authentik 2025.8.2 → 2026.5.8
32 releases · 33 breaking changes · 67 security fixes · 20 advisories fixed
67security33breaking6deprecated141feature229fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-hmrg-vpp4-gj88 Broken access control in Shared Signals Framework stream management
- 8.8 CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
- 8.7 CVE-2026-57580 Account Takeover via SAML NameID Comment Truncation
- 8.6 CVE-2026-54730 Google Chrome device trust stages can be bypassed
- 5.3 CVE-2026-55106 LDAP Source debug endpoint accessible without authorization
- 8.8 CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- 9.8 CVE-2026-49448 SourceStage bypass via empty POST
- 8.5 CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- 9.1 CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- 8.6 CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
- 8.8 CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
- 5.8 CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
- 4.8 CVE-2025-64521 Deactivated service account can authenticate to OAuth
Breaking changes
- breaking website/docs: 2026.5: remove preview tag from mtls stage doc in 2026.5.5
- breaking packages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5) in 2026.5.4
- breaking website/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5) in 2026.5.4
- breaking website/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5) in 2026.5.4
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5) in 2026.5.4
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.5) in 2026.5.0
- breaking website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) in 2026.5.0
- breaking flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) in 2026.5.0
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
- breaking website/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2) in 2026.2.2
- breaking endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) in 2026.2.2
- breaking providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) in 2026.2.2
- breaking events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) in 2026.2.2
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2) in 2026.2.1
- breaking core: remove superuser check from Token list in 2026.2.0
- breaking website/docs: 2025.12: remove superfluous changes in 2026.2.0
- breaking stages: remove more global state in 2026.2.0
- breaking website/docs: remove duplicates in slo docs in 2026.2.0
- breaking website/docs: remove "beta" tag from 2025.12 in 2026.2.0
- breaking core: remove session migration in 2026.2.0
- breaking web/elements: remove pfbase everywhere in 2026.2.0
- breaking website/docs: Remove stale 2024 version directives in 2026.2.0
- breaking website/docs: remove redundant RC notice in 2026.2.0
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) in 2025.12.5
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12) in 2025.12.3
- breaking website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) in 2025.12.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) in 2025.10.4
- breaking website/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10) in 2025.10.2
- breaking cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) in 2025.10.2
- breaking outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) in 2025.10.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8) in 2025.8.6
Security changes
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 in 2026.5.5
- security website/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5) in 2026.5.4
- security root: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5) in 2026.5.4
- security website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) in 2026.5.3
- security root: update security release versions (cherry-pick #22583 to version-2026.5) in 2026.5.2
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5 in 2026.5.2
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) in 2026.5.0
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
- security security: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2) in 2026.2.2
- security security: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2) in 2026.2.2
- security core: Update supported versions in SECURITY.md in 2026.2.0
- security security: CVE-2026-25922 (2026.2) in 2026.2.0
- security security: CVE-2026-25748 (2026.2) in 2026.2.0
- security security: CVE-2026-25227 (2026.2) in 2026.2.0
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) in 2025.12.6
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 in 2025.12.6
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 in 2025.12.5
- security security: CVE-2026-25922 (2025.12) in 2025.12.4
- security security: CVE-2026-25748 (2025.12) in 2025.12.4
- security security: CVE-2026-25227 (2025.12) in 2025.12.4
- security core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) in 2025.12.2
- security security: CVE-2026-25922 (2025.10) in 2025.10.4
- security security: CVE-2026-25748 (2025.10) in 2025.10.4
- security security: CVE-2026-25227 (2025.10) in 2025.10.4
- security security: CVE-2026-25922 (2025.8) in 2025.8.6
- security security: CVE-2026-25748 (2025.8) in 2025.8.6
- security security: CVE-2026-25227 (2025.8) in 2025.8.6
Deprecations
- deprecated website/docs: deprecate GCDT auth stage in 2026.2.0
- deprecated web/startup: deprecated theme names break theming in 2026.2.0
- deprecated core: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2) in 2026.2.0
- deprecated web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) in 2025.12.1
- deprecated website/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12) in 2025.12.0
- deprecated internal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10) in 2025.10.1
Every release in between
otherci: remove the Google Chrome apt source in setup (cherry-pick #25990 to version-2026.5)
