What goauthentik/authentik shipped
Written by FoxPlug from the repository's own releases; not affiliated with Goauthentik. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/goauthentik/authentik; Goauthentik did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- RBAC now denies unauthenticated object requests instead of failing with a server error. Pull request #26682
- The users/me endpoint no longer erases session data saved by concurrent requests. Pull request #26790
- FLows can now be run without authentication for re-authentication. Pull request #26785
- OAuth sources support public keys for PKCE flows, making client secrets optional. Pull request #20151
- Outgoing sync providers no longer create duplicate groups when provisioning tasks overlap. Pull request #25997
- The LDAP provider keeps its cached directory when a refresh fetch fails. Pull request #26420
- Entra ID OAuth group pagination now follows every Microsoft Graph nextLink. Pull request #26497
- Logout is allowed while flows are unfinished, limited to iframe logout callbacks. Pull request #26565
- Ak-search-select is rebuilt as a form-associated element with a native combobox input and popover listbox. Pull request #25610
- The LDAP source form now saves its parent group and admin table flakiness in end-to-end tests is fixed. Pull request #26568
Why it matters
This week fixed several cases where sessions, permissions and provisions could go wrong: unauthenticated object requests now get a clean denial, users/me no longer wipes session data written by concurrent requests, re-authentication flows are allowed without authentication, and overlapping outgoing sync tasks no longer create duplicate groups. LDAP, OAuth and Entra ID sources also got more reliable, with a cached directory kept on failed refresh fetches and full pagination of Entra ID group memberships. The search select element and the LDAP source form in the web interface were reworked for correct behavior.
Changelog entry
- Website/integrations: link authentik concepts in setup intros Pull request #26815
- Core: add validation for property mapping return types Pull request #26806
- Rbac: deny unauthenticated object requests instead of failing with a server error Pull request #26682
- Core: stop users/me from erasing session data saved by concurrent requests Pull request #26790
- Flows: allow unauthenticated flows for re-authentication Pull request #26785
- Sources/oauth: support public keys for PKCE flows Pull request #20151
- Lib/sync/outgoing: prevent duplicate group creation in outgoing providers Pull request #25997
- Providers/ldap: keep cached directory when a refresh fetch fails Pull request #26420
- Sources/oauth: fix Entra ID group pagination Pull request #26497
- Providers/oauth2: allow logout with unfinished flows Pull request #26565
- Web/elements: rebuild ak-search-select as a form-associated element Pull request #25610
- Web: save the LDAP source's parent group; fix e2e flakes Pull request #26568
RBAC denies unauthenticated object requests. users/me no longer erases session data. PKCE flows support public keys. Outgoing sync no longer creates duplicate groups. LDAP keeps cached directory on fetch failure. Entra ID group pagination fixed. ak-search-select rebuilt as form-a
Several fixes landed for authentik this week. RBAC now denies unauthenticated object requests instead of returning a server error. The users/me endpoint no longer erases session data saved by concurrent requests, and re-authentication flows can run without authentication. OAuth sources support public keys for PKCE flows so client secrets are optional, and outgoing sync providers no longer create duplicate groups when tasks overlap. The LDAP provider keeps its cached directory when a refresh fetch fails, and Entra ID OAuth group pagination now follows every Microsoft Graph nextLink. Logout is allowed while flows are unfinished where appropriate, the ak-search-select element was rebuilt as a form-associated element, and the LDAP source form now saves its parent group.
Week of September 28, 2026
What shipped
- Policies now support dry-run bindings that evaluate without affecting access decisions, reporting observations through policy execution events. Pull request #26382
- Locale preference now persists in a cookie and reloads the page when changed, fixing mixed language state issues. Pull request #25156
- The UI preloads locale catalogs to prevent a flash of untranslated English content on non-English pages. Pull request #25157
- Application list cache timeout is now configurable through a new cache.timeout_application_policies setting. Pull request #26596
- Client IP is now included in the user application cache key to fix caching issues when users connect from different IPs. Pull request #26553
- Superuser annotation in the user API was split into two EXISTS subqueries for improved query performance. Pull request #26275
- An expensive query in policy-related code was removed, speeding up enterprise requests. Pull request #26666
- Old Chrome versions now use SFE for better compatibility. Pull request #26594
- MFA login no longer generates spurious model update events for authenticators, reducing noise and SSF-related re-authentication requests. Pull request #26584
- Duration validation now catches overflow errors and converts them to proper validation errors. Pull request #26680
Why it matters
This week brings fixes for caching issues that affected user experience across different networks, performance improvements for policy evaluation and user queries, and better handling of localization to prevent UI flickering. Several changes target reliability and correctness in authentication and policy enforcement.
