What authelia/authelia shipped
Written by FoxPlug from the repository's own releases; not affiliated with Authelia. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/authelia/authelia; Authelia did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Each GoReleaser container now gets its own GPG agent so concurrent CI builds no longer sign through a shared GPG home. Pull request #13373
- The blocked build webhook notification moved to an organisation-level Notification Service webhook scoped to this pipeline. Pull request #13403
- Test engine reports now hide parent failures so a single failing subtest is not reported at every level of its name. Pull request #13404
- The storage concurrency test now retries SQLite begin on lock contention instead of failing with database is locked. Pull request #13407
- Web tests now wait for the TOTP secret to render before closing the registration dialog. Pull request #13398
Why it matters
Release signing and CI reliability are the focus this week. Concurrent container builds no longer share a GPG agent, so signatures come from the build that produced them. The test and notification changes reduce flaky and misleading CI reports, which keeps the pipeline trustworthy for everyone relying on releases.
Changelog entry
- Build: give each GoReleaser container its own GPG agent so concurrent CI builds sign correctly. Pull request #13373
- CI: move the blocked build notification from a pipeline webhook to an organisation-level Notification Service webhook. Pull request #13403
- CI: hide parent failures in test engine reports to avoid duplicate failure and flaky entries. Pull request #13404
- Tests: retry SQLite begin on lock contention in the storage concurrency test. Pull request #13407
- Tests: wait for the TOTP secret before closing the registration dialog in web tests. Pull request #13398
This week: each GoReleaser container gets its own GPG agent so concurrent builds sign correctly. Blocked build alerts move to an organisation-level webhook. CI reports now hide parent failures, and SQLite and TOTP tests are less flaky.
This week in the project: each GoReleaser container now has its own GPG agent, so concurrent CI builds on the same host no longer sign through a shared GPG home. The blocked build notification moved from a pipeline webhook to an organisation-level Notification Service webhook scoped to this pipeline. Test engine reports now pass --junitfile-hide-parent-failures so a single failing subtest is not counted as a separate failure at every level. The storage concurrency test retries SQLite begin on lock contention, and the web TOTP dialog test waits for the secret before closing. Together these changes make CI output and release signing more reliable.
Week of September 28, 2026
What shipped
- Fixed a race condition in OIDC where concurrent user authorizations for the same sector could cause the opaque identifier creation to fail. Pull request #13296
- Fixed the identity verification dialog to properly handle and display errors when verification requests fail instead of freezing the UI. Pull request #13327
- Moved OIDC conformance server image building to the CI pipeline, eliminating per-suite rebuild overhead by publishing it as a reusable integration image. Pull request #13313
- Stabilized the OIDC conformance suite by addressing environment and conformance server startup issues that caused one in six test runs to fail. Pull request #13297
- Improved Kubernetes suite setup reliability by increasing its timeout back to 12 minutes after it was reduced to 2 minutes. Pull request #13295
- Fixed the Caddy reset password test scenario by waiting for the reset password form to load before interacting with form fields. Pull request #13325
- Stopped Chrome from querying network time during tests, which was causing certificate verifier rebuilds that dropped all in-flight requests. Pull request #13334
- Added tracking of Chrome request failures in test suites to distinguish between timeouts and connection failures. Pull request #13328
- Fixed first time contributor detection in CI workflows by checking the GitHub API instead of relying on webhook association data. Pull request #13310
- Replaced Probot-based pull request commentary with a GitHub Actions workflow for better reliability and maintenance. Pull request #13320
Why it matters
This week addresses stability issues across multiple test suites and fixes production bugs in OIDC user identification and identity verification. The improvements reduce flaky tests and racing conditions that could affect deployments and user experiences.
Changelog entry
- Fix(oidc): handle concurrent creation of the user opaque identifier Pull request #13296
- Fix(web): recover the identity verification dialog when verifying fails Pull request #13327
- Ci(buildkite): publish the oidc conformance server image Pull request #13313
- Test(suites): stabilise the oidc conformance suite Pull request #13297
- Test(suites): stabilise the kubernetes suite setup Pull request #13295
- Test(suites): stabilise the caddy reset password scenario Pull request #13325
- Test(suites): stop chrome querying the network time Pull request #13334
- Test(suites): record the requests chrome fails Pull request #13328
- Ci(autheliabot): match first time contributors by webhook association Pull request #13310
- Ci(autheliabot): replace probot pr commentary with workflow Pull request #13320
Stabilized test suites, fixed OIDC race condition in concurrent user authorizations, and improved identity verification error handling.
Authelia this week fixed a race condition in OIDC concurrent user authorization that could fail identifier creation, improved identity verification to properly handle request failures, and stabilized multiple test suites including Kubernetes and OIDC conformance. These changes reduce flaky tests and address production reliability.