fixlib/expression: fix PickleError due to resolver match when using ak_call_policy (cherry-pick #25763 to version-2026.5)
fixweb/source/flows: fix flicker after webauthn (cherry-pick #25454 to version-2026.5)
othercore: bump rustls (cherry-pick #26142 to version-2026.5)
featurewebsite: add umami (cherry-pick #26460 to version-2026.5)
otherpackages/django-channels-postgres: refresh pool credentials on connection attempts (cherry-pick #26505 to version-2026.5)
otherweb/flows: check if localStorage is available for continuous login (cherry-pick #26267 to version-2026.5)
otherroot: don't fail websocket connections with non-UTF-8 headers (cherry-pick #26688 to version-2026.5)
fixstages/consent: fix integrity error when re-consenting after consent expired (cherry-pick #26866 to version-2026.5)
otherci: switch version bump to action, like platform repo (cherry-pick #26949 to version-2026.5)
otherroot: bump cert-related deps due to emudhra (cherry-pick #27068 to version-2026.5)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5)
fixenterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5)
fixbrands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5)
othercore: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container
otherproviders/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5)
othercore: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5)
fixfix pipeline for version 2026.5
otherendpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5)
fixendpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5)
featurewebsite/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5)
otherwebsite/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5)
otherpackages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5)
fixcore: fix group source connection source object (cherry-pick #24626 to version-2026.5)
otherroot: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5)
featurewebsite/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5)
featurewebsite/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5)
fixblueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5)
featureblueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5)
fixproviders/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5)
fixweb/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5)
fixproviders/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5)
fixendpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5)
featurecore: add user type-active-username index (cherry-pick #25223 to version-2026.5)
featurecore: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5)
fixlib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5)
fixworker: fix healthcheck paths (cherry-pick #24481 to version-2026.5)
fixtenants/settings: fix flags response (cherry-pick #25616 to version-2026.5)
fixweb/admin: fix schedule form (cherry-pick #25778 to version-2026.5)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5
fixlifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5)
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5
featurewebsite/docs: add release notes for 2026.2.7 (cherry-pick #25979 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.7 (cherry-pick #25980 to version-2026.5)
+21 more items in the release notesotherweb/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5)
otherenterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.5)
otherwebsite/docs: cleanup 07-12: refresh contributor guidance (cherry-pick #23969 to version-2026.5)
otherinternal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5)
fixstages/captcha: fix hcaptcha height (#20901)
featureproviders/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5)
fixproviders/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5)
fixproviders/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5)
fixroot: fix make gen-diff command (cherry-pick #22548 to version-2026.5)
othercore: bump pyjwt from 2.11.0 to 2.13.0 (cherry-pick #22562 to version-2026.5)
othercore: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5)
fixweb/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5)
fixroot: fix make gen-changelog (cherry-pick #24122 to version-2026.5)
otherroot: in-process per-IP rate throttle (#23015)
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5)
otherendpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5)
fixweb: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5)
featureweb/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5)
fixweb: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5)
fixstages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5)
fixwebsite/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5)
otherproviders/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5)
breakingwebsite/docs: 2026.5: remove preview tag from mtls stage doc
featureapi/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5)
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.5
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5)
otherwebsite/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5)
featurewebsite/integrations: dokuwiki: add post logout and logout urls (cherry-pick #22984 to version-2026.5)
otherwebsite/docs: additional scim provider docs (cherry-pick #22135 to version-2026.5)
otherroot: bump pyo3 (cherry-pick #23036 to version-2026.5)
securitywebsite/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5)
fixweb: Fix user list default paths. (cherry-pick #23062 to version-2026.5)
fixweb/i18n: Fix stale flow locale, unsynchronized locale selector options (cherry-pick #23007 to version-2026.5)
fixweb: Fix stale clipboard tokens, untranslated labels (cherry-pick #23063 to version-2026.5)
featurewebsite/docs: add Splunk event forwarding docs (cherry-pick #22938 to version-2026.5)
