v4.39.0

4.39.0 (2025-03-16)

Summary

Please see the Authelia Blog: 4.39 Release Notes for human readable summaries of the changes. It's important to note some critical changes have occurred in this release that warrant some user attention.

Specific critical changes which are detailed in the Authelia Blog: 4.39 Release Notes to watch out for:

1. Changes that will require manual intervention in some scenarios:
   • The default claims for ID Tokens minted by the Authelia OpenID Connect 1.0 Identity Provider have changed.
2. Changes that shouldn't require manual intervention but are significant enough to cause issues in some edge cases:
   • The official Authelia container has been heavily changed.
   • The official Systemd Units which are packaged in AUR packages, DEB packages, and the GitHub artifacts archives have been heavily changed.

Detailed Changes

Bug Fixes

• i18n: lack of privacy policy message consistency (#8845) (a091374) by @Crowley723
• web: radio group spacing on mobile and uncentered icons (#8843) (ff88332) by @hendrik1120
• web: workflow id missing from passkey first factor (#8951) (f948399), closes #8950 by @tcx4c70

Features

• authentication: additional and custom attributes (#8078) (34932a8) by @james-d-elliott
• authentication: ldap connection pooling (#7217) (0af038e) by @james-d-elliott
• authentication: permit empty base dn (#8112) (4b50771) by @james-d-elliott
• build from authelia/base base image (#8884) (7d1adff) by @nightah
• configuration: listen on file descriptor (#5973) (df67550) by @oliverpool
• configuration: reusable definitions (#8077) (a9d1986) by @james-d-elliott
• configuration: support abstract unix socket (#7662) (3fc0378) by @DCsunset
• docker: implement shellcheck recommendations (#7474) (c7a8e58) by @jonasgeiler
• embed: make authelia embedable (#8841) (9241731), closes #5803 by @james-d-elliott
• handlers: basic authz caching (#8320) (05fa254), closes #5006 by @james-d-elliott
• logging: reopen on sighup (#7140) (16e44cb), closes #4964 by @james-d-elliott
• metrics: record passkey logins separately (#8866) (6759988) by @james-d-elliott
• middlewares: tokenized bucket rate limit (#8321) (ef5051b), closes #7353 #1947 by @james-d-elliott
• oidc: authorization policy network criteria (#8079) (f67097c) by @james-d-elliott
• oidc: claims parameter support (#8081) (111344e), closes #2868 by @james-d-elliott
• oidc: merged id token claims (#8851) (eadf0ba), closes #8619 by @james-d-elliott
• oidc: prompt parameter support (#8080) (9c718b3), closes #2596 by @james-d-elliott
• oidc: rfc7516 jwt encryption (#8083) (684c8e2) by @james-d-elliott
• oidc: rfc8628 oauth 2.0 device code grant (#8082) (e7d387e) by @james-d-elliott
• regulation: ip bans and unbanning (#7230) (5e40d97) by @james-d-elliott
• storage: allow peer authentication (#8161) (4b8d2ce) by @james-d-elliott
• storage: allow postgres failover (#7775) (2934c16) by @james-d-elliott
• use dedicated system user for systemd unit (#4982) (e33d729), closes #3736 by @feinedsquirrel
• web: add new oled theme (#8838) (e02a2db) by @Crowley723
• webauthn: passkeys (#7942) (197b455), closes #2827 #2761 by @james-d-elliott
• web: change password (#7676) (f4abcb3), closes #3548 by @Crowley723
• web: language picker (#6716) (2f1afa1) by @mind-ar

New Contributors

• @DCsunset made their first contribution in #7662
• @gensyn made their first contribution in #8793
• @rm76 made their first contribution in #8894
• @oliverpool made their first contribution in #5973
• @jonasgeiler made their first contribution in #7474
• @tcx4c70 made their first contribution in #8951
• @allendema made their first contribution in #8957
• @feinedsquirrel made their first contribution in #4982

Docker Container

• docker pull authelia/authelia:4.39.0
• docker pull ghcr.io/authelia/authelia:4.39.0