Changelog entry
- Policies: support dry-run bindings with event reporting for policy and user/group bindings Pull request #26382
- Web/i18n, core: persist locale in cookie and reload page on language change Pull request #25156
- Web/i18n, core: preload locale catalog to prevent flash of untranslated content Pull request #25157
- Core: make application list cache timeout configurable via cache.timeout_application_policies Pull request #26596
- Core/applications: include
client_ipin user application cache key Pull request #26553 - Core: optimize superuser annotation query with two EXISTS subqueries Pull request #26275
- Policies: remove expensive query from enterprise/requests flow Pull request #26666
- Web/flows: use SFE for old Chrome versions Pull request #26594
- Stages/authenticator_validate: prevent model update events during MFA login Pull request #26584
- Core: handle overflow errors in duration validation Pull request #26680
- Web/flows: check localStorage availability for continuous login Pull request #26267
- Core, web: update Russian translations Pull request #26624
Week 24 ships: dry-run policy bindings, locale persistence, configurable cache timeouts, client IP in cache keys, and fixes for spurious MFA events and query performance.
This week's release improves caching behavior for multi-network users, adds dry-run support for policies with event reporting, fixes locale flash issues, and reduces noisy events during MFA login. Performance gains come from query optimization and an expensive policy query removal. Configuration is more flexible with the new cache timeout setting.
Week of September 21, 2026
What shipped
- Blueprints now export with references, fixing the long-standing issue that exported blueprints couldn't be re-imported in different authentik instances due to hardcoded primary keys. Pull request #26069
- RAC provider now correctly parses IPv6 literal endpoint hosts like [2001:1234::1]:5900 instead of splitting incorrectly on the first colon. Pull request #24465
- OAuth2 provider now returns authorization errors to custom scheme redirect URIs used by native apps, instead of bare HTTP 400 responses. Pull request #26386
- CAPTCHA widgets in flows now render without iframe wrappers, resolving providers directly via challenge
js_urlinstead of window global sniffing. Pull request #26143 - Removed legacy user and group attribute filters that inefficiently loaded all matching objects before pagination, causing performance issues. Pull request #25802
- Core now filters application entitlements for bound users, improving efficiency when querying user-specific application access. Pull request #26384
- Added new Paginator component and revised Table and DualSelect to use standardized pagination across the web interface. Pull request #26327
- Email stage now handles errors correctly when recovering with admin-generated tokens. Pull request #24409
- Blueprints admin interface now available to read-only role, allowing broader access to blueprint management. Pull request #26363
- LDAP now supports X25519MLKEM768 hybrid cryptographic key when using TLS. Pull request #26368
Why it matters
This week brings significant infrastructure improvements: blueprints are now portable across instances, IPv6 and OAuth2 native apps work correctly, and performance issues with user filtering are resolved. The UI also gets better consistency with standardized pagination and improved CAPTCHA rendering.
