What goauthentik/authentik shipped
Written by FoxPlug from the repository's own releases; not affiliated with Goauthentik. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/goauthentik/authentik; Goauthentik did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Added a Microsoft Intune device connector under enterprise endpoints. Pull request #23947
- SCIM providers now reconcile users after application binding, membership and group ancestry changes by queuing bounded background jobs. Pull request #27438
- OAuth2 provider max_age=0 now forces the user to log in again as prompt=login does, and negative or non-numeric values return an error. Pull request #27518
- LDAP sources now store the directory password change date (pwdLastSet or krbLastPwdChange) when resetting a password. Pull request #27578
- Unique attribute checks no longer flag the object being saved as a conflict with itself. Pull request #27693
- Read-only prompt fields now preserve empty initial values as defaults so optional text and text-area prompts can be submitted. Pull request #25148
- Added a policy dry run UI with a dry-run switch on policy, user and group binding forms and status shown in binding lists and the application wizard. Pull request #26621
- Expired cache, message and group-channel records are now cleaned up in batches of up to 1,000 rows using SELECT FOR UPDATE SKIP LOCKED. Pull request #27587
- Bundled MaxMind GeoLite2 databases were replaced with the free DB-IP Lite City and ASN databases, growing the image by about 75 MB uncompressed. Pull request #27102
- The authenticator validate stage now reuses a pending WebAuthn challenge until it is answered, removed or skipped, avoiding challenge races. Pull request #26291
Why it matters
This week touches several areas users depend on daily: OAuth2 login behavior, SCIM access reconciliation, LDAP password sync and policy dry runs. Several fixes also smooth out the admin interface and background cleanup, making the project more predictable to operate.
Changelog entry
- Added a Microsoft Intune device connector. Pull request #23947
- SCIM providers reconcile users after application binding, membership and group ancestry changes. Pull request #27438
- OAuth2 max_age=0 now forces re-authentication; invalid values return an error. Pull request #27518
- LDAP password resets now store the directory's password change date. Pull request #27578
- Unique attribute validation no longer treats the edited object as a conflict. Pull request #27693
- Read-only prompt fields preserve empty initial values as defaults. Pull request #25148
- Added a policy dry run UI to binding forms, binding lists and the application wizard. Pull request #26621
- Expired cache, message and channel records are cleaned up in batches. Pull request #27587
- Bundled GeoIP databases switched from MaxMind GeoLite2 to DB-IP Lite. Pull request #27102
- Authenticator validate stage keeps the pending WebAuthn challenge stable until answered. Pull request #26291
- OAuth2 provider no longer sets state in responses when it was not supplied. Pull request #9735
- Added a Google Cloud Workforce Identity Federation integration guide. Pull request #27571
This week: an Intune device connector, SCIM access reconciliation after binding changes, OAuth2 max_age=0 now forcing re-login, LDAP password reset storing directory dates, and a policy dry run UI.
This week's changes: a new Microsoft Intune device connector, SCIM providers reconciling users after application binding, membership and group ancestry changes, and OAuth2 max_age=0 now forcing re-login as prompt=login does. LDAP password resets now store the directory's change date, unique attribute checks skip the object being edited, read-only prompts keep empty initial values, and expired cache and channel records are cleaned up in batches. The admin interface gained a policy dry run UI, and bundled GeoIP databases moved from MaxMind GeoLite2 to DB-IP Lite.