fixcore: fix Invitation Emails Ignoring Selected Template (cherry-pick #23122 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: purge at start of loop to ensure it runs (cherry-pick #23185 to version-2026.5)
fixweb/stages/identification: Fix passkey autofill dropdown not showing on the identification stage (cherry-pick #23187 to version-2026.5)
fixwebsite/docs: fix broken custom email template example (cherry-pick #23191 to version-2026.5)
breakingpackages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5)
otherwebsite: migrate brand assets to pkg (cherry-pick #22336 to version-2026.5)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.5)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.5)
otherwebsite/docs: improve email authenticator docs (cherry-pick #23226 to version-2026.5)
breakingwebsite/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5)
otherwebsite/docs: clarify user and group filtering on scim provider (cherry-pick #22502 to version-2026.5)
securityroot: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5)
breakingwebsite/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5)
othercore: bump goauthentik/fips-debian and fips-python in /lifecycle/container (cherry-pick #23362 to version-2026.5)
fixwebsite/docs: fix 2026.5 release notes mentioning docker-compose.yml (cherry-pick #23385 to version-2026.5)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.5)
featurewebsite/docs: Add improved akql docs (cherry-pick #22693 to version-2026.5)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.5)
fixweb/admin: fix spacing issues in wizard (cherry-pick #23484 to version-2026.5)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.5)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.5)
otherpackages/django-postgres-cache: avoid regex queries when listing keys if possible (cherry-pick #23160 to version-2026.5)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.5)
othersources/ldap: avoid re-creating connections to LDAP server (cherry-pick #23520 to version-2026.5)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.5)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.5)
featurewebsite/docs: add expression policy example for welcome emails on user creation (cherry-pick #23486 to version-2026.5)
featuretasks: add pre_delete for TasksModel to avoid OOM when deleting object with many tasks linked (cherry-pick #23664 to version-2026.5)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.5)
fixweb: Fix outline selector, lack of outline on focused checkboxes. (cherry-pick #23260 to version-2026.5)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.5)
+17 more items in the release notesotherwebsite/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5)
otherwebsite/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5)
fixenterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5)
securitywebsite/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5)
featurewebsite/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5)
otherwebsite/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5)
otherwebsite/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5)
fixwebsite: fix package-lock.json (version-2026.5)
otherweb/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5)
otherproviders/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5)
fixwebsite/docs: Fix release notes cards (cherry-pick #22554 to version-2026.5)
securityroot: update security release versions (cherry-pick #22583 to version-2026.5)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5)
otherwebsite/docs: Bump package-lock
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.5)
fixevents: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5)
fixpackages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5)
fixpackages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5)
fixproviders/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5)
fixenterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
featurewebsite/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
featureenterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5)
fixwebsite/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5)
otherwebsite/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
fixwebsite/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5)
featurewebsite/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5)
otherwebsite/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5)
featureproviders/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5)
breakingflows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5)
featurewebsite: Docs and README new screenshots (cherry-pick #22341 to version-2026.5)
otherweb, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5)
otherweb/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5)
otherwebsite/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5)
otherproviders/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5)
featurewebsite/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5)
featurewebsite/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5)
fixroot: fix gitignore binary paths (cherry-pick #22445 to version-2026.5)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5)
otherwebsite/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5)
featurewebsite/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5)
otherproviders/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5)
fixevents: fix certificate typo (cherry-pick #22542 to version-2026.5)
otherwebsite/release: Release notes updates (cherry-pick #22543 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)
otherci: fix reason change in versions repo bump (cherry-pick #20696 to version-2026.2)
otherweb/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2)
otherweb/flows: continuous login (cherry-pick #19862 to version-2026.2)
othercore: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2026.2)
