Release 2026.5.6

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202656

What's Changed

• web/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5) by @authentik-cherry-pick[bot] in #24068
• lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5) by @authentik-cherry-pick[bot] in #24114
• enterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5) by @authentik-cherry-pick[bot] in #24112
• packages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5) by @authentik-cherry-pick[bot] in #24166
• endpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5) by @authentik-cherry-pick[bot] in #24167
• policies: filter policy engine (cherry-pick #24025 to version-2026.5) by @authentik-cherry-pick[bot] in #24168
• website/docs: cleanup 07-12: refresh contributor guidance (cherry-pick #23969 to version-2026.5) by @authentik-cherry-pick[bot] in #24157
• internal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5) by @authentik-cherry-pick[bot] in #24220
• stages/captcha: fix hcaptcha height (#20901) by @gergosimonyi in #24216
• providers/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5) by @authentik-cherry-pick[bot] in #24227
• providers/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5) by @authentik-cherry-pick[bot] in #24231
• providers/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5) by @authentik-cherry-pick[bot] in #24229
• root: fix make gen-diff command (cherry-pick #22548 to version-2026.5) by @authentik-cherry-pick[bot] in #24121
• core: bump pyjwt from 2.11.0 to 2.13.0 (cherry-pick #22562 to version-2026.5) by @authentik-automation[bot] in #22570
• core: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5) by @authentik-cherry-pick[bot] in #23881
• web/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5) by @authentik-cherry-pick[bot] in #24252
• root: fix make gen-changelog (cherry-pick #24122 to version-2026.5) by @authentik-cherry-pick[bot] in #24260
• root: in-process per-IP rate throttle (#23015) by @gergosimonyi in #24217

Full Changelog: version/2026.5.5...version/2026.5.6

Release 2026.5.5

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202655

What's Changed

• tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5) by @authentik-cherry-pick[bot] in #23834
• endpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5) by @authentik-cherry-pick[bot] in #23854
• web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5) by @GirlBossRush in #23558
• web: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5) by @authentik-cherry-pick[bot] in #23878
• web/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5) by @authentik-automation[bot] in #23668
• web: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5) by @authentik-cherry-pick[bot] in #23949
• stages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5) by @authentik-cherry-pick[bot] in #23952
• website/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5) by @authentik-cherry-pick[bot] in #23975
• website/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5) by @authentik-cherry-pick[bot] in #23976
• website/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5) by @authentik-cherry-pick[bot] in #23982
• providers/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5) by @authentik-cherry-pick[bot] in #23957
• lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5) by @authentik-cherry-pick[bot] in #24019
• website/docs: 2026.5: remove preview tag from mtls stage doc by @dominic-r in #23981
• api/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5) by @authentik-cherry-pick[bot] in #24033
• sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5) by @authentik-cherry-pick[bot] in #24020
• packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5) by @authentik-cherry-pick[bot] in #24035
• security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24059
• security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24058
• security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24060
• security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24061
• security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24062
• website/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5) by @authentik-cherry-pick[bot] in #24071
• website/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5) by @authentik-cherry-pick[bot] in #24073

Full Changelog: version/2026.5.4...version/2026.5.5

Release 2026.2.6

See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202626

What's Changed

• tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2) by @authentik-cherry-pick[bot] in #23835
• lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2) by @authentik-cherry-pick[bot] in #24018
• sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2) by @authentik-cherry-pick[bot] in #24021
• packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2) by @authentik-cherry-pick[bot] in #24034
• security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #24056
• security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #24054
• security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #24057
• security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #24055
• security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #24053
• website/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2) by @authentik-cherry-pick[bot] in #24072

