4.1.2 in /web
otherwebsite/blog: flex-hours-blog-draft-for-review
otherwebsite/docs: edits to full dev env
othercore: bump goauthentik.io/api/v3 from 3.2023050.1 to 3.2023050.2
othercore: bump sentry-sdk from 1.23.0 to 1.23.1
otherweb: bump tslib from 2.5.0 to 2.5.1 in /web
otherci: bump helm/kind-action from 1.6.0 to 1.7.0
othercore: bump github.com/sirupsen/logrus from 1.9.1 to 1.9.2
featurewebsite/integrations: Updated AWS docs for the new IAM Center and SCIM
otherweb/flows: improve UI for TOTP code input
othersources/ldap: log full exception when user password set fails
otherwebsite/docs: prepare 2023.5.1 release notes
featurewebsite/docs: add better explanation for goauthentik.io/user/token-ex…
featurewebsite: add X-Frame-Options
featureweb: fetch custom.css via fetch and add stylesheet
featurecore: Add resolve_dns and reverse_dns functions to evaluator
securitysecurity: fix CVE-2023-26481
featurewebsite: add website development setup, update contribution guidelines on PR titles
featurewebsite/docs: Corrected typo and added Note about port number if using Istio/Kubern…
featureproviders/scim: add option to filter out service accounts, parent group
featurecore: add a list of recommended vs code extensions
featurecore: add validator which allows for URLs with formatting
featurewebsite/docs: add new release to sidebar, cleanup
breakingstages/authenticator_webauthn: remove credential_id size limit
featurewebsite/docs: forward-auth page, add list of links
featureroot: add common fixture loader
featureblueprints: allow setting of token key in blueprint context
featurewebsite/docs: added content to Welcome page
featurewebsite: use slider on docs, add flow images
featurestages/prompt: Add Radio Button Group, Dropdown and Text Area prompt fields
featurecore: Add unique constraint to user UUID
featurewebsite/integrations: add detail to MinIO docs
featurewebsite/stages/prompt: Update new prompt fields docs
featurewebsite: add pricing waitlist and blog post
breakingweb: remove more until
breakingwebsite/blog: removed strikethrough text and formatted feature list
featureproviders: Add ability to choose a default authentication flow
featurewebsite/developer-docs: add note to create version subdomain and conf…
featureproviders/scim: add missing default fields
featurestages: Add ability to set user friendly names for MFA stages
securityoutposts: set k8s deployment security context
featureCONTRIBUTING: added a section about contributing to docs
featureREADME: added link to Contributor file, small edits
featurewebsite/docs: add helm RBAC notice
featurelifecycle: re-add exec to ak wrapper
featureroot: add ruff linter
featureroot: add argon2-cffi
featurestages/prompt: Add initial_data prompt field and ability to select a default choice for choice fields
breakingproviders/ldap: remove deprecated fields
breakingweb/admin: remove grouping
featurewebsite: add documentation for AUTHENTIK_REDIS__TLS
breakingweb/admin: remove redundant markdown notice
+560 more items in the release notessecurityFixes CVE-2023-36456: Lack of Proxy IP headers validation
otherrelease: 2023.4.0
featurewebsite/docs: add helm RBAC notice
otherweb: bump API Client version
otherci: fix tag lookup for previous stable version
featurelifecycle: re-add exec to ak wrapper
fixlifecycle: fix worker healthcheck
otherwebsite/docs: separate docker steps
othercore: bump drf-spectacular from 0.26.1 to 0.26.2
othercore: bump importlib-metadata from 6.3.0 to 6.4.1
othercore: bump pytest from 7.3.0 to 7.3.1
otherwebsite: bump postcss from 8.4.21 to 8.4.22 in /website
otherwebsite: bump react-before-after-slider-component from 1.1.6 to 1.1.8 in /website
otherweb: bump @sentry/tracing from 7.47.0 to 7.48.0 in /web
othercore: bump goauthentik.io/api/v3 from 3.2023031.17 to 3.2023040.1
otherweb: bump @sentry/browser from 7.47.0 to 7.48.0 in /web
fixcore: Fix bug causing whitespace only names to raise exception when generating avatars
featurewebsite/docs: add better explanation for goauthentik.io/user/token-ex…
fixwebsite/integrations: fix Vikunja setup instructions
fixproviders/ldap: fix tests
fixweb/user: fix source connections not being filtered