Week of October 26, 2026
What shipped
- Added required actions, an Enterprise feature, where a user's goauthentik.io/user/required-actions attribute lists flows they must complete before they can use authentik. Pull request #24846
- Added a required actions card to the user page for adding and removing a user's required actions without editing their attributes. Pull request #24850
- The server now strips hop-by-hop headers and every header they name before forwarding a request to the application. Pull request #27191
- Outpost.build_user_permissions() now compares needed permissions with the managed role's existing ones, deleting only stale rows and creating only missing ones, with an endpoint added to rebuild them. Pull request #26928
- The Envoy forward auth endpoint now builds the post-login redirect from X-Forwarded-Host when the request comes from a trusted proxy, and Host otherwise. Pull request #26888
- Outgoing sync providers now report which object failed and the remote system's response while continuing with the next object instead of failing the sync. Pull request #27287
- Clicking Retry authentication during WebAuthn validation now refreshes the flow challenge from the server to start a new ceremony. Pull request #26616
- The blueprint hash now also covers current!Env values, so discovery reapplies a blueprint when one of those variables changes. Pull request #26932
- The policy engine skips expensive
select_subclasseswhen no policy is bound and no longer writes to cache unless it reads from cache. Pull request #27396
Why it matters
This week adds required actions as a new Enterprise feature with a user page card and documentation, letting admins make users complete flows before using authentik. Several fixes make deployment under a non-root web path work for outposts and the URLs the web interfaces build. Policy and sync changes also reduce wasted database work and keep a failing object from stopping an entire sync.
Changelog entry
- Enterprise: add required actions for users, stored in the goauthentik.io/user/required-actions attribute Pull request #24846
- Web/admin: add a required actions card to the user page Pull request #24850
- Website/docs: document required actions and link them from the password reset guides Pull request #24847
- Server: strip hop-by-hop headers before forwarding requests to the application Pull request #27191
- Web: build URLs starting at the web base path, including the RAC tunnel and notifications websockets Pull request #27291
- Outposts: write only changed permissions in
build_user_permissionsand add an endpoint to rebuild them Pull request #26928 - Outposts/proxy: honor X-Forwarded-Host in envoy forward auth redirects Pull request #26888
- Lib/sync/outgoing: report conflicting objects with the remote response and continue the sync Pull request #27287
- Web/flow: refresh the WebAuthn challenge when the user retries authentication Pull request #26616
- Blueprints: reapply when!Env values change and include those values in the hash Pull request #26932
- Policies: skip
select_subclasseswhen no policy is bound and skip cache writes when not reading from cache Pull request #27396
Required actions shipped this week: list flows a user must complete before using authentik, with a card on the user page. Outposts and web URLs now keep the web path, sync reports conflicting objects and continues, and the policy engine skips work when no policy is bound.
Week of October 19, 2026
What shipped
- SAML and WS-FED providers now let you pick the encryption algorithm, and the default moves from AES128-CBC to AES256-GCM. Pull request #27009
- SAML source metadata now advertises AES256-GCM by default to tell identity providers which encryption algorithm to use. Pull request #27010
- Entra login scopes and group membership requests now follow the configured profile URL, so national cloud Graph hosts such as graph.microsoft.us are used. Pull request #27091
- Release 2026.8.5 shipped with fixes including a MultipleObjectsReturned fix in endpoints and skipping members already in the group for Entra. Release
- Release 2026.5.8 shipped with fixes including the Chrome apt source removal in CI and a PickleError fix for
ak_call_policy. Release - Added a distroless version of the server container image. Pull request #26321
- The django-postgres-cache package reverted to plain SQL instead of the ORM, taking a cache get hit from 539 to 205 microseconds. Pull request #27146
- The TypeScript client package now generates imports with.js extensions and uses nodenext as a proper ESM package. Pull request #27029
- Node.js 24.22.1 is now the minimum required version, fixing five high-severity CVEs in TLS, DNS and Brotli. Pull request #27093
- SAML source response processing errors are now logged while users see a generic message. Pull request #27012
Why it matters
This week brought two maintenance releases plus security- and correctness-focused changes for SAML, Entra and local sources. Users of SAML and WS-FED get a stronger default encryption algorithm and control over the algorithm used, and admins running Entra in national clouds get group membership from the right Graph host.
Changelog entry
- SAML and WS-FED providers: selectable encryption algorithm, default changed to AES256-GCM Pull request #27009
- SAML sources: advertise AES256-GCM encryption algorithm to identity providers by default Pull request #27010
- OAuth sources: Entra national cloud group membership uses the configured profile URL Pull request #27091
- SAML sources: log response processing errors and show users a generic message Pull request #27012
- LDAP sources: fixed the password write error message Pull request #27076
- Release 2026.8.5 Release
- Release 2026.5.8 Release
- Container: added a distroless server image Pull request #26321
- Django-postgres-cache: reverted to plain SQL instead of the ORM Pull request #27146
- Client-ts: generated imports now use.js extensions Pull request #27029
- Root: require Node.js 24.22.1 Pull request #27093
- Web: fixed table fetch races and search select lookups Pull request #27059
SAML and WS-FED providers can now pick their encryption algorithm, defaulting to AES256-GCM. Entra national cloud group membership uses the configured Graph host. Releases 2026.8.5 and 2026.5.8 are out, plus a distroless server image and Node.js 24.22.1 as the minimum.
