Release 2026.8.0

See https://docs.goauthentik.io/docs/releases/2026.8

What's Changed

• blueprints: emit draft-07 definitions instead of $defs (cherry-pick #24981 to version-2026.8) by @authentik-cherry-pick[bot] in #24985
• website/docs: add object attributes doc (cherry-pick #24437 to version-2026.8) by @authentik-cherry-pick[bot] in #24988
• providers/oauth2: fix dcr missing csrf_exempt (cherry-pick #24983 to version-2026.8) by @authentik-cherry-pick[bot] in #24989
• web/admin: fix missing preview banner for object attributes (cherry-pick #24982 to version-2026.8) by @authentik-cherry-pick[bot] in #24990
• enterprise/requests: optimize db for requestable apps (cherry-pick #24984 to version-2026.8) by @authentik-cherry-pick[bot] in #24992
• enterprise/endpoints/connectors/fleet: decrease page size (cherry-pick #24995 to version-2026.8) by @authentik-cherry-pick[bot] in #24997
• web/elements: fix prioritization in form serialization for dotted input-fields (cherry-pick #24987 to version-2026.8) by @authentik-cherry-pick[bot] in #24996
• tasks: aggregate status from logs instead of legacy field (cherry-pick #24792 to version-2026.8) by @authentik-cherry-pick[bot] in #25004
• enterprise/stages/source: configurable failure action (cherry-pick #24963 to version-2026.8) by @authentik-cherry-pick[bot] in #25027
• endpoints: handle error in facts (cherry-pick #25028 to version-2026.8) by @authentik-cherry-pick[bot] in #25032
• sources/saml: add audience override field for SAML sources (cherry-pick #25029 to version-2026.8) by @authentik-cherry-pick[bot] in #25033
• web: Fix content_left/right layouts. (cherry-pick #25025 to version-2026.8) by @authentik-cherry-pick[bot] in #25030
• website/docs: add 2026.8 release note for task status change (cherry-pick #25044 to version-2026.8) by @authentik-cherry-pick[bot] in #25045
• outposts/proxy: include query string in post-authentication redirect (cherry-pick #25043 to version-2026.8) by @authentik-cherry-pick[bot] in #25058
• website/docs: preserve host and port in proxy provider nginx redirects (cherry-pick #24991 to version-2026.8) by @authentik-cherry-pick[bot] in #25000
• core: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.8) by @authentik-cherry-pick[bot] in #25060
• web: Fix mangled nested CSS in compatibility mode. (cherry-pick #25053 to version-2026.8) by @authentik-cherry-pick[bot] in #25063
• ci: require test-rust to pass (cherry-pick #25066 to version-2026.8) by @authentik-cherry-pick[bot] in #25068
• providers/scim: fix group membership removals (cherry-pick #25024 to version-2026.8) by @authentik-cherry-pick[bot] in #25067
• website/docs: correct proxy unauthenticated path regex reference (cherry-pick #25077 to version-2026.8) by @authentik-cherry-pick[bot] in #25082
• website/docs: match UI label capitalization and add a style rule (cherry-pick #25080 to version-2026.8) by @authentik-cherry-pick[bot] in #25084
• website/docs: update source field labels renamed in 2026.8 (cherry-pick #25072 to version-2026.8) by @authentik-cherry-pick[bot] in #25085
• packages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.8) by @authentik-cherry-pick[bot] in #25106
• enterprise/requests: fix API schema for grant requests (cherry-pick #25111 to version-2026.8) by @authentik-cherry-pick[bot] in #25114
• web/user: fix request access URL from agent not working (cherry-pick #25113 to version-2026.8) by @authentik-cherry-pick[bot] in #25118
• providers/oauth2: fix token exchange provider lookup for actor/subject (cherry-pick #25110 to version-2026.8) by @authentik-cherry-pick[bot] in #25116
• enterprise/endpoints/connectors/agent: add login_hint to auth_ia (cherry-pick #25122 to version-2026.8) by @authentik-cherry-pick[bot] in #25124
• core: scope user path_startswith filter to the path subtree (cherry-pick #25093 to version-2026.8) by @authentik-cherry-pick[bot] in #25145
• website/docs: agents: add doc (cherry-pick #24826 to version-2026.8) by @authentik-cherry-pick[bot] in #25150
• sources/telegram: restore next= redirect after pre_authentication_flow (cherry-pick #22762 to version-2026.8) by @authentik-cherry-pick[bot] in #25152
• core: delete all user sessions when user is deactivated (cherry-pick #25088 to version-2026.8) by @authentik-cherry-pick[bot] in #25104
• website/docs: mark deprecated PostgreSQL options and fix listen settings (cherry-pick #25074 to version-2026.8) by @authentik-cherry-pick[bot] in #25083
• web: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.8) by @authentik-cherry-pick[bot] in #25002
• website/docs: add access requests doc (cherry-pick #24457 to version-2026.8) by @authentik-cherry-pick[bot] in #25161
• providers/oauth2: send back-channel logout requests when a user is deactivated (cherry-pick #24718 to version-2026.8) by @authentik-cherry-pick[bot] in #25109
• core: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.8) by @authentik-cherry-pick[bot] in #25186
• stages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.8) by @authentik-cherry-pick[bot] in #25190
• providers/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.8) by @authentik-cherry-pick[bot] in #25197
• website/docs: add OBO (cherry-pick #25149 to version-2026.8) by @authentik-cherry-pick[bot] in #25192
• enterprise: increase cache duration and ensure summary is cached (cherry-pick #25187 to version-2026.8) by @authentik-cherry-pick[bot] in #25199
• website/docs: 2026.8 release notes: add features and links to docs (cherry-pick #25194 to version-2026.8) by @authentik-cherry-pick[bot] in #25201