otherlifecycle: make gunicorn --max-requests configurable (cherry-pick #20736 to version-2026.2)
otherpackages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2)
breakingwebsite/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2)
otherwebsite: override DocSearch button colors in light mode (cherry-pick #20770 to version-2026.2)
fixproviders/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2)
otherproviders/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2)
otherweb/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2)
breakingendpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2)
otherwebsite/docs: update agent docs (cherry-pick #20782 to version-2026.2)
breakingproviders/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2)
featurelifecycle/migrate: add flag to skip migrations (cherry-pick #20863 to version-2026.2)
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2)
fixwebsite/docs: fix notification transport etc (cherry-pick #20982 to version-2026.2)
fixwebsite/docs: fix swapped sidebar label (cherry-pick #21011 to version-2026.2)
fixsources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2)
featureenterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2)
breakingevents: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2)
featurewebsite/docs: add missing dependencies for linux dev environment (cherry-pick #21020 to version-2026.2)
featureproviders/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2)
fixendpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2)
featureweb/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2)
featuresources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2)
featurewebsite/docs: ad source: add note about ldap signing (cherry-pick #21274 to version-2026.2)
fixcore: fix provider not nullable (cherry-pick #21275 to version-2026.2)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2026.2)
featurewebsite/docs: entra scim: add note about validator (cherry-pick #21273 to version-2026.2)
securitysecurity: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2026.2)
fixinternal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2)
fixwebsite/docs: fix merge conflict
securitysecurity: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2)
featuretasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2)
+24 more items in the release notesotherwebsite/docs: update supported versions (cherry-pick #20534 to version-2026.2)
fixwebsite/docs: fix upgrade link in 2026.2 release notes (cherry-pick #20539 to version-2026.2)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2)
otherwebsite/docs: revamp enterprise section (cherry-pick #20379 to version-2026.2)
otherdocs: fix typos and wording in docs and integrations (cherry-pick #20550 to version-2026.2)
otherci: add reason change to versions repo bump (cherry-pick #20562 to version-2026.2)
otherinternal: make http timeouts configurable (cherry-pick #20472 to version-2026.2)
otherpackages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2)
fixweb/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2)
fixcrypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2)
featuresources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2)
fixpackages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2)
fixenterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2)
featurewebsite/docs: entra id provider: add custom email domain info (cherry-pick #20444 to version-2026.2)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2026.2)
fixcore: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2)
otherpackages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2)
otheroutpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2)
featurewebsite/docs: add 2025 pentest (cherry-pick #20626 to version-2026.2)
fixweb: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2)
otherproviders/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.1 (cherry-pick #20659 to version-2026.2)
featureroot: Add macOS support for sed in Makefile
featurewebsite/docs: add icon info to style guide
breakingcore: remove superuser check from Token list
featureadmin/files: revert add check for /media existence (#18636)
featurewebsite/docs: add jellyseer integration doc
featurecore: add skip s3_test_server_available to TestResolveFileUrlS3Backend
featurewebsite/docs: Add docs for passkey autofill (WebauthN Conditional UI)
featureweb: add custom message with links for empty data export list
featureweb/admin: endpoint: change wording and add helper text
featurewebsite/docs: added list of Int Guide contributors (also edited frontmatter)
breakingwebsite/docs: 2025.12: remove superfluous changes
featureweb/admin: add UI copy to RBAC modal
breakingstages: remove more global state
featurewebsite/integrations: Add launch URL for Immich
featurewebsite/docs: release notes: add endpoint device links to 2025.12 notes
featurewebsite/docs: add note to active directory source doc
featureblueprints: add InternallyManagedMixin instead of large list
featureenterprise/search: add static autocomplete structure
featurewebsite/integrations: Add Wallos
featuretests/e2e: add endpoint tests
featurewebsite/docs: rel notes .12: add wallos
featurewebsite/docs: endpoint devices: add path to macos setup
featurewebsite/integrations: Add Pulse
featurewebsite/integrations: Add Audiobookshelf
featurewebsite/docs: release notes: Add more integrations
featurewebsite/integrations: vaultwarden: add custom email scope
featureweb/admin: adjust sync threshold, add tooltip
breakingwebsite/docs: remove duplicates in slo docs
deprecatedwebsite/docs: deprecate GCDT auth stage
securitycore: Update supported versions in SECURITY.md
breakingwebsite/docs: remove "beta" tag from 2025.12
breakingcore: remove session migration
deprecatedweb/startup: deprecated theme names break theming
breakingweb/elements: remove pfbase everywhere