This week's work: SAML and WS-FED providers let you select the encryption algorithm, with the default moving to AES256-GCM, and SAML source metadata now advertises AES256-GCM to identity providers. Entra login and group membership requests follow the configured profile URL so national cloud Graph hosts work. Releases 2026.8.5 and 2026.5.8 are out with their fixes, a distroless server image is now available, the Postgres cache package reverted to plain SQL for faster cache hits, and Node.js 24.22.1 is the new minimum. SAML source errors are logged while users see a generic message.
Week of October 12, 2026
What shipped
- Released version 2026.8.4, which fixes SAML metadata serving only the leaf of a PEM chain, handles overflow in duration validation, and fixes a device lookup error when an identifier is missing. Release
- Authenticator validation stages now restrict code verification to the device classes the stage permits, so a TOTP code can no longer satisfy an email-only stage. Pull request #26779
- Token list responses now prefetch token owners' groups and roles, avoiding repeated database lookups when many tokens share an owner. Pull request #25803
- Added generation and storage of ML-DSA certificates for post-quantum support, working only when FIPS is disabled until OpenSSL 3.4+ is FIPS compliant. Pull request #26380
- The WebAuthn setup stage now accepts ML-DSA credentials by overriding the default algorithm list, while avoiding suggesting the algorithm to browsers that may error on unknown algorithms. Pull request #26381
- The Microsoft Entra provider now lists a group's current members in Entra and adds only the missing authentik members, skipping the listing for groups with no synced members. Pull request #26891
- Blueprints now re-apply when a file referenced through a!File tag changes, so rotating a mounted Kubernetes Secret no longer leaves the change-detection hash unchanged. Pull request #26402
- Adding another user after a stale session save no longer signs out the current account. Pull request #26765
- The consent stage deletes expired consents for the application before saving a new one, fixing an integrity error when re-consenting after expiry. Pull request #26866
- The WebAuthn setup stage now treats an unparsable attestation certificate as a normal failed registration with a warning log instead of a system exception. Pull request #26811
Why it matters
This week brought a security release plus fixes for stage behavior that users could hit directly, including authenticator code restrictions and consent re-saving. Token list performance and Entra group syncing reduce repeated backend work, and the WebAuthn and certificate changes start preparation for post-quantum support. Several documentation and integration guides were also added or expanded.
Changelog entry
- Release 2026.8.4: SAML metadata serves only the leaf of a PEM chain, duration validation overflow handled, device lookup error fixed. Release
- Authenticator validation restricts code verification to permitted device classes. Pull request #26779
- Token list prefetches user groups and roles. Pull request #25803
- Add ML-DSA certificate generation and storage, FIPS disabled only. Pull request #26380
- WebAuthn setup stage accepts ML-DSA credentials. Pull request #26381
- WebAuthn stage handles unparsable attestation certificates as failed registrations. Pull request #26811
- Entra provider skips members already in the group when writing groups. Pull request #26891
- Blueprints re-apply when a file referenced by!File changes. Pull request #26402
- Adding a user after a stale session save keeps the current login. Pull request #26765
- Consent stage deletes expired consents before saving to avoid integrity errors. Pull request #26866
- Endpoints fix MultipleObjectsReturned. Pull request #26971
- CI uploads the latest CloudFormation template on release. Pull request #26954
Authentik 2026.8.4 is out with SAML metadata, duration validation and device lookup fixes. Authenticator stages now enforce code device restrictions, consent re-saving is fixed, and WebAuthn accepts ML-DSA credentials.
