version/2025.10.1
goauthentik/authentikversion/2025.10.1Nov 3, 2025by authentik-automation[bot]
Upgrading?
AI Summary
This patch release addresses security and stability concerns, including fixing missing JWT headers in proxy providers and validating PKCE verifier lengths. It also fixes Radius provider crashes and reverts a change to message authenticator validation.
Key Highlights
- Fixed missing JWT/claims header in proxy providers
- Made PKCE verifier 128 characters
- Fixed Radius panic when no cert is configured
- Fixed OAuth2 encryption key field positioning
- Fixed Radius message authenticator validation (reverted)
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2025.10#fixed-in-2025101 ## What's Changed * website/docs: fix placeholder leftover (cherry-pick #17737 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17738 * root: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17757 * providers/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17764 * sources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17765 * providers/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17766 * providers/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17729 * packages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17767 * tasks: delay startup signals (cherry-pick #17769 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17775 * root: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17798 * internal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17824 * ci: rework internal repo (#17797) by @BeryJu in https://github.com/goauthentik/authentik/pull/17829 * internal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17832 * web/admin: fix scim provider form (cherry-pick #17831 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17834 * core: bump astral-sh/uv from 0.9.5 to 0.9.6 (cherry-pick #17820 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17835 * tasks: sanitize log attributes (cherry-pick #17833 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17842 * outposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17841 * outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17848 * internal: full openssl path (cherry-pick #17856 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17860 * web: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17859 * web/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17828 * providers/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17888 * providers/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17916 * providers/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17917 * website/docs: 2025.10.1 release notes (cherry-pick #17918 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/17919 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.10.0...version/2025.10.1
Related Repositories
public-apis/public-apis★ 491,218
A collective list of free APIs
NousResearch/hermes-agent★ 256,089
The agent that grows with you
yt-dlp/yt-dlp★ 200,265
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,562
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.