breakingwebsite/docs: Remove stale 2024 version directives
breakingwebsite/docs: remove redundant RC notice
securitysecurity: CVE-2026-25922 (2026.2)
securitysecurity: CVE-2026-25748 (2026.2)
securitysecurity: CVE-2026-25227 (2026.2)
deprecatedcore: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2)
+722 more items in the release notessecuritywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12)
otherci: fix docs not having correct js version setup (2025.12)
fixtenants: fix test teardown (version-2025.12)
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12
otherwebsite/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12)
otherwebsite/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12)
otherwebsite/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12)
otherci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12)
featurewebsite/docs: add okta source doc (cherry-pick #20296 to version-2025.12)
otherroot: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12)
otherci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12)
otherwebsite/docs: Custom CSS (cherry-pick #19991 to version-2025.12)
fixweb: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12)
othersources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12)
fixwebsite/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12)
otherci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12)
otherwebsite/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12)
fixwebsite/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12)
featureenterprise: add ES384 to enterprise license algorithms (cherry-pick #20507 to version-2025.12)
fixendpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12)
fixwebsite/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12)
fixpolicies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12)
fixweb/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12)
featureweb/flows: add continuous flow 2025.12
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12)
fixweb: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12)
fixinternal: fix lint (cherry-pick #22263 to version-2025.12)
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12
+23 more items in the release notesfeaturewebsite/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12)
fixweb/admin: fix default binding order (cherry-pick #19943 to version-2025.12)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.12)
othercore: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12)
fixoutposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12)
fixwebsite/docs: fix typos (cherry-pick #20000 to version-2025.12)
otherwebsite/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12)
otherwebsite/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12)
fixwebsite/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12)
otherwebsite: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12)
otherwebsite/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12)
otheroutpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)
otherwebsite/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12)
otherwebsite/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12)
fixsources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12)
otherwebsite/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12)
securitysecurity: CVE-2026-25922 (2025.12)
securitysecurity: CVE-2026-25748 (2025.12)
securitysecurity: CVE-2026-25227 (2025.12)
otherweb: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12)
feature2025.12: Revert bulk revoke added by accident in release branch
fixweb/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12)
fixweb: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12)
otherci: always generate API clients (#19906)
otherlifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12)
featurelifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12)
otherwebsite/docs: Update location of media storage and outdated references (cherry-pick #19885 to version-2025.12)
fixcore: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12)
otherwebsite/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12)
featuresources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12)
featuretests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12)
otherwebsite/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12)
fixadmin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12)
fixadmin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12)
securitycore: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12)
featurewebsite/docs: add s3 perms (cherry-pick #19579 to version-2025.12)
otherweb: update @goauthentik/api (cherry-pick #19542 to version-2025.12)
fixweb/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12)
fixendpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12)
fixpolicies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12)
fixproviders/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12)
featureproviders/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12)
fixsources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12)
othertests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12)
otherlib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12)
otherwebsite/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12)
fixweb/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12)
fixweb/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12)
otherwebsite/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12)
otherwebsite/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.12)
fixweb/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12)
fixweb/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12)
featuresources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12)
fixwebsite/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12)