Release 2026.8.4 is out, fixing SAML metadata to serve only the leaf of a PEM chain, duration validation overflow, and device lookup errors when an identifier is missing. This week also tightened authenticator validation so code verification only uses permitted device classes, fixed consent re-saving after expiry, and added ML-DSA certificate generation and WebAuthn acceptance to start post-quantum support. Token lists now prefetch owners' groups and roles, and the Entra provider only adds missing group members.
Week of October 5, 2026
What shipped
- RBAC now denies unauthenticated object requests instead of failing with a server error. Pull request #26682
- The users/me endpoint no longer erases session data saved by concurrent requests. Pull request #26790
- FLows can now be run without authentication for re-authentication. Pull request #26785
- OAuth sources support public keys for PKCE flows, making client secrets optional. Pull request #20151
- Outgoing sync providers no longer create duplicate groups when provisioning tasks overlap. Pull request #25997
- The LDAP provider keeps its cached directory when a refresh fetch fails. Pull request #26420
- Entra ID OAuth group pagination now follows every Microsoft Graph nextLink. Pull request #26497
- Logout is allowed while flows are unfinished, limited to iframe logout callbacks. Pull request #26565
- Ak-search-select is rebuilt as a form-associated element with a native combobox input and popover listbox. Pull request #25610
- The LDAP source form now saves its parent group and admin table flakiness in end-to-end tests is fixed. Pull request #26568
Why it matters
This week fixed several cases where sessions, permissions and provisions could go wrong: unauthenticated object requests now get a clean denial, users/me no longer wipes session data written by concurrent requests, re-authentication flows are allowed without authentication, and overlapping outgoing sync tasks no longer create duplicate groups. LDAP, OAuth and Entra ID sources also got more reliable, with a cached directory kept on failed refresh fetches and full pagination of Entra ID group memberships. The search select element and the LDAP source form in the web interface were reworked for correct behavior.
Changelog entry
- Website/integrations: link authentik concepts in setup intros Pull request #26815
- Core: add validation for property mapping return types Pull request #26806
- Rbac: deny unauthenticated object requests instead of failing with a server error Pull request #26682
- Core: stop users/me from erasing session data saved by concurrent requests Pull request #26790
- Flows: allow unauthenticated flows for re-authentication Pull request #26785
- Sources/oauth: support public keys for PKCE flows Pull request #20151
- Lib/sync/outgoing: prevent duplicate group creation in outgoing providers Pull request #25997
- Providers/ldap: keep cached directory when a refresh fetch fails Pull request #26420
- Sources/oauth: fix Entra ID group pagination Pull request #26497
- Providers/oauth2: allow logout with unfinished flows Pull request #26565
- Web/elements: rebuild ak-search-select as a form-associated element Pull request #25610
- Web: save the LDAP source's parent group; fix e2e flakes Pull request #26568
RBAC denies unauthenticated object requests. users/me no longer erases session data. PKCE flows support public keys. Outgoing sync no longer creates duplicate groups. LDAP keeps cached directory on fetch failure. Entra ID group pagination fixed. ak-search-select rebuilt as form-a
Several fixes landed for authentik this week. RBAC now denies unauthenticated object requests instead of returning a server error. The users/me endpoint no longer erases session data saved by concurrent requests, and re-authentication flows can run without authentication. OAuth sources support public keys for PKCE flows so client secrets are optional, and outgoing sync providers no longer create duplicate groups when tasks overlap. The LDAP provider keeps its cached directory when a refresh fetch fails, and Entra ID OAuth group pagination now follows every Microsoft Graph nextLink. Logout is allowed while flows are unfinished where appropriate, the ak-search-select element was rebuilt as a form-associated element, and the LDAP source form now saves its parent group.