Full Changelog: version/2026.2.5...version/2026.2.6

Release 2026.5.4

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202654

What's Changed

• website/integrations: dokuwiki: add post logout and logout urls (cherry-pick #22984 to version-2026.5) by @authentik-automation[bot] in #22985
• website/docs: additional scim provider docs (cherry-pick #22135 to version-2026.5) by @authentik-automation[bot] in #23003
• root: bump pyo3 (cherry-pick #23036 to version-2026.5) by @authentik-automation[bot] in #23038
• website/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5) by @authentik-automation[bot] in #23125
• web: Fix user list default paths. (cherry-pick #23062 to version-2026.5) by @authentik-automation[bot] in #23127
• web/i18n: Fix stale flow locale, unsynchronized locale selector options (cherry-pick #23007 to version-2026.5) by @authentik-automation[bot] in #23148
• web: Fix stale clipboard tokens, untranslated labels (cherry-pick #23063 to version-2026.5) by @authentik-automation[bot] in #23143
• website/docs: add Splunk event forwarding docs (cherry-pick #22938 to version-2026.5) by @authentik-automation[bot] in #23163
• core: fix Invitation Emails Ignoring Selected Template (cherry-pick #23122 to version-2026.5) by @authentik-automation[bot] in #23133
• packages/django-dramatiq-postgres/broker: purge at start of loop to ensure it runs (cherry-pick #23185 to version-2026.5) by @authentik-automation[bot] in #23188
• web/stages/identification: Fix passkey autofill dropdown not showing on the identification stage (cherry-pick #23187 to version-2026.5) by @authentik-automation[bot] in #23189
• website/docs: fix broken custom email template example (cherry-pick #23191 to version-2026.5) by @authentik-automation[bot] in #23192
• packages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5) by @authentik-automation[bot] in #23213
• website: migrate brand assets to pkg (cherry-pick #22336 to version-2026.5) by @authentik-automation[bot] in #23222
• packages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.5) by @authentik-automation[bot] in #23235
• packages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.5) by @authentik-automation[bot] in #23257
• website/docs: improve email authenticator docs (cherry-pick #23226 to version-2026.5) by @authentik-automation[bot] in #23263
• website/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5) by @authentik-automation[bot] in #23312
• website/docs: clarify user and group filtering on scim provider (cherry-pick #22502 to version-2026.5) by @authentik-automation[bot] in #23358
• root: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5) by @authentik-automation[bot] in #23372
• website/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5) by @authentik-automation[bot] in #23391
• core: bump goauthentik/fips-debian and fips-python in /lifecycle/container (cherry-pick #23362 to version-2026.5) by @authentik-automation[bot] in #23384
• website/docs: fix 2026.5 release notes mentioning docker-compose.yml (cherry-pick #23385 to version-2026.5) by @authentik-automation[bot] in #23400
• providers/scim: allow failures during discovery (cherry-pick #23357 to version-2026.5) by @authentik-automation[bot] in #23365
• website/docs: Add improved akql docs (cherry-pick #22693 to version-2026.5) by @authentik-automation[bot] in #23497
• providers/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.5) by @authentik-automation[bot] in #23485
• web/admin: fix spacing issues in wizard (cherry-pick #23484 to version-2026.5) by @authentik-automation[bot] in #23488
• policies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.5) by @authentik-automation[bot] in #23421
• tasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.5) by @authentik-automation[bot] in #23424
• packages/django-postgres-cache: avoid regex queries when listing keys if possible (cherry-pick #23160 to version-2026.5) by @authentik-automation[bot] in #23423
• brands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.5) by @authentik-automation[bot] in #23524
• sources/ldap: avoid re-creating connections to LDAP server (cherry-pick #23520 to version-2026.5) by @authentik-automation[bot] in #23525
• tasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.5) by @authentik-automation[bot] in #23527
• core: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.5) by @authentik-automation[bot] in #23394
• providers/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.5) by @authentik-automation[bot] in #23233
• website/docs: improve service account docs (cherry-pick #22145 to version-2026.5) by @authentik-automation[bot] in #22885
• website: upgrade postman dep to fix pipeline by @PeshekDotDev in #23571
• core: bump pydantic from 2.13.3 to 2.13.4 (cherry-pick #22207 to version-2026.5) by @authentik-automation[bot] in #23570
• providers/oauth: Properly return error via post and for request objects (cherry-pick #23037 to version-2026.5) by @authentik-automation[bot] in #23529
• docs: Americanize and minor fixes (cherry-pick #22600 to version-2026.5) by @authentik-automation[bot] in #22604
• website/docs: clean up source docs (cherry-pick #23374 to version-2026.5) by @authentik-automation[bot] in #23397
• website/docs: add expression policy example for welcome emails on user creation (cherry-pick #23486 to version-2026.5) by @authentik-automation[bot] in #23579
• website/docs: update release notes for 2026.5.4 (cherry-pick #23576 to version-2026.5) by @authentik-automation[bot] in #23586
• tasks: add pre_delete for TasksModel to avoid OOM when deleting object with many tasks linked (cherry-pick #23664 to version-2026.5) by @authentik-automation[bot] in #23666
• packages/ak-common/config: coerce file:// and env:// values to their native type (cherry-pick #23758 to version-2026.5) by @rissson in #23759
• core: handle missing tenant in setup migration (cherry-pick #23034 to version-2026.5) by @authentik-automation[bot] in #23762
• sources/ldap: optimize the connection endpoints (cherry-pick #23761 to version-2026.5) by @authentik-automation[bot] in #23765
• providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5) by @authentik-automation[bot] in #23767
• root: update crossbeam-epoch (cherry-pick #23794 to version-2026.5) by @authentik-automation[bot] in #23795
• ci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.5) by @authentik-cherry-pick[bot] in #23803
• website/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.5) by @authentik-cherry-pick[bot] in #23820
• website: upgrade postman again to fix pipeline by @PeshekDotDev in #23824
• web: Fix outline selector, lack of outline on focused checkboxes. (cherry-pick #23260 to version-2026.5) by @authentik-cherry-pick[bot] in #23825
• stages/authenticator_webauthn: disable prevent_duplicate_devices by default (cherry-pick #23823 to version-2026.5) by @authentik-cherry-pick[bot] in #23826
• web, core: Fix server-side message race condition, type mismatch. (cherry-pick...

