version/2026.2.0

See https://docs.goauthentik.io/docs/releases/2026.2

## What's Changed
* root: bump version to 2026.2.0-rc1 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18794
* tests/e2e: retry detached shadow roots by @melizeche in https://github.com/goauthentik/authentik/pull/18796
* website/release notes: Update v2025.12 release notes by @melizeche in https://github.com/goauthentik/authentik/pull/18797
* web/admin: fix read-only provider selection for application form by @dominic-r in https://github.com/goauthentik/authentik/pull/18768
* web: bump the react group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18775
* web: bump chromedriver from 143.0.0 to 143.0.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18776
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18774
* internal: don't warn on empty outpost for embedded by @BeryJu in https://github.com/goauthentik/authentik/pull/18786
* lifecycle/aws: bump aws-cdk from 2.1033.0 to 2.1034.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18771
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18804
* root: Add macOS support for sed in Makefile by @melizeche in https://github.com/goauthentik/authentik/pull/18795
* ci: bump astral-sh/setup-uv from 7.1.5 to 7.1.6 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18826
* ci: bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18824
* core: bump goauthentik/fips-debian from `07f41ce` to `c10cd2c` by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18822
* ci: bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18825
* ci: bump actions/cache from 5.0.0 to 5.0.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18823
* core: list applications fix by @ryanpesek in https://github.com/goauthentik/authentik/pull/18798
* website/docs: add icon info to style guide by @dewi-tik in https://github.com/goauthentik/authentik/pull/18832
* core: remove superuser check from `Token` list by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18684
* packages/django-dramatiq-postgres: broker: close django connections on consumer close by @rissson in https://github.com/goauthentik/authentik/pull/18833
* core: bump goauthentik.io/api/v3 from 3.2025120.26 to 3.2026020.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18815
* admin/files: revert add check for /media existence (#18636) by @rissson in https://github.com/goauthentik/authentik/pull/18829
* website/docs: add jellyseer integration doc by @gabay in https://github.com/goauthentik/authentik/pull/18812
* crypto: Store details parsed from includeDetails in database instead by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/18013
* core: skip s3 tests if endpoint isn't available by @melizeche in https://github.com/goauthentik/authentik/pull/18841
* admin/files: fix get_objects_for_user queryset argument in FileUsedByView by @dominic-r in https://github.com/goauthentik/authentik/pull/18845
* core: bump goauthentik/fips-debian from `c10cd2c` to `2f19fc1` by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18856
* ci: replace codecov test-results action by @BeryJu in https://github.com/goauthentik/authentik/pull/18862
* core: add skip s3_test_server_available to TestResolveFileUrlS3Backend by @melizeche in https://github.com/goauthentik/authentik/pull/18858
* rbac: alter migrated direct permission roles by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18860
* core: bump library/golang from `5d35fb8` to `8e8f9c8` by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18855
* web/admin/rbac: misc object permission fixes by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18859
* outposts: fix permission errors for related certificates by @BeryJu in https://github.com/goauthentik/authentik/pull/18861
* website/docs: adjust RBAC-related details in 2025.12 release notes by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18863
* website/docs: Add docs for passkey autofill (WebauthN Conditional UI) by @melizeche in https://github.com/goauthentik/authentik/pull/18805
* website/docs: 2025.10.3 release notes by @BeryJu in https://github.com/goauthentik/authentik/pull/18868
* web: add custom message with links for empty data export list by @atereshkin in https://github.com/goauthentik/authentik/pull/18830
* web: fix notification counter by @atereshkin in https://github.com/goauthentik/authentik/pull/18781
* web: bump vite from 7.2.7 to 7.3.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18854
* stages/authenticator_*: fix code input field not string by @BeryJu in https://github.com/goauthentik/authentik/pull/18875
* web: fix file upload form by @dominic-r in https://github.com/goauthentik/authentik/pull/18808
* web/admin: endpoint: change wording and add helper text by @dewi-tik in https://github.com/goauthentik/authentik/pull/18871
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18807