Week of September 28, 2026
What shipped
- Policies now support dry-run bindings that evaluate without affecting access decisions, reporting observations through policy execution events. Pull request #26382
- Locale preference now persists in a cookie and reloads the page when changed, fixing mixed language state issues. Pull request #25156
- The UI preloads locale catalogs to prevent a flash of untranslated English content on non-English pages. Pull request #25157
- Application list cache timeout is now configurable through a new cache.timeout_application_policies setting. Pull request #26596
- Client IP is now included in the user application cache key to fix caching issues when users connect from different IPs. Pull request #26553
- Superuser annotation in the user API was split into two EXISTS subqueries for improved query performance. Pull request #26275
- An expensive query in policy-related code was removed, speeding up enterprise requests. Pull request #26666
- Old Chrome versions now use SFE for better compatibility. Pull request #26594
- MFA login no longer generates spurious model update events for authenticators, reducing noise and SSF-related re-authentication requests. Pull request #26584
- Duration validation now catches overflow errors and converts them to proper validation errors. Pull request #26680
Why it matters
This week brings fixes for caching issues that affected user experience across different networks, performance improvements for policy evaluation and user queries, and better handling of localization to prevent UI flickering. Several changes target reliability and correctness in authentication and policy enforcement.
Changelog entry
- Policies: support dry-run bindings with event reporting for policy and user/group bindings Pull request #26382
- Web/i18n, core: persist locale in cookie and reload page on language change Pull request #25156
- Web/i18n, core: preload locale catalog to prevent flash of untranslated content Pull request #25157
- Core: make application list cache timeout configurable via cache.timeout_application_policies Pull request #26596
- Core/applications: include
client_ipin user application cache key Pull request #26553 - Core: optimize superuser annotation query with two EXISTS subqueries Pull request #26275
- Policies: remove expensive query from enterprise/requests flow Pull request #26666
- Web/flows: use SFE for old Chrome versions Pull request #26594
- Stages/authenticator_validate: prevent model update events during MFA login Pull request #26584
- Core: handle overflow errors in duration validation Pull request #26680
- Web/flows: check localStorage availability for continuous login Pull request #26267
- Core, web: update Russian translations Pull request #26624
Week 24 ships: dry-run policy bindings, locale persistence, configurable cache timeouts, client IP in cache keys, and fixes for spurious MFA events and query performance.
This week's release improves caching behavior for multi-network users, adds dry-run support for policies with event reporting, fixes locale flash issues, and reduces noisy events during MFA login. Performance gains come from query optimization and an expensive policy query removal. Configuration is more flexible with the new cache timeout setting.
Week of September 21, 2026
What shipped
- Blueprints now export with references, fixing the long-standing issue that exported blueprints couldn't be re-imported in different authentik instances due to hardcoded primary keys. Pull request #26069
- RAC provider now correctly parses IPv6 literal endpoint hosts like [2001:1234::1]:5900 instead of splitting incorrectly on the first colon. Pull request #24465
- OAuth2 provider now returns authorization errors to custom scheme redirect URIs used by native apps, instead of bare HTTP 400 responses. Pull request #26386
- CAPTCHA widgets in flows now render without iframe wrappers, resolving providers directly via challenge
js_urlinstead of window global sniffing. Pull request #26143 - Removed legacy user and group attribute filters that inefficiently loaded all matching objects before pagination, causing performance issues. Pull request #25802
- Core now filters application entitlements for bound users, improving efficiency when querying user-specific application access. Pull request #26384
- Added new Paginator component and revised Table and DualSelect to use standardized pagination across the web interface. Pull request #26327
- Email stage now handles errors correctly when recovering with admin-generated tokens. Pull request #24409
- Blueprints admin interface now available to read-only role, allowing broader access to blueprint management. Pull request #26363
- LDAP now supports X25519MLKEM768 hybrid cryptographic key when using TLS. Pull request #26368
Why it matters
This week brings significant infrastructure improvements: blueprints are now portable across instances, IPv6 and OAuth2 native apps work correctly, and performance issues with user filtering are resolved. The UI also gets better consistency with standardized pagination and improved CAPTCHA rendering.