fixweb/admin: fix chart display with no sources
featurewebsite: add X-Frame-Options
fixproviders/oauth2: fix typo
featureweb: fetch custom.css via fetch and add stylesheet
featurecore: Add resolve_dns and reverse_dns functions to evaluator
fixstages/authenticator_sms: fix twilio sending, add test
securitysecurity: fix CVE-2023-26481
fixsources/plex: fix check_token error unusable if token is empty
featurewebsite: add website development setup, update contribution guidelines on PR titles
featurewebsite/docs: Corrected typo and added Note about port number if using Istio/Kubern…
fixweb/elements: fix center text not scrolling with container
featureproviders/scim: add option to filter out service accounts, parent group
featurecore: add a list of recommended vs code extensions
featurecore: add validator which allows for URLs with formatting
featurewebsite/docs: add new release to sidebar, cleanup
breakingstages/authenticator_webauthn: remove credential_id size limit
featurewebsite/docs: forward-auth page, add list of links
featureroot: add common fixture loader
featureblueprints: allow setting of token key in blueprint context
featurewebsite/docs: added content to Welcome page
featurewebsite: use slider on docs, add flow images
featurestages/prompt: Add Radio Button Group, Dropdown and Text Area prompt fields
featurecore: Add unique constraint to user UUID
featurewebsite/integrations: add detail to MinIO docs
featurewebsite/stages/prompt: Update new prompt fields docs
featurewebsite: add pricing waitlist and blog post
breakingweb: remove more until
breakingwebsite/blog: removed strikethrough text and formatted feature list
featureproviders: Add ability to choose a default authentication flow
featurewebsite/developer-docs: add note to create version subdomain and conf…
featureproviders/scim: add missing default fields
featurestages: Add ability to set user friendly names for MFA stages
securityoutposts: set k8s deployment security context
featureCONTRIBUTING: added a section about contributing to docs
featureREADME: added link to Contributor file, small edits
+320 more items in the release notesfeaturewebsite/docs: add new release to sidebar, cleanup
otherrelease: 2023.3.0
otherweb: bump API Client version
otherweb/flows: update background
breakingstages/authenticator_webauthn: remove credential_id size limit
otherwebsite/docs: capitalization of product names
fixproviders: fix authorization_flow not required in API
fixweb/admin: fix wizards with radio selects not working correctly after use
otherweb: bump @typescript-eslint/parser from 5.54.1 to 5.55.0 in /web
otherweb: bump core-js from 3.29.0 to 3.29.1 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.54.1 to 5.55.0 in /web
otherweb: bump @sentry/browser from 7.42.0 to 7.43.0 in /web
otherweb: bump @sentry/tracing from 7.42.0 to 7.43.0 in /web
othercore: bump goauthentik.io/api/v3 from 3.2023022.15 to 3.2023030.2
otherwebsite/integrations: Changes to reverse proxy information for grafana
featurewebsite/docs: forward-auth page, add list of links
featureroot: add common fixture loader
othercore: bump google.golang.org/protobuf from 1.29.0 to 1.29.1
otherwebsite: bump webpack from 5.73.0 to 5.76.1 in /website
othercore: bump goauthentik.io/api/v3 from 3.2023030.2 to 3.2023030.3
otherweb: bump @babel/core from 7.21.0 to 7.21.3 in /web
fixwebsite/docs: Fix detail and improve latest changelog regarding SCIM
fixcore: fix url validator
fix*: fix mismatched task names for discovery, make output service connection task monitored
otherwebsite/docs: capitalization and clarifications
fixweb/common: fix tab label color on dark theme
fixweb/user: fix custom user interface background with dark theme
otherweb: bump API Client version
othercore: bump kubernetes from 25.3.0 to 26.1.0
othercore: bump goauthentik.io/api/v3 from 3.2023021.1 to 3.2023022.1
otherweb: bump mermaid from 9.3.0 to 9.4.0 in /web
otherweb: bump pyright from 1.1.293 to 1.1.294 in /web
otherci: bump snok/container-retention-policy from 1 to 2
othercore: bump duo-client from 4.5.0 to 4.6.1
othercore: bump selenium from 4.8.0 to 4.8.2
othercore: bump webauthn from 1.7.0 to 1.7.2