Full Changelog: version/2026.8.0-rc7...version/2026.8.0

Release 2026.8.0-rc7

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• core: Actors (cherry-pick #24353 to version-2026.8) by @authentik-cherry-pick[bot] in #24709
• website/docs: document API scope and domain join required by the authentik Agent (cherry-pick #24599 to version-2026.8) by @authentik-cherry-pick[bot] in #24715
• website/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.8) by @authentik-cherry-pick[bot] in #24735
• enterprise/requests: only show requests tab when usable (cherry-pick #24705 to version-2026.8) by @authentik-cherry-pick[bot] in #24743
• providers/oauth2: token exchange delegation (cherry-pick #24356 to version-2026.8) by @authentik-cherry-pick[bot] in #24745
• website/docs: fix broken link in 2026.11 release notes draft (cherry-pick #24746 to version-2026.8) by @authentik-cherry-pick[bot] in #24747
• website/docs: release notes: add ws-fed info (cherry-pick #24659 to version-2026.8) by @authentik-cherry-pick[bot] in #24661
• blueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.8) by @authentik-cherry-pick[bot] in #24750
• web/components: update styling for user account switcher (cherry-pick #24749 to version-2026.8) by @authentik-cherry-pick[bot] in #24753
• web/admin: fix alignment of task list filters (cherry-pick #24752 to version-2026.8) by @authentik-cherry-pick[bot] in #24754
• website/docs: fix link in .8 release notes (cherry-pick #24757 to version-2026.8) by @authentik-cherry-pick[bot] in #24758
• source/oauth: add cas source integration (cherry-pick #24737 to version-2026.8) by @authentik-cherry-pick[bot] in #24768
• website/docs: recpatcha: add mention of google enterprise (cherry-pick #24658 to version-2026.8) by @authentik-cherry-pick[bot] in #24769
• web/common: allow line-break in dom-purify (cherry-pick #24755 to version-2026.8) by @authentik-cherry-pick[bot] in #24784
• core: delete expired actor tokens (cherry-pick #24767 to version-2026.8) by @authentik-cherry-pick[bot] in #24783
• web/admin: drop misleading delete consequences from user activation review (cherry-pick #24273 to version-2026.8) by @authentik-cherry-pick[bot] in #24787
• enterprise/agents: add (cherry-pick #24598 to version-2026.8) by @authentik-cherry-pick[bot] in #24790
• core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.8) by @authentik-cherry-pick[bot] in #24816
• blueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.8) by @authentik-cherry-pick[bot] in #24821
• providers/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.8) by @authentik-cherry-pick[bot] in #24822
• enterprise/agents: fix enterprise required check for agents (cherry-pick #24814 to version-2026.8) by @authentik-cherry-pick[bot] in #24825
• server: avoid looping indefinitely on embedded outpost start (take 2) (cherry-pick #24824 to version-2026.8) by @authentik-cherry-pick[bot] in #24827
• web: contain long text in tables and application cards (cherry-pick #24621 to version-2026.8) by @authentik-cherry-pick[bot] in #24689
• web: fix file search input interactions (cherry-pick #24609 to version-2026.8) by @authentik-cherry-pick[bot] in #24811
• website/docs: add gitguardian to 2026.8 release notes by @dominic-r in #24830
• website/docs: cleanup 07-12: polish endpoint device guidance (cherry-pick #23968 to version-2026.8) by @authentik-cherry-pick[bot] in #24629
• web/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.8) by @authentik-cherry-pick[bot] in #24837
• blueprints Add EQ and NEQ modes to the !Condition tag (cherry-pick #20315 to version-2026.8) by @authentik-cherry-pick[bot] in #24842
• root: pin pnpm 11.20.0 everywhere (cherry-pick #24789 to version-2026.8) by @authentik-cherry-pick[bot] in #24854
• blueprints: run initial migration before flows are created (cherry-pick #24880 to version-2026.8) by @authentik-cherry-pick[bot] in #24883
• website/docs: release: sync integrations by @dominic-r in #24876
• website/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.8) by @authentik-cherry-pick[bot] in #24681
• providers/oauth2: fix client_credentials regression (cherry-pick #24900 to version-2026.8) by @authentik-cherry-pick[bot] in #24901
• providers/oauth2: optimize JWKS conversion (cherry-pick #24889 to version-2026.8) by @authentik-cherry-pick[bot] in #24907
• lib/evaluator: use lazy proxy for http session (cherry-pick #24893 to version-2026.8) by @authentik-cherry-pick[bot] in #24909
• providers/oauth2: refactor token parsing logic (cherry-pick #24904 to version-2026.8) by @authentik-cherry-pick[bot] in #24906
• providers/oauth2: cache ProviderInfoView get_claims (cherry-pick #24890 to version-2026.8) by @authentik-cherry-pick[bot] in #24914
• enterprise/endpoints/connectors/fleet: decrease page size (cherry-pick #24908 to version-2026.8) by @authentik-cherry-pick[bot] in #24911
• root: add optional pyroscope for profiling (cherry-pick #24887 to version-2026.8) by @authentik-cherry-pick[bot] in #24945
• rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.8) by @authentik-cherry-pick[bot] in #24948
• website/docs: Get notified about new releases (cherry-pick #24885 to version-2026.8) by @authentik-cherry-pick[bot] in #24941
• providers/scim: fix display of SCIMRequestException (2026.8) by @BeryJu in #24833
• providers/oauth2: move DCR to OSS (cherry-pick #24949 to version-2026.8) by @authentik-cherry-pick[bot] in #24953
• enterprise/requests: integrate agents with requests (cherry-pick #24844 to version-2026.8) by @authentik-cherry-pick[bot] in #24952
• providers/oauth2: automatically invalidate ProviderInfoView cached claims (cherry-pick #24944 to version-2026.8) by @authentik-cherry-pick[bot] in #24960
• providers/oauth2: add token exchange targeting (cherry-pick #24874 to version-2026.8) by @authentik-cherry-pick[bot] in #24955
• core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.8) by @authentik-cherry-pick[bot] in #24958