* website/integrations: bookstack: fix redir url by @dominic-r in https://github.com/goauthentik/authentik/pull/18891
* core: bump astral-sh/uv from 0.9.17 to 0.9.18 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18898
* core: bump goauthentik/fips-debian from `2f19fc1` to `189345a` by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18897
* web: bump knip from 5.73.3 to 5.74.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18896
* web: bump @types/node from 25.0.0 to 25.0.3 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18895
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18852
* web: bump the bundler group across 1 directory with 7 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18894
* web: bump @sentry/browser from 10.30.0 to 10.31.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18893
* lifecycle/aws: bump aws-cdk from 2.1034.0 to 2.1100.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18850
* web: bump the goauthentik group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18819
* web: bump the swc group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18818
* web: bump the eslint group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18851
* core: bump goauthentik.io/api/v3 from 3.2026020.1 to 3.2026020.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18892
* tasks/middleware: close connections on worker status update database error by @rissson in https://github.com/goauthentik/authentik/pull/18881
* website/docs: added list of Int Guide contributors (also edited frontmatter) by @tanberry in https://github.com/goauthentik/authentik/pull/18888
* api: fix page_size with invalid query param by @rissson in https://github.com/goauthentik/authentik/pull/18879
* ci/release-tag: checkout correct branch for make test-docker by @rissson in https://github.com/goauthentik/authentik/pull/18880
* api: fix latest version for public schema by @BeryJu in https://github.com/goauthentik/authentik/pull/18902
* website/docs: 2025.12: remove superfluous changes by @rissson in https://github.com/goauthentik/authentik/pull/18910
* web/admin: reword some things on the device view page by @BeryJu in https://github.com/goauthentik/authentik/pull/18785
* core/groups: optimize prefetch queries to fetch only required fields by @joaocfernandes in https://github.com/goauthentik/authentik/pull/18448
* root: fix docker-compose data mount by @rissson in https://github.com/goauthentik/authentik/pull/18903
* web/admin: add UI copy to RBAC modal by @tanberry in https://github.com/goauthentik/authentik/pull/18917
* tests/e2e: handle StaleElementReferenceException in parse_json_content by @melizeche in https://github.com/goauthentik/authentik/pull/18842
* core: bump goauthentik/fips-debian from `189345a` to `10dadf1` by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18927
* web: bump chromedriver from 143.0.1 to 143.0.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18926
* web: bump knip from 5.74.0 to 5.75.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18924
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18920
* lifecycle/aws: bump aws-cdk from 2.1100.0 to 2.1100.1 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18922
* web: bump the swc group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18923
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18817
* stages: remove more global state by @BeryJu in https://github.com/goauthentik/authentik/pull/18641
* packages/ak-guardian: cast safely by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18929
* web/flow: Fix spurious double submit  on ak-stage-autosubmit by @dminuoso in https://github.com/goauthentik/authentik/pull/18727
* website/integrations: Add launch URL for Immich by @optix2000 in https://github.com/goauthentik/authentik/pull/18921
* crypto: fix extra cert data in db migration by @rissson in https://github.com/goauthentik/authentik/pull/18937
* web/elements: progress-bar and table loading header by @BeryJu in https://github.com/goauthentik/authentik/pull/18934
* stages/identification: replace sleep with make_password by @BeryJu in https://github.com/goauthentik/authentik/pull/18883
* website/docs: endpoint devices by @dewi-tik in https://github.com/goauthentik/authentik/pull/18634
* website/docs: Fix labels, Pre-Release detection by @GirlBossRush in https://github.com/goauthentik/authentik/pull/18945
* website/docs: release notes: add endpoint device links to 2025.12 notes by @dewi-tik in https://github.com/goauthentik/authentik/pull/18940
* website/docs: Fix version parsing. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/18948
* web/admin: fix endpoints user binding by @BeryJu in https://github.com/goauthentik/authentik/pull/18935
* flows/executor: fix KeyError when session has no existing plan by @dominic-r in https://github.com/goauthentik/authentik/pull/18951
* root: move docker files to lifecycle/containers and change docker-compose to compose by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/16624