Changelog entry
- Blueprints: Export with references instead of hardcoded primary keys for cross-instance portability Pull request #26069
- Providers/RAC: Fix IPv6 literal endpoint host parsing Pull request #24465
- Providers/OAuth2: Return authorization errors to custom scheme redirect URIs Pull request #26386
- Web/Flows: Render CAPTCHA widgets without iframe wrapper Pull request #26143
- Core: Remove legacy user and group attribute filters to improve query performance Pull request #25802
- Core: Add filter for application entitlements for bound users Pull request #26384
- Web/Elements: Add Paginator component and revise Table and DualSelect Pull request #26327
- Core: Remove unnecessary DISTINCT from users list when filtering by type Pull request #26413
- Blueprints: Add admin interface to read-only role Pull request #26363
- Internal/Utils: Add X25519MLKEM768 support for LDAP hybrid cryptography Pull request #26368
- Stages/Email: Fix error when recovering with admin-generated token Pull request #24409
- Core: Fix client certificate header forwarded to mTLS stage Pull request #26438
- Web/Elements: Fix scroll sticking when too many tables are visible Pull request #26423
- Web/Admin: Fix device view page and outpost view page Pull request #26383
- Web/Admin: Add user deletion to detail view Pull request #26397
- Packages/Django-Dramatiq-Postgres: Reconcile pending tasks during continuous notifications Pull request #26152
This week: blueprints export with references for portability, IPv6 RAC endpoints work, OAuth2 native app errors route correctly, and user filtering performance improves.
This week in authentik: exported blueprints are now re-importable across instances thanks to reference-based exports. IPv6 RAC endpoints parse correctly, OAuth2 native apps receive proper error responses, CAPTCHA widgets render without iframe wrappers, and legacy user attribute filters that caused performance issues are removed. Also added: standardized pagination components, read-only blueprint access, and X25519MLKEM768 hybrid crypto support for LDAP.
Week of September 14, 2026
What shipped
- Released version 2026.8.3 with fixes for file search, API autocomplete, blueprints, and Docker Compose configuration. Release
- Fixed migration failures occurring when upgrading from 2026.5.7 to 2026.8.2 due to inconsistent migration history. Pull request #26208
- Replaced ESLint and Prettier with Oxlint and Oxfmt for faster web linting and formatting. Pull request #26061
- Converted all JSDoc types to TypeScript using Node's built-in type stripping, bringing type safety to build scripts and web modules. Pull request #25525
- Fixed RAC browser WebSocket disconnects by implementing Guacamole instruction parsing and ping echo handling. Pull request #26207
- Added GitLab compatibility option to the web SCIM form that was missing from the 2026.8 release. Pull request #26154
- Fixed admin sidebar expansion regression and added persistence of expansion state to session storage. Pull request #26218
- Static authenticator tokens now display in hyphenated groups and accept separators during verification. Pull request #26251
- RADIUS property mappings now support returning additional properties as dictionaries and continue processing after mapping failures. Pull request #26029
- Documented percent-encoding of proxy headers to prevent failures in upstream applications with non-ASCII header values. Pull request #26093
Why it matters
This week includes a critical maintenance release fixing upgrade failures, substantial web tooling improvements for developer experience, and bug fixes for WebSocket stability and UI regressions. TypeScript adoption across the web build pipeline strengthens type safety going forward.
Changelog entry
- 2026.8.3 released with file search, API autocomplete, and blueprint fixes Release
- Core: fix migrations for 2026.5.7 to 2026.8.2 upgrade path Pull request #26208
- Web: replace ESLint/Prettier with Oxlint/Oxfmt Pull request #26061
- Web: convert JSDoc types to TypeScript Pull request #25525
- Providers/rac: fix WebSocket disconnects by parsing Guacamole instructions Pull request #26207
- Web/scim: add GitLab compatibility option Pull request #26154
- Web/router: fix sidebar expansion and add persistence Pull request #26218
- Stages/authenticator_static: display tokens in hyphenated groups with separator support Pull request #26251
- Providers/radius: allow returning properties as dictionaries and continue on mapping failure Pull request #26029
- Website/docs: document percent-encoding for proxy headers Pull request #26093
2026.8.3 released: upgrade path fixed, RAC WebSocket stability improved, web tooling upgraded to Oxlint/Oxfmt, and sidebar persistence restored.
Authentik 2026.8.3 is out. This release fixes migration failures from earlier versions, restores the admin sidebar expansion behavior, improves WebSocket stability for RAC sessions, and replaces ESLint/Prettier with faster Oxlint/Oxfmt tooling. The web build pipeline is now fully TypeScript for better type safety.