otherweb: bump @sentry/browser from 7.37.2 to 7.38.0 in /web
otherweb: bump @codemirror/theme-one-dark from 6.1.0 to 6.1.1 in /web
fixcore: Fix bug causing whitespace only names to raise exception when generating avatars
featurewebsite/docs: add better explanation for goauthentik.io/user/token-ex…
fixwebsite/integrations: fix Vikunja setup instructions
fixproviders/ldap: fix tests
fixweb/user: fix source connections not being filtered
fixweb/admin: fix chart display with no sources
featurewebsite: add X-Frame-Options
fixproviders/oauth2: fix typo
featureweb: fetch custom.css via fetch and add stylesheet
featurecore: Add resolve_dns and reverse_dns functions to evaluator
fixstages/authenticator_sms: fix twilio sending, add test
securitysecurity: fix CVE-2023-26481
fixsources/plex: fix check_token error unusable if token is empty
featurewebsite: add website development setup, update contribution guidelines on PR titles
featurewebsite/docs: Corrected typo and added Note about port number if using Istio/Kubern…
fixweb/elements: fix center text not scrolling with container
fixinternal: fix crash when port 9000 is in use
featureproviders/scim: add option to filter out service accounts, parent group
fixwebsite/docs: fix typo
featurecore: add a list of recommended vs code extensions
fixweb: fix locale inconsistencies
featurecore: add validator which allows for URLs with formatting
fixweb: fix theming issues when using automatic
fixwebsite/docs: fix layout for preview annotation
fixweb/elements: fix flipped theme in codemirror
fixroot: fix session middleware for websocket connections
fixweb/flows: fix compatibility mode
fixweb/admin: fix scim provider layout
fixweb/elements: fix copy on insecure origins
+108 more items in the release notessecurityFixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage
otherflows: include flow authentication requirement in diagram
otherlib: don't try to cache generated avatar with full user, only cache with name
otherproviders/ldap: check MFA password on password stage
fixproviders/proxy: fix client credential flows not using http interceptor
fixproviders/proxy: fix value is too long with filesystem sessions
otherroot: use channel send workaround for sync sending of websocket messages
fixweb/admin: fix error when creating new users
otherweb/user: revert truncate behaviour for application description
fixinternal: fix scheme not being forwarded correctly for host intercepted requests
featuresources/ldap: add LDAP Debug endpoint
otherweb/admin: improve action button spinner on ldap source page
breakingweb/admin: remove groups and users from users and group form to prevent accidental removal when updating
otherweb/admin: use full page size for modals
otherweb: bump API Client version
featureproviders/ldap: add unbind flow execution
othercore: bump selenium from 4.7.2 to 4.8.0
otherweb: bump @types/codemirror from 5.60.6 to 5.60.7 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.48.2 to 5.49.0 in /web
othercore: bump sentry-sdk from 1.13.0 to 1.14.0
otherweb: bump @typescript-eslint/parser from 5.48.2 to 5.49.0 in /web
otherweb: bump @sentry/tracing from 7.31.1 to 7.32.1 in /web
othercore: bump goauthentik.io/api/v3 from 3.2023010.1 to 3.2023012.1
otherweb: bump @sentry/browser from 7.31.1 to 7.32.1 in /web
otherstages/prompt: field name
othercore: bump coverage from 7.0.5 to 7.1.0
otherweb: bump @lingui/detect-locale from 3.16.0 to 3.16.1 in /web
otherweb: bump @sentry/tracing from 7.32.1 to 7.33.0 in /web
otherweb: bump pyright from 1.1.290 to 1.1.291 in /web
othercore: bump goauthentik.io/api/v3 from 3.2023012.1 to 3.2023012.2
otherweb: bump @lingui/cli from 3.16.0 to 3.16.1 in /web
otherwebsite: bump ua-parser-js from 0.7.32 to 0.7.33 in /website
otherweb: bump @lingui/macro from 3.16.0 to 3.16.1 in /web
otherweb: bump @sentry/browser from 7.32.1 to 7.33.0 in /web
othercore: bump twilio from 7.16.1 to 7.16.2
othercore: bump dacite from 1.7.0 to 1.8.0
otherweb: bump @sentry/browser from 7.33.0 to 7.34.0 in /web
otherweb: bump tslib from 2.4.1 to 2.5.0 in /web
otherweb: bump @sentry/tracing from 7.33.0 to 7.34.0 in /web
othertests: run e2e tests in random order