Changelog entry
- Blueprints: Export with references instead of hardcoded primary keys for cross-instance portability Pull request #26069
- Providers/RAC: Fix IPv6 literal endpoint host parsing Pull request #24465
- Providers/OAuth2: Return authorization errors to custom scheme redirect URIs Pull request #26386
- Web/Flows: Render CAPTCHA widgets without iframe wrapper Pull request #26143
- Core: Remove legacy user and group attribute filters to improve query performance Pull request #25802
- Core: Add filter for application entitlements for bound users Pull request #26384
- Web/Elements: Add Paginator component and revise Table and DualSelect Pull request #26327
- Core: Remove unnecessary DISTINCT from users list when filtering by type Pull request #26413
- Blueprints: Add admin interface to read-only role Pull request #26363
- Internal/Utils: Add X25519MLKEM768 support for LDAP hybrid cryptography Pull request #26368
- Stages/Email: Fix error when recovering with admin-generated token Pull request #24409
- Core: Fix client certificate header forwarded to mTLS stage Pull request #26438
- Web/Elements: Fix scroll sticking when too many tables are visible Pull request #26423
- Web/Admin: Fix device view page and outpost view page Pull request #26383
- Web/Admin: Add user deletion to detail view Pull request #26397
- Packages/Django-Dramatiq-Postgres: Reconcile pending tasks during continuous notifications Pull request #26152
This week: blueprints export with references for portability, IPv6 RAC endpoints work, OAuth2 native app errors route correctly, and user filtering performance improves.
This week in authentik: exported blueprints are now re-importable across instances thanks to reference-based exports. IPv6 RAC endpoints parse correctly, OAuth2 native apps receive proper error responses, CAPTCHA widgets render without iframe wrappers, and legacy user attribute filters that caused performance issues are removed. Also added: standardized pagination components, read-only blueprint access, and X25519MLKEM768 hybrid crypto support for LDAP.
Week of September 14, 2026
What shipped
- Released version 2026.8.3 with fixes for file search, API autocomplete, blueprints, and Docker Compose configuration. Release
- Fixed migration failures occurring when upgrading from 2026.5.7 to 2026.8.2 due to inconsistent migration history. Pull request #26208
- Replaced ESLint and Prettier with Oxlint and Oxfmt for faster web linting and formatting. Pull request #26061
- Converted all JSDoc types to TypeScript using Node's built-in type stripping, bringing type safety to build scripts and web modules. Pull request #25525
- Fixed RAC browser WebSocket disconnects by implementing Guacamole instruction parsing and ping echo handling. Pull request #26207
- Added GitLab compatibility option to the web SCIM form that was missing from the 2026.8 release. Pull request #26154
- Fixed admin sidebar expansion regression and added persistence of expansion state to session storage. Pull request #26218
- Static authenticator tokens now display in hyphenated groups and accept separators during verification. Pull request #26251
- RADIUS property mappings now support returning additional properties as dictionaries and continue processing after mapping failures. Pull request #26029
- Documented percent-encoding of proxy headers to prevent failures in upstream applications with non-ASCII header values. Pull request #26093
Why it matters
This week includes a critical maintenance release fixing upgrade failures, substantial web tooling improvements for developer experience, and bug fixes for WebSocket stability and UI regressions. TypeScript adoption across the web build pipeline strengthens type safety going forward.
Changelog entry
- 2026.8.3 released with file search, API autocomplete, and blueprint fixes Release
- Core: fix migrations for 2026.5.7 to 2026.8.2 upgrade path Pull request #26208
- Web: replace ESLint/Prettier with Oxlint/Oxfmt Pull request #26061
- Web: convert JSDoc types to TypeScript Pull request #25525
- Providers/rac: fix WebSocket disconnects by parsing Guacamole instructions Pull request #26207
- Web/scim: add GitLab compatibility option Pull request #26154
- Web/router: fix sidebar expansion and add persistence Pull request #26218
- Stages/authenticator_static: display tokens in hyphenated groups with separator support Pull request #26251
- Providers/radius: allow returning properties as dictionaries and continue on mapping failure Pull request #26029
- Website/docs: document percent-encoding for proxy headers Pull request #26093
2026.8.3 released: upgrade path fixed, RAC WebSocket stability improved, web tooling upgraded to Oxlint/Oxfmt, and sidebar persistence restored.
Authentik 2026.8.3 is out. This release fixes migration failures from earlier versions, restores the admin sidebar expansion behavior, improves WebSocket stability for RAC sessions, and replaces ESLint/Prettier with faster Oxlint/Oxfmt tooling. The web build pipeline is now fully TypeScript for better type safety.