fixwebsite/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12)
fixproviders/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12)
fixsources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12)
featurewebsite/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12)
featurewebsite/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12)
featureadmin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12)
fixweb/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12)
fixweb/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12)
featurewebsite/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12)
+14 more items in the release notesbreakingwebsite/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12)
fixoutposts/ldap: fix build
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.12)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.12)
deprecatedweb/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12)
otherci: fix checkout stable (for 2025.12) (#19448)
featureproviders/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12)
othercore: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12)
otherendpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12)
featureendpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12)
otherweb: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12)
fixweb/admin: fix switches (cherry-pick #19493 to version-2025.12)
otherendpoints: include license status in agent config (cherry-pick #19227 to version-2025.12)
otherwebsite/docs: revisit endpoint docs the nth (cherry-pick #19116 to version-2025.12)
otherwebsite/glossary: improve (cherry-pick #18969 to version-2025.12)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.12)
otherstages/authenticator_static: set max token length to 100 chars (cherry-pick #19162 to version-2025.12)
fixwebsite: Fix typos. (cherry-pick #19243 to version-2025.12)
otherstages/prompt: optimize API endpoints (cherry-pick #19251 to version-2025.12)
otherstages/password: replace session-based retries with reputation (cherry-pick #18643 to version-2025.12)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.12)
othercore: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #19287 to version-2025.12)
othercore: bump django from v5.2.9 to 5.2.10 (cherry-pick #19290 to version-2025.12)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.12)
deprecatedwebsite/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.12)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.12)
featurewebsite/docs: add flow import warnings (cherry-pick #19307 to version-2025.12)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.12)
fixweb: Fix flow inspector advancement event. (cherry-pick #19309 to version-2025.12)
otherwebsite/docs: update github social login script example (cherry-pick #19246 to version-2025.12)
otherwebsite/docs: update unique email policy (cherry-pick #19305 to version-2025.12)
otherweb: Images styles, theming (cherry-pick #19233 to version-2025.12)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.12)
otherpackages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #19340 to version-2025.12)
otherweb/admin: always retrieve selected provider when editing the application (cherry-pick #19341 to version-2025.12)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.12)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.12)
otherwebsite/docs: update location for logs on windows (cherry-pick #19371 to version-2025.12)
otherinternal/outpost: improve PostgreSQL connection options parsing (cherry-pick #19118 to version-2025.12)
otherweb: Flow info, localization, back button. (cherry-pick #19234 to version-2025.12)
otherstages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #19378 to version-2025.12)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.12)
otherweb: UI Locale Fixes (cherry-pick #19235 to version-2025.12)
fixweb/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10)
featurewebsite/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10)
otherwebsite/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10)
fixweb/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10)
fixweb/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10)
othercore: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10)
otherinternal: update TLS Suite (cherry-pick #19076 to version-2025.10)
fixwebsite/docs: fix build (cherry-pick #19148 to version-2025.10)
fixweb: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.10)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.10)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.10)
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.10)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10)
othercore: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.10)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10)
othercore: bump django from v5.2.8 to 5.2.11 (version-2025.10)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10)
securitysecurity: CVE-2026-25922 (2025.10)
securitysecurity: CVE-2026-25748 (2025.10)
securitysecurity: CVE-2026-25227 (2025.10)
+4 more items in the release notesfixwebsite/docs: fix broken link in source switching doc (cherry-pick #18317 to version-2025.10)
otherwebsite/docs: further improvments to source switch doc (cherry-pick #18320 to version-2025.10)
otherwebsite/docs: enhance blueprint docs (cherry-pick #15984 to version-2025.10)
featurewebsite/docs: added missed edits on Blueprints docs (cherry-pick #18321 to version-2025.10)
featurewebsite/docs: add high availability doc (cherry-pick #18182 to version-2025.10)
otherwebsite/docs: update info about docker socket mount (cherry-pick #18344 to version-2025.10)
otheroutposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10)
featureweb/admin: add entitlement search (cherry-pick #18291 to version-2025.10)
otherlib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10)