otherdocs(passwordless): Make sure to include a warning about Firefox
otherstages/prompt: set UUID to be a string
othercore: bump pycryptodome from 3.16.0 to 3.17
otherweb: bump eslint from 8.32.0 to 8.33.0 in /web
otherwebsite: bump @docusaurus/preset-classic from 2.2.0 to 2.3.0 in /website
othercore: bump goauthentik.io/api/v3 from 3.2023012.2 to 3.2023012.3
featurewebsite/integrations: Added GitHub Enterprise Server
featureproviders/proxy: initial outpost wide logout implementation
featurewebsite/integrations: add Gravitee integration
fixwebsite/integrations: Fix Nextcloud SAM UID value setting
fixproviders/saml: fix mismatched SAML SLO Urls
featurewebsite/integrations: Add danger annotation for using username as Nextcloud UID
featurecore: Add support for auto generating unique avatars based on the user's initials
fixroot: fix config load order to include /etc/authentik/config.yml
+69 more items in the release notessecurityFixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage
otherweb: bump API Client version
otherproviders/oauth2: more x5c and ecdsa x/y tests
otherweb: bump @lingui/detect-locale from 3.15.0 to 3.16.0 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022122.8 to 3.2023010.1
otherweb: bump chart.js from 4.1.2 to 4.2.0 in /web
otherweb: bump core-js from 3.27.1 to 3.27.2 in /web
otherweb: bump @lingui/core from 3.15.0 to 3.16.0 in /web
otherweb: bump @lingui/cli from 3.15.0 to 3.16.0 in /web
otherweb: bump @lingui/macro from 3.15.0 to 3.16.0 in /web
othersources/ldap: start adding more LDAP source tests
fixproviders/proxy: fix issuer for embedded outpost
otherci: build beta for amd64 and arm64
fixFix TOTP issuer mangling
othercore: bump paramiko from 2.12.0 to 3.0.0
otherweb: bump @rollup/plugin-commonjs from 24.0.0 to 24.0.1 in /web
otherweb: bump @babel/plugin-proposal-decorators from 7.20.7 to 7.20.13 in /web
fixfix a typo in email template main content
othercore: compile backend translations
featureproviders/saml: initial SLO implementation
otherweb: bump API Client version
featureproviders/proxy: add tests for proxy basic auth
otherweb: bump @babel/core from 7.20.7 to 7.20.12 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022121.4 to 3.2022121.5
otherweb: bump @sentry/tracing from 7.28.1 to 7.29.0 in /web
otherweb: bump @sentry/browser from 7.28.1 to 7.29.0 in /web
otherweb: bump pyright from 1.1.286 to 1.1.287 in /web
breakingpolices/hibp: remove deprecated
featurestages/user_write: add more user creation options
featureadd code support for ldap provider
featureblueprints: Add !Enumerate, !Value and !Index tags
othercore: bump goauthentik.io/api/v3 from 3.2022121.5 to 3.2022122.3
otherci: bump actions/setup-node from 3.5.1 to 3.6.0
otherweb: bump chart.js from 4.1.1 to 4.1.2 in /web
fixblueprints: Fix resolve model_name in !Find tag
othercore: bump coverage from 7.0.3 to 7.0.4
othercore: bump packaging from 22.0 to 23.0
otherweb: bump prettier from 2.8.1 to 2.8.2 in /web
otherwebsite: bump postcss from 8.4.20 to 8.4.21 in /website
otherwebsite: bump prettier from 2.8.1 to 2.8.2 in /website
otherweb: bump @rollup/plugin-typescript from 10.0.1 to 11.0.0 in /web
othercore: bump pylint from 2.15.9 to 2.15.10
otherweb: bump @typescript-eslint/parser from 5.48.0 to 5.48.1 in /web
otherweb: bump lit from 2.5.0 to 2.6.0 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.48.0 to 5.48.1 in /web
otherblueprints: internal storage
featureweb/admin: rework admin dashboard, add more links, remove user and group graphs
othercore: bump coverage from 7.0.4 to 7.0.5
othercore: bump goauthentik.io/api/v3 from 3.2022122.3 to 3.2022122.4
othercore: bump golang from 1.19.4-bullseye to 1.19.5-bullseye
otherweb: bump @sentry/browser from 7.29.0 to 7.30.0 in /web
otherevents: rework metrics
otherweb: migrate checkbox to switch
otherweb: bump lit from 2.6.0 to 2.6.1 in /web
otherweb: bump eslint-plugin-lit from 1.7.2 to 1.8.0 in /web
othercore: bump twilio from 7.16.0 to 7.16.1
othercore: bump goauthentik.io/api/v3 from 3.2022122.4 to 3.2022122.5
featureproviders/proxy: add initial header token auth
featureproviders/proxy: add setting to intercept authorization header