Release 2026.2.5

See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202625

What's Changed

• website/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2) by @authentik-automation[bot] in #22737
• website/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2) by @authentik-automation[bot] in #22740
• tests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2) by @authentik-automation[bot] in #22791
• web/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2) by @authentik-automation[bot] in #22894
• blueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2) by @authentik-automation[bot] in #22926
• endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2) by @authentik-automation[bot] in #22950
• providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2) by @authentik-automation[bot] in #22966
• core: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2) by @authentik-automation[bot] in #22961
• admin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2) by @authentik-automation[bot] in #23008
• packages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2) by @authentik-automation[bot] in #23234
• website/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2) by @authentik-automation[bot] in #23398
• policies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2) by @authentik-automation[bot] in #23426
• tasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2) by @authentik-automation[bot] in #23425
• packages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2) by @authentik-automation[bot] in #23258
• tasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2) by @authentik-automation[bot] in #23526
• brands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2) by @authentik-automation[bot] in #23523
• providers/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2) by @authentik-automation[bot] in #23232
• core: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2) by @authentik-automation[bot] in #23393
• web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2) by @GirlBossRush in #23557
• web, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2) by @authentik-automation[bot] in #23583
• web: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2) by @authentik-automation[bot] in #22457
• providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) by @authentik-automation[bot] in #23766
• providers/SCIM: Add discover support (cherry-pick #20658 to version-2026.2) by @authentik-automation[bot] in #23776
• providers/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2) by @authentik-automation[bot] in #23772
• providers/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2) by @authentik-automation[bot] in #23771
• stages/captcha: fix hcaptcha height (#20901) (2026.2) by @gergosimonyi in #23775
• root: in-process per-IP rate throttle (#23015) (2026.2) by @gergosimonyi in #23774
• ci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2) by @authentik-cherry-pick[bot] in #23804
• website/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2) by @authentik-cherry-pick[bot] in #23821

Full Changelog: version/2026.2.4...version/2026.2.5

Release 2026.5.3

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202653

What's Changed

• website/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5) by @authentik-automation[bot] in #22736
• website/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5) by @authentik-automation[bot] in #22738
• website/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5) by @authentik-automation[bot] in #22741
• website/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5) by @authentik-automation[bot] in #22793
• tests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5) by @authentik-automation[bot] in #22792
• enterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5) by @authentik-automation[bot] in #22861
• website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) by @authentik-automation[bot] in #22864
• website/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5) by @authentik-automation[bot] in #22800
• website/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5) by @authentik-automation[bot] in #22872
• web/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5) by @authentik-automation[bot] in #22895
• blueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5) by @authentik-automation[bot] in #22927
• website/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5) by @authentik-automation[bot] in #22890
• endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5) by @authentik-automation[bot] in #22951
• providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5) by @authentik-automation[bot] in #22967
• website: fix package-lock.json (version-2026.5) by @PeshekDotDev in #22964
• web/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5) by @authentik-automation[bot] in #22963
• core: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5) by @authentik-automation[bot] in #22962
• providers/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5) by @authentik-automation[bot] in #22955
• website/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5) by @authentik-automation[bot] in #22978

Full Changelog: version/2026.5.2...version/2026.5.3

Release 2026.5.2

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202652

What's Changed

• website/docs: Fix release notes cards (cherry-pick #22554 to version-2026.5) by @authentik-automation[bot] in #22555
• root: update security release versions (cherry-pick #22583 to version-2026.5) by @authentik-automation[bot] in #22591
• endpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5) by @authentik-automation[bot] in #22597
• website/docs: Bump package-lock by @GirlBossRush in #22552
• providers/radius: fix eap debug logging (cherry-pick #22551 to version-2026.5) by @authentik-automation[bot] in #22579
• events: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5) by @authentik-automation[bot] in #22683
• packages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5) by @authentik-automation[bot] in #22686
• packages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5) by @authentik-automation[bot] in #22685
• providers/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5) by @authentik-automation[bot] in #22692
• enterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5) by @authentik-automation[bot] in #22700
• security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #22729
• security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #22730
• security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #22731