Week of September 21, 2026
What shipped
- Authz endpoints now derive response headers from user attributes, allowing any standard, extended, or custom attribute to be sent to the proxy instead of just the defaults. Pull request #9346
- Configuration files now support TOML and JSON formats in addition to YAML, with format determined by file extension. Pull request #9223
- Added config.filters.values option to load YAML, JSON, or TOML values files that are deep-merged and exposed to the template filter as.Values. Pull request #9230
- Template filter delimiters are now customizable via --config.filters.template.delimiter.left and --config.filters.template.delimiter.right options. Pull request #11907
- OTP input styling now uses theme tokens correctly when using the OLED theme. Pull request #13252
- Web dependencies refactored to replace clsx and tailwind-merge with cn package. Pull request #13279
- OIDC integration documentation updated with Vault configuration examples. Pull request #13188
- OIDC integration documentation updated for OwnCloud with version bump and desktop client notes. Pull request #13277
- Container image tagging now normalizes branch names to comply with registry tag requirements. Pull request #13249
- CI pipeline reorganized into logical Buildkite group steps for better readability. Pull request #13258
Why it matters
This week brings significant configuration flexibility improvements with TOML and JSON support, customizable template delimiters, and the ability to map any user attribute to response headers. These features enable more sophisticated deployment scenarios and better integration with various infrastructure setups.
Changelog entry
- Feat(handlers): authz endpoints now derive response headers from user attributes Pull request #9346
- Feat(configuration): add support for TOML and JSON config file formats Pull request #9223
- Feat(configuration): add template filter values files with deep merge support Pull request #9230
- Feat(configuration): customizable template filter delimiters Pull request #11907
- Fix(web): OTP input styling now respects theme tokens in OLED mode Pull request #13252
- Refactor(web): replace clsx and tailwind-merge with cn package Pull request #13279
- Docs(oidc): updated Vault integration guide Pull request #13188
- Docs(oidc): updated OwnCloud integration documentation Pull request #13277
- Docs(oidc): updated Mastodon integration guide Pull request #13241
- Docs(oidc): updated Gitea integration guide Pull request #13145
Authelia now supports TOML and JSON config formats, customizable template delimiters, and derives authz headers from any user attribute. Better flexibility for your deployment.
This week's Authelia updates focus on configuration flexibility and integration depth. Support for TOML and JSON formats, customizable template delimiters, and the ability to map any user attribute to authz response headers give operators more control over their deployments. We've also enhanced OIDC integration docs and improved web styling for OLED themes.
Week of September 14, 2026
What shipped
- Version 4.39.28 released with fixes for consent redirects, Envoy authz headers, and OIDC consent duplication. Release
- Added /api/health/extended endpoint that checks database and authentication backend connectivity, improving load balancer routing decisions. Pull request #13127
- Second factor registration is now offered in user settings even when no access control rules explicitly require two-factor authentication. Pull request #13156
- Operators can now configure a custom registration URL to point users toward external account provisioning systems. Pull request #13093
- TOTP authenticator application suggestions are now configurable instead of hardcoded to Google Authenticator. Pull request #13095
- Filesystem notifier now supports FIFO destinations without panicking during startup checks or synchronization. Pull request #11903
- OIDC conformance suite image pinned by digest to satisfy supply chain security checks. Pull request #13172
- Scorecard file-based checks integrated into the lint script to catch issues at commit time instead of waiting for weekly runs. Pull request #13178
Why it matters
This week's updates improve deployment flexibility and observability. Operators gain control over authenticator recommendations and registration flows, while infrastructure improvements ensure load balancers can route traffic only to healthy nodes with functional backends.
Changelog entry
- Release v4.39.28 Release
- Server: add verbose health check endpoint at /api/health/extended Pull request #13127
- Handlers: offer second factor registration for elevation Pull request #13156
- Authentication: add registration custom URL configuration Pull request #13093
- TOTP: make suggested authenticator app configurable Pull request #13095
- Notification: support FIFO destinations for filesystem notifier Pull request #11903
- Build: pin OIDC conformance suite image by digest Pull request #13172
- CI: add scorecard linter to file-based checks Pull request #13178
Authelia 4.39.28 ships with health checks that verify backend connectivity, configurable TOTP apps, custom registration URLs, and FIFO notifier support.
Authelia 4.39.28 is available. This release improves observability with extended health checks that verify database and authentication backend connectivity, giving load balancers better routing decisions. Operators can now customize TOTP authenticator recommendations and point users to external registration systems. The filesystem notifier gains FIFO support, and supply chain security is enhanced with pinned container images.