+29 more items in the release notessecurityFixes CVE-2023-26481: Insufficient user check in FlowTokens by Email stage
otherweb: bump API Client version
othercore: bump importlib-metadata from 5.2.0 to 6.0.0
othercore: bump watchdog from 2.2.0 to 2.2.1
othercore: bump goauthentik.io/api/v3 from 3.2022120.3 to 3.2022121.4
othercore: bump github.com/jellydator/ttlcache/v3 from 3.0.0 to 3.0.1
otherweb: bump eslint from 8.30.0 to 8.31.0 in /web
otherweb: bump @types/codemirror from 5.60.5 to 5.60.6 in /web
otherweb: bump yaml from 2.2.0 to 2.2.1 in /web
othercore: bump django from 4.1.4 to 4.1.5
featureweb/admin: add Radio control, search-select fixes
otherweb/admin: migrate api calls to async
othercore: bump coverage from 7.0.1 to 7.0.2
otherweb: bump @typescript-eslint/parser from 5.47.1 to 5.48.0 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.47.1 to 5.48.0 in /web
otherweb: bump @squoosh/cli from 0.7.2 to 0.7.3 in /web
othercore: bump coverage from 7.0.2 to 7.0.3
otherweb: bump eslint-plugin-custom-elements from 0.0.6 to 0.0.7 in /web
featureproviders/saml: add prefix to entity descriptor
otherweb: bump API Client version
otherweb: bump pyright from 1.1.285 to 1.1.286 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022114.2 to 3.2022120.2
otherwebsite: bump json5 from 2.2.1 to 2.2.2 in /website
otherweb: bump json5 from 2.2.1 to 2.2.2 in /web
otherblueprints: Resolve yamltags in state and model attributes
othercore: bump goauthentik.io/api/v3 from 3.2022120.2 to 3.2022120.3
otherblueprints: watch blueprints directory and trigger tasks
othercore: bump packaging from 21.3 to 22.0
othercore: bump sentry-sdk from 1.11.0 to 1.11.1
otherweb: bump @sentry/browser from 7.20.1 to 7.21.0 in /web
otherweb: bump chart.js from 3.9.1 to 4.0.1 in /web
otherweb: bump @patternfly/patternfly from 4.219.2 to 4.221.2 in /web
otherweb: bump @sentry/tracing from 7.20.1 to 7.21.0 in /web
otherweb: bump API Client version
othercore: bump urllib3 from 1.26.12 to 1.26.13
othercore: bump goauthentik.io/api/v3 from 3.2022110.1 to 3.2022111.1
otherweb: bump @sentry/browser from 7.21.0 to 7.21.1 in /web
otherweb: bump pyright from 1.1.280 to 1.1.281 in /web
otherwebsite: bump prettier from 2.7.1 to 2.8.0 in /website
otherweb: bump @types/mermaid from 9.1.0 to 9.2.0 in /web
otherweb: bump prettier from 2.7.1 to 2.8.0 in /web
otherweb: bump @sentry/tracing from 7.21.0 to 7.21.1 in /web
otherproviders/ldap: updates documentation related to issue #4038
othercore: bump structlog from 22.1.0 to 22.3.0
othercore: bump importlib-metadata from 5.0.0 to 5.1.0
otherweb: bump @trivago/prettier-plugin-sort-imports from 3.4.0 to 4.0.0 in /web
otherweb: bump @codemirror/legacy-modes from 6.3.0 to 6.3.1 in /web
fixFix: Using the same http transport as the api
othercore: bump selenium from 4.6.0 to 4.6.1
othercore: bump pycryptodome from 3.15.0 to 3.16.0
otherweb: bump @rollup/plugin-commonjs from 23.0.2 to 23.0.3 in /web
otherweb: bump @rollup/plugin-typescript from 9.0.2 to 10.0.0 in /web
otherweb: bump @rollup/plugin-babel from 6.0.2 to 6.0.3 in /web
otherChange Kubernetes ingress apiVersion out of beta
featureAlways add generic message to failing zxcvbn password policy
fixweb: fix authentification with Plex on iOS
securitysecurity: fix CVE 2022 46145
fixFixed bug causing filtering with an empty query
fixFix typo in ldap source documentation
featureAdd docs for Skyhigh
fixwebsite/docs: fix typo
featurefeat(docs/nextcloud): Updated docs
featureproviders: add preview for mappings
featureblueprints: Added conditional entry application
securitysecurity: fix CVE 2022 46172
securitysecurity: fix CVE 2022 23555
featurewebsite/integrations: add hcp docs
featureBlueprints: Added !If tag
+101 more items in the release notessecurityFixes CVE-2022-23555: Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow
securityFixes CVE-2022-46172: Existing Authenticated Users can Create Arbitrary Accounts
securityFixes CVE-2022-46145: Unauthorized user creation and potential account takeover
otherweb: bump API Client version
othercore: bump goauthentik.io/api/v3 from 3.2022101.8 to 3.2022110.1