* core: bump goauthentik.io/api/v3 from 3.2026020.3 to 3.2026020.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18956
* web: bump chromedriver from 143.0.2 to 143.0.3 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18959
* web: bump the swc group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18958
* web: bump @sentry/browser from 10.31.0 to 10.32.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18957
* ci: bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18960
* website/docs: add note to active directory source doc by @dewi-tik in https://github.com/goauthentik/authentik/pull/18787
* web/maintenance: fix missing custom web component imports by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/18942
* web/maintenance: no unknown tag names by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/18944
* website/integrations: Fix path for Cloudflare Access by @stijn220 in https://github.com/goauthentik/authentik/pull/18979
* blueprints: add InternallyManagedMixin instead of large list by @BeryJu in https://github.com/goauthentik/authentik/pull/18983
* web/admin: fix dark theme on map by @BeryJu in https://github.com/goauthentik/authentik/pull/18985
* web/admin: Fix haveibeenpwned link in PasswordPolicyForm by @hskrtich in https://github.com/goauthentik/authentik/pull/18984
* events: notifications live update by @BeryJu in https://github.com/goauthentik/authentik/pull/18980
* web: fix Open button selecting row instead of navigating by @dominic-r in https://github.com/goauthentik/authentik/pull/18992
* blueprints: fix flaky tests by @BeryJu in https://github.com/goauthentik/authentik/pull/19002
* ci: bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18999
* providers/oauth2: Automated OpenID Conformance tests by @BeryJu in https://github.com/goauthentik/authentik/pull/14785
* enterprise/reports: improve export list, confirmation by @BeryJu in https://github.com/goauthentik/authentik/pull/18981
* enterprise/search: add static autocomplete structure by @BeryJu in https://github.com/goauthentik/authentik/pull/19008
* website/docs: improve endpoint devices docs by @dewi-tik in https://github.com/goauthentik/authentik/pull/19007
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18994
* core: bump openapitools/openapi-generator-cli from v7.16.0 to v7.18.0 in /scripts/api by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19018
* web: bump globby from 16.0.0 to 16.1.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/18995
* api: rework schema generation by @BeryJu in https://github.com/goauthentik/authentik/pull/18977
* web/admin: prevent file upload attempt when backend not managed by @BeryJu in https://github.com/goauthentik/authentik/pull/18646
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19019
* core: bump goauthentik.io/api/v3 from 3.2026020.4 to 3.2026020.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19017
* website/docs: Prioritize "Release Candidate" over "Current Release" by @GirlBossRush in https://github.com/goauthentik/authentik/pull/18975
* web: Locale selector UI fixes by @GirlBossRush in https://github.com/goauthentik/authentik/pull/18972
* web: Fix Storybook package resolution with `npm link` by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19016
* core: use chunked_queryset for expired message deletion by @BeryJu in https://github.com/goauthentik/authentik/pull/19028
* web/admin: use consistent icon for inactive user status by @dominic-r in https://github.com/goauthentik/authentik/pull/19032
* web: bump lit from 3.3.1 to 3.3.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19038
* web: bump @lit/reactive-element from 2.1.1 to 2.1.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19037
* web: bump knip from 5.75.1 to 5.77.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19041
* core: bump goauthentik.io/api/v3 from 3.2026020.5 to 3.2026020.6 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19036
* docs/release notes: update 2025.12 release notes by @melizeche in https://github.com/goauthentik/authentik/pull/19043
* lib/sync: fix sync_dispatch by @krejcar25 in https://github.com/goauthentik/authentik/pull/19053
* endpoints/devices: cleanup  by @BeryJu in https://github.com/goauthentik/authentik/pull/19047
* blueprints: set enrollment token key by @BeryJu in https://github.com/goauthentik/authentik/pull/19061
* website/integrations: Add Wallos by @0skater0 in https://github.com/goauthentik/authentik/pull/19013
* website/docs: FreeIPA documentation updates by @borutmrak in https://github.com/goauthentik/authentik/pull/15183
* *: Auto compress images by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19065
* blueprints: fix deadlock and task context error in MetaApplyBlueprint by @dominic-r in https://github.com/goauthentik/authentik/pull/19033
* web: fix file search input not resetting results properly by @dominic-r in https://github.com/goauthentik/authentik/pull/19034