Full Changelog: version/2026.8.0-rc6...version/2026.8.0-rc7

Release 2026.8.0-rc6

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• stages/authenticator_validate: fix intermittnetly failing throttling test (cherry-pick #24568 to version-2026.8) by @authentik-cherry-pick[bot] in #24708
• ci: sentry-release needs access to metadata. (cherry-pick #24710 to version-2026.8) by @authentik-cherry-pick[bot] in #24711

Full Changelog: version/2026.8.0-rc5...version/2026.8.0-rc6

Release 2026.8.0-rc5

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• ci: release publish: fix image attestation by @rissson in #24706

Full Changelog: version/2026.8.0-rc4...version/2026.8.0-rc5

Release 2026.8.0-rc4

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• website/docs: fix sidebar titles and ordering (cherry-pick #24051 to version-2026.8) by @authentik-cherry-pick[bot] in #24700
• ci: release publish: fix metadata parsing by @rissson in #24703

Full Changelog: version/2026.8.0-rc3...version/2026.8.0-rc4

Release 2026.8.0-rc3

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• lib/sync/outgoing: allow discovery to be deactivated (cherry-pick #24667 to version-2026.8) by @authentik-cherry-pick[bot] in #24678
• website/docs: Mark the release notes for 2026.8 as 'beta' (cherry-pick #24682 to version-2026.8) by @authentik-cherry-pick[bot] in #24686
• ci: release tag: add validation that the workflow was started on the appropriate branch (cherry-pick #24676 to version-2026.8) by @authentik-cherry-pick[bot] in #24690
• web: hide plain action icons while loading (cherry-pick #24618 to version-2026.8) by @authentik-cherry-pick[bot] in #24688
• ci: release publish: fix missing gh cli env var by @rissson in #24695
• ci: release: rename major release to release family (cherry-pick #24691 to version-2026.8) by @authentik-cherry-pick[bot] in #24697