otherweb: bump @sentry/tracing from 7.20.0 to 7.20.1 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.43.0 to 5.44.0 in /web
otherweb: bump chartjs-adapter-moment from 1.0.0 to 1.0.1 in /web
fixFix installations link in footer
otherweb: bump @typescript-eslint/parser from 5.43.0 to 5.44.0 in /web
otherweb: bump @sentry/browser from 7.20.0 to 7.20.1 in /web
featureblueprints: add state attribute to delete objects
otherweb: bump API Client version
othercore: bump django-silk from 5.0.1 to 5.0.2
othercore: bump goauthentik.io/api/v3 from 3.2022100.1 to 3.2022101.1
otherwebsite: bump @docusaurus/plugin-client-redirects from 2.1.0 to 2.2.0 in /website
otherweb: bump @sentry/tracing from 7.17.1 to 7.17.2 in /web
otherwebsite: bump @docusaurus/preset-classic from 2.1.0 to 2.2.0 in /website
othercore: bump twilio from 7.15.0 to 7.15.1
othercore: bump twisted from 22.8.0 to 22.10.0
otherweb: bump @typescript-eslint/parser from 5.41.0 to 5.42.0 in /web
otherweb: bump @sentry/tracing from 7.17.2 to 7.17.3 in /web
otherweb: bump tslib from 2.4.0 to 2.4.1 in /web
otherweb: bump @sentry/browser from 7.17.2 to 7.17.3 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.41.0 to 5.42.0 in /web
othercore: bump django from 4.1.2 to 4.1.3
otherweb: bump mermaid from 9.1.7 to 9.2.0 in /web
othercore: bump golang from 1.19.2-bullseye to 1.19.3-bullseye
othercore: bump swagger-spec-validator from 3.0.2 to 3.0.3
otherweb: bump @patternfly/patternfly from 4.217.1 to 4.219.2 in /web
otherweb: bump pyright from 1.1.277 to 1.1.278 in /web
othercore: bump github.com/prometheus/client_golang from 1.13.0 to 1.13.1
othercore: bump docker from 6.0.0 to 6.0.1
fixdev-docs: Fix incorrect command for web-build
otherweb: bump @sentry/browser from 7.17.3 to 7.17.4 in /web
otherweb: bump @sentry/tracing from 7.17.3 to 7.17.4 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022101.1 to 3.2022101.2
otherweb: bump lit from 2.4.0 to 2.4.1 in /web
otherUpdated translation website URL
othercore: bump paramiko from 2.11.0 to 2.12.0
otherweb: bump @babel/core from 7.19.6 to 7.20.2 in /web
otherweb: bump eslint from 8.26.0 to 8.27.0 in /web
otherweb: bump @babel/preset-env from 7.19.4 to 7.20.2 in /web
othercore: bump selenium from 4.5.0 to 4.6.0
otherweb: bump @babel/plugin-proposal-decorators from 7.20.0 to 7.20.2 in /web
otherweb: Bump @typescript-eslint/eslint-plugin from 5.42.0 to 5.42.1 in /web
otherweb: Bump @lingui/macro from 3.14.0 to 3.15.0 in /web
otherwebsite: Bump loader-utils from 2.0.2 to 2.0.3 in /website
fixFixed bug causing blueprint instance context be discarded
fixFix small error in Invitation stage docs
featurepolicies/password: merge hibp add zxcvbn
featuresources: add custom icon support
+47 more items in the release notessecurityFixes CVE-2022-23555: Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow
securityFixes CVE-2022-46172: Existing Authenticated Users can Create Arbitrary Accounts
securityFixes CVE-2022-46145: Unauthorized user creation and potential account takeover
otherweb: bump API Client version
othercore: bump pylint from 2.15.4 to 2.15.5
othercore: bump github.com/stretchr/testify from 1.8.0 to 1.8.1
othercore: bump duo-client from 4.4.0 to 4.5.0
othercore: bump sentry-sdk from 1.10.0 to 1.10.1
otherweb: bump @rollup/plugin-babel from 6.0.0 to 6.0.2 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022090.10 to 3.2022100.1
otherweb: bump eslint from 8.25.0 to 8.26.0 in /web
otherweb: bump @rollup/plugin-replace from 5.0.0 to 5.0.1 in /web
otherweb: bump @rollup/plugin-commonjs from 23.0.1 to 23.0.2 in /web
otherweb: bump @rollup/plugin-typescript from 9.0.1 to 9.0.2 in /web
otherweb: bump @rollup/plugin-node-resolve from 15.0.0 to 15.0.1 in /web
othercore: bump colorama from 0.4.5 to 0.4.6
otherweb: bump @codemirror/lang-xml from 6.0.0 to 6.0.1 in /web
otherweb: bump @codemirror/lang-html from 6.1.2 to 6.1.3 in /web
otherweb: bump @codemirror/legacy-modes from 6.1.0 to 6.2.0 in /web
otherweb: bump @typescript-eslint/parser from 5.40.1 to 5.41.0 in /web
otherweb: bump @codemirror/lang-javascript from 6.1.0 to 6.1.1 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.40.1 to 5.41.0 in /web
otherweb: bump @codemirror/lang-python from 6.0.3 to 6.0.4 in /web