Full Changelog: version/2026.5.0...version/2026.5.2

Release 2026.2.4

See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202624

What's Changed

• endpoints: remove print line (cherry-pick #22325 to version-2026.2) by @authentik-automation[bot] in #22326
• website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) by @authentik-automation[bot] in #22333
• enterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2) by @authentik-automation[bot] in #22414
• enterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2) by @authentik-automation[bot] in #22500
• outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2) by @authentik-automation[bot] in #22504
• website/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2) by @authentik-automation[bot] in #22530
• core: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2) by @authentik-automation[bot] in #22528
• endpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2) by @authentik-automation[bot] in #22596
• providers/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2) by @authentik-automation[bot] in #22578
• core: fix filter_not_expired not accepting positional arguments (2026.2) by @BeryJu in #22690
• ci: fix docs not having correct js version setup (2026.2) by @BeryJu in #22716
• tenants: fix test teardown (version-2026.2) by @gergosimonyi in #22715
• security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #22726
• security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #22727
• security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #22728

Full Changelog: version/2026.2.3...version/2026.2.4

Release 2025.12.6

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025126

What's Changed

• website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) by @authentik-automation[bot] in #22332
• enterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12) by @authentik-automation[bot] in #22413
• root: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12) by @authentik-automation[bot] in #22446
• enterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12) by @authentik-automation[bot] in #22499
• outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12) by @authentik-automation[bot] in #22503
• ci: fix docs not having correct js version setup (2025.12) by @BeryJu in #22717
• tenants: fix test teardown (version-2025.12) by @gergosimonyi in #22714
• security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 by @authentik-automation[bot] in #22724
• security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 by @authentik-automation[bot] in #22725
• security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 by @authentik-automation[bot] in #22723

Full Changelog: version/2025.12.5...version/2025.12.6

Release 2026.5.0

See https://docs.goauthentik.io/docs/releases/2026.5

What's Changed

• endpoints: remove print line (cherry-pick #22325 to version-2026.5) by @authentik-automation[bot] in #22327
• website/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5) by @authentik-automation[bot] in #22324
• website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) by @authentik-automation[bot] in #22334
• enterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5) by @authentik-automation[bot] in #22337
• website/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5) by @authentik-automation[bot] in #22189
• website/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5) by @authentik-automation[bot] in #22346
• website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) by @authentik-automation[bot] in #22348
• website/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5) by @authentik-automation[bot] in #22309
• web: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5) by @authentik-automation[bot] in #22364
• website/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5) by @authentik-automation[bot] in #22316
• website/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5) by @authentik-automation[bot] in #22347
• providers/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5) by @authentik-automation[bot] in #22368
• flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) by @authentik-automation[bot] in #22371
• enterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5) by @authentik-automation[bot] in #22415
• website: Docs and README new screenshots (cherry-pick #22341 to version-2026.5) by @authentik-automation[bot] in #22441
• web, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5) by @authentik-automation[bot] in #22374
• web/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5) by @authentik-automation[bot] in #22438
• website/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5) by @authentik-automation[bot] in #22443
• providers/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5) by @authentik-automation[bot] in #22449
• website/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5) by @authentik-automation[bot] in #22444
• root: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5) by @authentik-automation[bot] in #22448
• website/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5) by @authentik-automation[bot] in #22450
• root: fix gitignore binary paths (cherry-pick #22445 to version-2026.5) by @authentik-automation[bot] in #22485
• enterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5) by @authentik-automation[bot] in #22501
• outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5) by @authentik-automation[bot] in #22505
• website/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5) by @authentik-automation[bot] in #22510
• website/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5) by @authentik-automation[bot] in #22531
• core: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5) by @authentik-automation[bot] in #22529
• website/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5) by @authentik-automation[bot] in #22537
• providers/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5) by @authentik-automation[bot] in #22539
• events: fix certificate typo (cherry-pick #22542 to version-2026.5) by @authentik-automation[bot] in #22547
• website/release: Release notes updates (cherry-pick #22543 to version-2026.5) by @authentik-automation[bot] in #22545

Full Changelog: version/2026.5.0-rc2...version/2026.5.0