Full Changelog: version/2026.8.0-rc2...version/2026.8.0-rc3

Release 2026.8.0-rc2

See https://next.goauthentik.io/docs/releases/2026.8

What's Changed

• root: limit request body size (cherry-pick #24666 to version-2026.8) by @authentik-cherry-pick[bot] in #24671
• core: fix group source connection source object (cherry-pick #24626 to version-2026.8) by @authentik-cherry-pick[bot] in #24673
• providers/scim: rework discovery with pageSize (cherry-pick #24490 to version-2026.8) by @authentik-cherry-pick[bot] in #24675
• root: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.8) by @authentik-cherry-pick[bot] in #24669
• brands: expose authenticated flags correct in current brand (cherry-pick #24577 to version-2026.8) by @authentik-cherry-pick[bot] in #24597
• web, packages/geo, server/static: Air Gapped Maps Merge Branch (cherry-pick #24254 to version-2026.8) by @authentik-cherry-pick[bot] in #24602
• ci: split test job into 10 (cherry-pick #24591 to version-2026.8) by @authentik-cherry-pick[bot] in #24677
• ci: release publish: fix missing checkout by @rissson in #24684

Full Changelog: version/2026.8.0-rc1...version/2026.8.0-rc2

Release 2026.8.0-rc1

See https://next.goauthentik.io/docs/releases/2026.8

Release 2026.5.6

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202656

What's Changed

• web/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5) by @authentik-cherry-pick[bot] in #24068
• lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5) by @authentik-cherry-pick[bot] in #24114
• enterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5) by @authentik-cherry-pick[bot] in #24112
• packages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5) by @authentik-cherry-pick[bot] in #24166
• endpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5) by @authentik-cherry-pick[bot] in #24167
• policies: filter policy engine (cherry-pick #24025 to version-2026.5) by @authentik-cherry-pick[bot] in #24168
• website/docs: cleanup 07-12: refresh contributor guidance (cherry-pick #23969 to version-2026.5) by @authentik-cherry-pick[bot] in #24157
• internal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5) by @authentik-cherry-pick[bot] in #24220
• stages/captcha: fix hcaptcha height (#20901) by @gergosimonyi in #24216
• providers/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5) by @authentik-cherry-pick[bot] in #24227
• providers/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5) by @authentik-cherry-pick[bot] in #24231
• providers/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5) by @authentik-cherry-pick[bot] in #24229
• root: fix make gen-diff command (cherry-pick #22548 to version-2026.5) by @authentik-cherry-pick[bot] in #24121
• core: bump pyjwt from 2.11.0 to 2.13.0 (cherry-pick #22562 to version-2026.5) by @authentik-automation[bot] in #22570
• core: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5) by @authentik-cherry-pick[bot] in #23881
• web/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5) by @authentik-cherry-pick[bot] in #24252
• root: fix make gen-changelog (cherry-pick #24122 to version-2026.5) by @authentik-cherry-pick[bot] in #24260
• root: in-process per-IP rate throttle (#23015) by @gergosimonyi in #24217

Full Changelog: version/2026.5.5...version/2026.5.6

Release 2026.5.5

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202655

What's Changed

• tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5) by @authentik-cherry-pick[bot] in #23834
• endpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5) by @authentik-cherry-pick[bot] in #23854
• web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5) by @GirlBossRush in #23558
• web: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5) by @authentik-cherry-pick[bot] in #23878
• web/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5) by @authentik-automation[bot] in #23668
• web: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5) by @authentik-cherry-pick[bot] in #23949
• stages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5) by @authentik-cherry-pick[bot] in #23952
• website/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5) by @authentik-cherry-pick[bot] in #23975
• website/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5) by @authentik-cherry-pick[bot] in #23976
• website/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5) by @authentik-cherry-pick[bot] in #23982
• providers/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5) by @authentik-cherry-pick[bot] in #23957
• lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5) by @authentik-cherry-pick[bot] in #24019
• website/docs: 2026.5: remove preview tag from mtls stage doc by @dominic-r in #23981
• api/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5) by @authentik-cherry-pick[bot] in #24033
• sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5) by @authentik-cherry-pick[bot] in #24020
• packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5) by @authentik-cherry-pick[bot] in #24035
• security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24059
• security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24058
• security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24060
• security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24061
• security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #24062
• website/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5) by @authentik-cherry-pick[bot] in #24071
• website/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5) by @authentik-cherry-pick[bot] in #24073

Full Changelog: version/2026.5.4...version/2026.5.5