featureAdd TrueCommand integration
othercore: bump pytest from 7.1.3 to 7.2.0
othercore: bump psycopg2-binary from 2.9.4 to 2.9.5
othercore: bump deepmerge from 1.0.1 to 1.1.0
otherweb: bump pyright from 1.1.276 to 1.1.277 in /web
othercore: bump kubernetes from 24.2.0 to 25.3.0
otherweb: bump @sentry/tracing from 7.16.0 to 7.17.1 in /web
otherweb: bump @babel/plugin-proposal-decorators from 7.19.6 to 7.20.0 in /web
otherweb: bump @sentry/browser from 7.16.0 to 7.17.2 in /web
othercore: explicitly enable locales
otherweb: bump API Client version
fixFix typo
otherweb: bump eslint from 8.23.1 to 8.24.0 in /web
otherci: bump helm/kind-action from 1.3.0 to 1.4.0
othercore: bump goauthentik.io/api/v3 from 3.2022082.6 to 3.2022090.1
othercore: bump sentry-sdk from 1.9.8 to 1.9.9
otherDocs: Fix letsencrypt folder
otherTranslate '/web/src/locales/en.po' in 'zh-Hans' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'ko_KR' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'zh_TW' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'tr' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'de' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'pt_PT' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'pl_PL' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'zh-Hant' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'ru_RU' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'zh_TW' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'pl_PL' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'zh_CN' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'tr' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'pl' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'fr' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'fr_FR' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'es' [manual sync]
otherTranslate '/web/src/locales/en.po' in 'de' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'zh-Hant' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'zh_CN' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'pl' [manual sync]
otherTranslate '/locale/en/LC_MESSAGES/django.po' in 'es' [manual sync]
featurewebsite/integrations: added jellyfin integration
featurewebsite/integrations: added snipe-it integration
featurewebsite/docs: Add ArgoCD documentation
featureAdd Documentation: QNAP NAS connect to authentik LDAP
featuresources/oauth: add Twitch OAuth source
featureproviders/oauth2: add device flow
featureAdd setting to adjust database config for pgbouncer
featurewebsite/integrations: add missing step to create mappings
featureAdded General Setup instructions for LDAP Provider
fixproviders/oauth2: fix issues with es256 and add tests
featureadmin: add authorisations metric
+100 more items in the release notesotherweb: bump API Client version
othercore: bump goauthentik.io/api/v3 from 3.2022081.1 to 3.2022082.1
othercore: bump xmlsec from 1.3.12 to 1.3.13
othercore: bump urllib3 from 1.26.11 to 1.26.12
otherweb: bump @typescript-eslint/parser from 5.33.1 to 5.34.0 in /web
otherweb: bump rollup-plugin-cssimport from 1.0.2 to 1.0.3 in /web
otherweb: bump @babel/core from 7.18.10 to 7.18.13 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.33.1 to 5.34.0 in /web
otherweb: bump rollup from 2.78.0 to 2.78.1 in /web
othercore: bump ua-parser from 0.15.0 to 0.16.0
otherweb: bump @formatjs/intl-listformat from 7.0.3 to 7.1.1 in /web
othercore: bump wsproto from 1.1.0 to 1.2.0
otherweb: bump @rollup/plugin-typescript from 8.3.4 to 8.4.0 in /web
othercore: bump uvicorn from 0.18.2 to 0.18.3
othercore: bump twilio from 7.12.1 to 7.13.0
otherweb: bump @typescript-eslint/parser from 5.34.0 to 5.35.1 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.34.0 to 5.35.1 in /web
otherweb: bump typescript from 4.7.4 to 4.8.2 in /web
othercore: bump ua-parser from 0.16.0 to 0.16.1
othercore: bump pylint from 2.14.5 to 2.15.0
otherweb: bump @formatjs/intl-listformat from 7.1.1 to 7.1.2 in /web
otherweb: bump eslint from 8.22.0 to 8.23.0 in /web
other(doc): Adding mention of custom JWT Claims
featurewebsite/docs: Added mention of how to force 2fa