fixweb/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10)
fixweb: Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherweb: revert Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherstages/prompt: set allow_blank for _read_only fields (cherry-pick #18297 to version-2025.10)
fixpackages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10)
otherwebsite/docs: improve creds recovery docs (cherry-pick #18385 to version-2025.10)
fixweb/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10)
otherwebsite/docs: update certificate doc (cherry-pick #18295 to version-2025.10)
otherproviders/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10)
fixweb/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10)
fixwebsite/docs: expressions: fix markdown (cherry-pick #18613 to version-2025.10)
featurewebsite/docs: adds note about ak_create_jwt function (cherry-pick #18614 to version-2025.10)
otherflows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10)
fixroot: fix missing authentik_device cookie causing error (cherry-pick #18642 to version-2025.10)
fixenterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10)
fixweb: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10)
fixweb/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10)
othersources/ldap: make server info optional (cherry-pick #18648 to version-2025.10)
fixwebsite/docs: install-config: fix dump_config command (cherry-pick #18659 to version-2025.10)
otherroot: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10)
otherweb: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10)
otherweb: Improved table selection behavior (cherry-pick #18622 to version-2025.10)
featurewebsite/docs: background tasks: add more detail about "next run" (cherry-pick #18660 to version-2025.10)
otheroutpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10)
othercore: optimize list applications (cherry-pick #18330 to version-2025.10)
othercore: list applications fix (cherry-pick #18798 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10)
featurewebsite/docs: add icon info to style guide (cherry-pick #18832 to version-2025.10)
otherwebsite/docs: 2025.10.3 release notes (cherry-pick #18868 to version-2025.10)
featurebrands: add more matching tests (cherry-pick #16185 to version-2025.10)
otherbrands: sort matched brand by match length (cherry-pick #17920 to version-2025.10)
fixtasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10)
featurewebsite/docs: added Note about email_verified scope mapping is set to false by default (cherry-pick #17942 to version-2025.10)
breakingwebsite/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10)
othercore: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10)
otherwebsite/docs: updates img-src csp (cherry-pick #18010 to version-2025.10)
otherci: fix migrate-from-stable for old versions (#18019)
fixwebsite/release notes: fix broken urls (cherry-pick #18041 to version-2025.10)
otherwebsite/docs: update discord social login script example (cherry-pick #18026 to version-2025.10)
otherci: attempt to fix integration tests using dind (cherry-pick #18066 to version-2025.10)
otherci: revert to upstream GHA for release (#18058)
fixevents: fix timezone not set for log events (cherry-pick #18067 to version-2025.10)
featureproviders/scim: allow custom schema data (cherry-pick #18073 to version-2025.10)
othercore: improve app launch URL formatting (cherry-pick #18076 to version-2025.10)
breakingcmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10)
fixweb: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10)
fixweb: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10)
fixwebsite/docs: fix wording in stages overview (cherry-pick #18061 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10)
otherweb/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10)
otherweb/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10)
fixpackages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10)
otherweb: Disable library on Firefox. (cherry-pick #18103 to version-2025.10)
otherweb/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10)
featurewebsite/docs: Add instructions for installing RC versions (cherry-pick #18099 to version-2025.10)
otherwebsite/docs: update application description (cherry-pick #18125 to version-2025.10)
fixstages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10)
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.10)
fixwebsite/docs: fix placeholder leftover (cherry-pick #17737 to version-2025.10)
featureroot: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10)
fixproviders/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10)
othersources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10)
fixproviders/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10)
otherproviders/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10)
otherpackages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10)
othertasks: delay startup signals (cherry-pick #17769 to version-2025.10)
otherroot: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10)
deprecatedinternal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10)
otherci: rework internal repo (#17797)
fixinternal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10)
fixweb/admin: fix scim provider form (cherry-pick #17831 to version-2025.10)
othercore: bump astral-sh/uv from 0.9.5 to 0.9.6 (cherry-pick #17820 to version-2025.10)
othertasks: sanitize log attributes (cherry-pick #17833 to version-2025.10)
otheroutposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10)
breakingoutpost: revert breaking signals change (cherry-pick #17847 to version-2025.10)
otherinternal: full openssl path (cherry-pick #17856 to version-2025.10)
otherweb: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10)
fixweb/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10)
