version/2025.12.2

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025122


## What's Changed
* website/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19503
* sources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19523
* tests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19532
* website/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19534
* admin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19553
* admin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19575
* core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19578
* website/docs: add s3 perms (cherry-pick #19579 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19581
* web: update @goauthentik/api (cherry-pick #19542 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19589
* web/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19582
* endpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19610
* policies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19615
* providers/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19613
* providers/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19612
* sources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19614
* tests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19611
* lib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19617
* website/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19622
* web/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19626
* web/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19636
* website/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19642
* website/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19646
* web/a11y: Locale selector select styles, contrast. (cherry-pick #19634 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19651
* website/docs: update LDAP search permission instructions (cherry-pick #19676 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19678
* web/maintenance: no unknown tag names (cherry-pick #18944 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19637
* providers/oauth2: add `logout+jwt` token type for oidc logout token. (cherry-pick #19554 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19675
* web/maintenance: no missing element type definitions (cherry-pick #18950 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19638
* web/maintenance/no unknown attributes (part 1) (cherry-pick #18970 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19639
* sources/saml: Set AuthnRequest ProtocolBinding to HTTP-POST instead of HTTP-Redirect (cherry-pick #17378 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19649
* web/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19635
* web/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19682
* internal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19703
* sources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19704
* core: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19710
* web/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19712
* web/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19765
* root: update client-go generation (cherry-pick #19762 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19791
* web/elements: reduce spacing between collapsible form groups (cherry-pick #19627 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19640
* web/elements: stabilize dual-select status height (cherry-pick #19734 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19776
* website/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19771
* website/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19790
* website/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19816
* providers/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19853
* sources/saml: properly catch InvalidSignature exception (cherry-pick #19641 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19650
* sources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19854
* website/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19855
* website/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19866
* admin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19793
* web/table: align row action icons and tooltip color (cherry-pick #19736 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19773
* web/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19685
* web/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19656
* web: Session UI Config Lifecycle (cherry-pick #19788 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19821
* website/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19877
* web: Enforce `challenge` nullish types. (cherry-pick #19768 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19777


**Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.12.1...version/2025.12.2