fixProposal and fix for issue #3359 and #3415 authentik redirect to wrong internal port
featureblueprints: add meta model to apply blueprint within blueprint for dependencies
otherweb: bump @typescript-eslint/eslint-plugin from 5.35.1 to 5.36.0 in /web
otherweb: bump @typescript-eslint/parser from 5.35.1 to 5.36.0 in /web
otherblueprints: OCI registry support
otherwebsite/docs: improve nginx examples
othercore: bump requests-mock from 1.9.3 to 1.10.0
otherweb: bump @fortawesome/fontawesome-free from 6.1.2 to 6.2.0 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.36.0 to 5.36.1 in /web
featureproviders/oauth2: add x5c
featurewebsite/integrations: Add Gitea Helm Chart Configuration
fixstages/user_write: Fixed typo
fixWebsite: Fix padding in feature comparison table
fixoutposts: fix oauth state when using signature routing
fixweb: fix scrolling in modals in low-height views
fixoutposts/proxy: fix redirect path when external host is a subdirectory
+74 more items in the release notesotherdocs(vikunja): fix config typo
otherweb: bump API Client version
othercore: bump sentry-sdk from 1.9.4 to 1.9.5
othercore: bump coverage from 6.4.3 to 6.4.4
otherweb: bump @patternfly/patternfly from 4.202.1 to 4.206.3 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022073.8 to 3.2022081.1
featureblueprints: add generic export next to flow exporter
featureblueprints: allow for adding remote blueprints
featurewebsite/docs: New VCS section and GitHub integrations
featurewebsite/docs: add note for which outpost configs apply for which outposts
otherdocs: Oracle Cloud title case
othercore: bump docker from 5.0.3 to 6.0.0
otherweb: bump @sentry/tracing from 7.10.0 to 7.11.1 in /web
otherweb: bump lit from 2.3.0 to 2.3.1 in /web
otherweb: bump @sentry/browser from 7.10.0 to 7.11.1 in /web
othercore: bump selenium from 4.4.1 to 4.4.3
othercore: bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0
otherweb: bump terser from 5.7.1 to 5.14.2 in /web
otherwebsite: bump terser from 5.10.0 to 5.14.2 in /website
otherweb: Update Web API Client version
othercore: bump goauthentik.io/api/v3 from 3.2022072.1 to 3.2022073.1
othercore: bump sentry-sdk from 1.7.2 to 1.8.0
otherweb: bump @codemirror/lang-python from 6.0.0 to 6.0.1 in /web
otherweb: bump lit from 2.2.7 to 2.2.8 in /web
otherweb: bump @codemirror/lang-javascript from 6.0.1 to 6.0.2 in /web
othercore: bump structlog from 21.5.0 to 22.1.0
otherweb: bump chart.js from 3.8.0 to 3.8.2 in /web
othercore: bump urllib3 from 1.26.9 to 1.26.11
otherweb: bump @typescript-eslint/parser from 5.30.7 to 5.31.0 in /web
otherweb: bump @fortawesome/fontawesome-free from 6.1.1 to 6.1.2 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.30.7 to 5.31.0 in /web
otherweb: bump rollup from 2.77.0 to 2.77.1 in /web
othercore: bump github.com/go-ldap/ldap/v3 from 3.4.3 to 3.4.4
othercore: bump drf-spectacular from 0.22.1 to 0.23.1
otherweb: bump @sentry/browser from 7.7.0 to 7.8.0 in /web
otherweb: bump rollup from 2.77.1 to 2.77.2 in /web
otherweb: bump @rollup/plugin-typescript from 8.3.3 to 8.3.4 in /web
otherweb: bump @sentry/tracing from 7.7.0 to 7.8.0 in /web
othercore: bump goauthentik.io/api/v3 from 3.2022073.1 to 3.2022073.2
featureproviders/proxy: add caddy endpoint
featureFeat: use mailcow full_name as username for mailcow source
otherproviders/proxy: no exposed urls
othercomment on PR with instructions on how to use branch
otheroptimise container lifecycle and process signals
otherflows: migrate flows to be yaml
otherBlueprints v1
fixflows/stages/consent: fix for post requests
othercore: bump goauthentik.io/api/v3 from 3.2022073.2 to 3.2022073.4
otherblueprints: migrate from managed
othercore: bump goauthentik.io/api/v3 from 3.2022073.4 to 3.2022073.5
otherweb: bump @babel/plugin-proposal-decorators from 7.18.9 to 7.18.10 in /web
otherweb: bump @typescript-eslint/eslint-plugin from 5.31.0 to 5.32.0 in /web
othercore: bump golang from 1.18.4-bullseye to 1.18.5-bullseye
otherweb: bump @sentry/tracing from 7.8.0 to 7.8.1 in /web
otherweb: bump @babel/core from 7.18.9 to 7.18.10 in /web
otherweb: bump @typescript-eslint/parser from 5.31.0 to 5.32.0 in /web
+40 more items in the release notes