fixproviders/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10)
otherproviders/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10)
fixproviders/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10)
otherwebsite/docs: 2025.10.1 release notes (cherry-pick #17918 to version-2025.10)
featureenterprise: add prometheus metrics for license usage and expiry (cherry-pick #17606 to version-2025.10)
featurewebsite/docs: rel notes 2025.10: add 3 more integration guides (cherry-pick #17641 to version-2025.10)
otherproviders/proxy: drop headers with underscores (cherry-pick #17650 to version-2025.10)
featurewebsite/docs: add note about invite link not bound (cherry-pick #17657 to version-2025.10)
featurewebsite/docs: eap add info about custom validation (cherry-pick #17642 to version-2025.10)
featurewebsite/docs: release notes: Add Zot integration (cherry-pick #17700 to version-2025.10)
featurewebsite/docs: add short-lived certificate recommendation (cherry-pick #17628 to version-2025.10)
featurewebsite/docs: blueprints: add a bit more info (cherry-pick #17704 to version-2025.10)
otherenterprise: handle cached naive timezone (cherry-pick #17695 to version-2025.10)
otherwebsite/docs: update flow context ref (cherry-pick #17723 to version-2025.10)
otherwebsite/docs: finalise 2025.10 release notes (cherry-pick #17728 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.8)
securitysecurity: CVE-2026-25922 (2025.8)
securitysecurity: CVE-2026-25748 (2025.8)
securitysecurity: CVE-2026-25227 (2025.8)
otherwebsite/docs: developer docs: adjust sentence for writing docs (cherry-pick #17137 to version-2025.8)
otherbuild(deps): bump django from 5.1.12 to 5.1.13 (cherry-pick #17198 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix task expiration (cherry-pick #17178 to version-2025.8)
fixpackages/django-dramatiq-postgres: fix error when updating task with no changes (cherry-pick #16728 to version-2025.8)
othertasks/middlewares/messages: make sure exceptions are always logged (cherry-pick #17237 to version-2025.8)
fixcore: fix absolute and relative path file uploads (cherry-pick #17269 to version-2025.8)
fixweb: Fix behavior for modals configured with closeAfterSuccessfulSubmit (cherry-pick #17277 to version-2025.8)
otherlib/sync/outgoing: revert reduce number of db queries made (revert #14177) (cherry-pick #17306 to version-2025.8)
otherblueprints: ensure tasks retry on database errors (cherry-pick #17333 to version-2025.8)
fixweb/admin: fix incorrect placeholder for scim provider (cherry-pick #17308 to version-2025.8)
featurewebsite/docs: add entra id scim source (cherry-pick #17357 to version-2025.8)
featurewebsite/docs: add email config section (cherry-pick #16727 to version-2025.8)
featurewebsite: add powershell syntax highlighting and bump package (cherry-pick #16683)
otherwebsite/docs: update SAML provider docs (cherry-pick #15887 to version-2025.8)
otherci: rework internal repo (#17797)
otherci: fix migrate-from-stable for old versions
othercore: bump Django from 5.1.13 to 5.1.14 for 2025.8
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.8
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.8)
otherwebiste/docs: improve user ref doc (cherry-pick #16779)
fixproviders/scim: fix string formatting for SCIM user filter (cherry-pick #16465)
fixwebsite/docs: 2025.8: fix worker concurrency setting rename (cherry-pick #16946)
fixwebsite/docs: fix capitalization (cherry-pick #16944)
otherwebsite/docs: random typo fixes (cherry-pick #16956)
featurewebsite/docs: add docs for source switch expression policy (cherry-pick #16878)
otherwebsite/docs: update url to docker-compose.yml (cherry-pick #16901)
otherwebsite/developer docs: What domain for what doc version (cherry-pick #16987)
featureproviders/ldap: add include_children parameter to cached search mode (cherry-pick #16918)
featurewebsite/docs: oauth provider: Add device and introspect to reserved slugs (cherry-pick #16994)
featurewebiste/docs: add missing oauth endpoints (cherry-pick #16995)
otherwebsite/docs: improve discord policies when also bound to non-oauth sources (cherry-pick #17008)
fixrbac: fix typo (cherry-pick #16476)
featurecore: add index on Group.is_superuser (cherry-pick #17011)
otherlib: match exception_to_dict locals behaviour (cherry-pick #17006)
otherwebsite/docs: Update Github expression to handle non-OAuth sources gracefully (cherry-pick #17014)
fixlib/config: fix listen settings (cherry-pick #17005)
other*/bindings: order by pk (cherry-pick #17027)
fixtasks: fix logger name (cherry-pick #17009 to version-2025.8)
fixweb/admin: fix federation sources automatically selected (cherry-pick #17069 to version-2025.8)
otherrbac: optimize rbac assigned by users query (cherry-pick #17015 to version-2025.8)
fixweb: Fix layout class for row in LibraryPage (cherry-pick #16752 to version-2025.8)
othercmd/server/healthcheck: info log success instead of debug (cherry-pick #17093 to version-2025.8)
featureoutposts/ldap: add pwdChangeTime attribute (cherry-pick #17010 to version-2025.8)
fixstages/identification: fix mismatched error messages (cherry-pick #17090 to version-2025.8)
fixproviders/oauth2: fix authentication error with identical app passwords (cherry-pick #17100 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (cherry-pick #17106 to version-2025.8)
othertasks: reduce default number of retries and max backoff (cherry-pick #17107 to version-2025.8)
otherwebsite/docs: 2025.8.4 release notes (cherry-pick #17119 to version-2025.8)
fixwebsite/docs: fix docker tabs not rendering properly (cherry-pick #16799)
fixlifecycle: fix permission error when running worker as root (cherry-pick #16735)
otherwebsite/docs: update create oauth provider page (cherry-pick #16617)
fixstages/email_authenticator: Fix email mfa loop (cherry-pick #16579)
otherwebsite/docs: 2025.8.3 release notes (cherry-pick #16809)