authentik

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202658

What's Changed

• ci: remove the Google Chrome apt source in setup (cherry-pick #25990 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26011
• lib/expression: fix PickleError due to resolver match when using ak_call_policy (cherry-pick #25763 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26071
• web/source/flows: fix flicker after webauthn (cherry-pick #25454 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25835
• core: bump rustls (cherry-pick #26142 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26144
• website: add umami (cherry-pick #26460 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26462
• packages/django-channels-postgres: refresh pool credentials on connection attempts (cherry-pick #26505 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26549
• web/flows: check if localStorage is available for continuous login (cherry-pick #26267 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26639
• root: don't fail websocket connections with non-UTF-8 headers (cherry-pick #26688 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26707
• stages/consent: fix integrity error when re-consenting after consent expired (cherry-pick #26866 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26871
• ci: switch version bump to action, like platform repo (cherry-pick #26949 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/26951
• root: bump cert-related deps due to emudhra (cherry-pick #27068 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/27070

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.5.7...version/2026.5.8

See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202684

What Changed in 2026.8.4

• common/saml: Fix metadata to serve only the leaf of a PEM chain (#26273)
• core: handle overflow in duration validation (#26680)
• endpoints: fix error during device lookup with one identifier missing (#26902)
• endpoints: retain last fact snapshot (#26343)
• enterprise/requests: show message after successful request (#26587)
• events: fix group membership changes with OSS audit middleware (#26477)
• flows: allow unauthenticated flows for re-authentication (#26785)
• lifecycle: fix AWS cloudformation template defaults (#26807)
• outposts/proxy: don't negotiate HTTP/2 to upstreams (#26281)
• outposts/proxy: fetch embedded JWKS over the unix socket, not the browser host (#26448)
• outposts/proxy: use HTTP/1.1 for OAuth backchannel requests (#26422)
• packages/ak-axum/extract/client_ip: use the leftmost X-Forwarded-For IP (#26353)
• packages/ak-common/config: fix list values from env variables parsing (#26081)
• packages/django-channels-postgres: refresh pool credentials on connection attempts (#26505)
• providers/proxy: fix startup reconcile not being atomic (#26344)
• providers/scim: accept a service provider that reports bulk as unsupported (#25057)
• providers/scim: fix scim user conflict resolution (#25998)
• providers/scim: show remote error details for 4xx/5xx responses (#26906)
• root, web, docs: revert pnpm to 11.20.0 on version-2026.8 (#26366)
• root: don't fail websocket connections with non-UTF-8 headers (#26688)
• root: fix client certificate header forwarded to the mTLS stage (#26438)
• root: log full stacktrace for ASGI exception (#26415)
• sources/kerberos, sources/ldap: Save source connections when linking an existing user/group (#26059)
• sources/saml: Fallback NameID (#25713)
• stages/consent: fix integrity error when re-consenting after consent expired (#26866)
• web: Close command palette when opening About (#25734)
• web: Fix denied template static form layout. (#26733)
• web: Fix disabled token icon buttons. (#25527)
• web: resolve themed icon URLs everywhere (#25103)
• web/admin: fix device view page and outpost view page (#26383)
• web/admin: restore file upload capability check (#26556)
• web/admin: show agent connector local auth & compliance status (#26610)
• web/admin: update oauth federated provider helptext wording (#26611)
• web/elements: reload edit forms after cancel and on pk change (#26892)
• web/flows: check if localStorage is available for continuous login (#26267)
• web/flows: fix layout shift once initial challenge is loaded (#26758)
• web/user: fix requests banner wording (#26586)
• web/user: remove slug display in any display mode on the user application library page (#26441)

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.8.2...version/2026.8.3

See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202683

What's Changed

• admin/files: make file search case-insensitive (#25736)
• api: include JSON field relation models in search autocomplete (#26153)
• blueprints: fix employee_department typo (#26046)
• change docker compose to compose (#26087)
• core: fix migrations (version-2026.8) (cherry-pick #26208) (#26209)
• events: Note in logs when an agent makes a call (#26146)
• flows: strip login_hint from next on cancel to prevent loop (#26111)
• outposts: refresh sessions when impersonation changes (#26086)
• packages/ak-axum/extract/client_ip: support X-Forwarded-For with ports (#25682)
• policies: fix policybinding cache invalidation (#25989)
• providers/ldap: fix memory leak in the cached searcher (#26028)
• providers/oauth: handle token exchange when no signing key is set (#26049)
• providers/oauth2: only expose URL-based avatars as picture claim (#26080)
• root: document CNA in SECURITY.md (#26124)
• root: fix metric gauges for multiprocessor mode (#25882)
• server: preserve websocket close code when proxying to outposts (#26090)
• sources/saml: Register ID attributes (#25706)
• web/flows: fix hardcoded locale in identification stage's OR_LIST_FORMATTERS (#26017)
• web/scim: Add gitlab compatibility option to form (#26154)

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.8.2...version/2026.8.3

See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202682