* website/integrations: owncloud: fix php by @ocmateusz in https://github.com/goauthentik/authentik/pull/19073
* tests/e2e: add endpoint tests by @BeryJu in https://github.com/goauthentik/authentik/pull/19072
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18991
* web: bump knip from 5.77.0 to 5.77.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19049
* web: bump @lit/localize-tools from 0.8.0 to 0.8.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19040
* internal: update TLS Suite by @BeryJu in https://github.com/goauthentik/authentik/pull/19076
* web: bump @formatjs/intl-listformat from 7.7.13 to 8.1.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19054
* web/admin: fix button alignment on user view page by @BeryJu in https://github.com/goauthentik/authentik/pull/19079
* website/docs: endpoints: mention connector key required for stage to work by @dominic-r in https://github.com/goauthentik/authentik/pull/19084
* website/docs: rel notes .12: add wallos by @dominic-r in https://github.com/goauthentik/authentik/pull/19063
* website/docs: endpoint devices: update features table by @dewi-tik in https://github.com/goauthentik/authentik/pull/19094
* website/docs: endpoint devices: add path to macos setup by @dewi-tik in https://github.com/goauthentik/authentik/pull/19093
* web: bump knip from 5.77.1 to 5.78.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19090
* web: fix promoted source button hover losing blue color by @dominic-r in https://github.com/goauthentik/authentik/pull/19048
* web: Fix stale flow background by @dominic-r in https://github.com/goauthentik/authentik/pull/19015
* Update Vaultwarden documentation by removing warning by @austin-dudzik in https://github.com/goauthentik/authentik/pull/19102
* web/maintenance/no unknown attributes (part 1) by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/18970
* website/integrations: Add Pulse by @0skater0 in https://github.com/goauthentik/authentik/pull/19105
* website/integrations: Add Audiobookshelf by @0skater0 in https://github.com/goauthentik/authentik/pull/19104
* website/docs: release notes: Add more integrations by @dominic-r in https://github.com/goauthentik/authentik/pull/19109
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19111
* core: bump library/nginx from `fb01117` to `ad85427` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19112
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19110
* web: Fix Impersonation, Lit Reactive Controller Contexts by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19114
* web: Capitalize language display names, code owner fix by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19119
* core: bump library/nginx from `ad85427` to `ca871a8` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19126
* web: bump the swc group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19124
* core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19088
* core: bump library/node from `ccfd9da` to `03729a7` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19125
* core, web: bump qs from 6.14.0 to 6.14.1 in /packages/docusaurus-config by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19130
* website/integrations: karakeep: don't hardcode wellknown's slug by @pippo73 in https://github.com/goauthentik/authentik/pull/19127
* web: disable user settings fields when changes are not allowed by @dominic-r in https://github.com/goauthentik/authentik/pull/19132
* website/docs: endpoint agent release notes by @BeryJu in https://github.com/goauthentik/authentik/pull/19042
* website/docs: fix build by @BeryJu in https://github.com/goauthentik/authentik/pull/19148
* web: Token Form Fixes by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19121
* web/user: fix consent delete form missing details by @BeryJu in https://github.com/goauthentik/authentik/pull/19147
* web: bump globals from 16.5.0 to 17.0.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19154
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19135
* ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19138
* website/integrations: vaultwarden: add custom email scope by @williamkray in https://github.com/goauthentik/authentik/pull/19160
* stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19137
* core: handle deserialization errors from FileField migration by @dominic-r in https://github.com/goauthentik/authentik/pull/19067
* web: fix slug auto-updating when editing existing applications by @dominic-r in https://github.com/goauthentik/authentik/pull/19169
* web: Fix user library colors, modal z-indexes, table progress bars by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19152
* web/admin: adjust sync threshold, add tooltip by @BeryJu in https://github.com/goauthentik/authentik/pull/19131
* website/docs: remove duplicates in slo docs by @nmasnadithya in https://github.com/goauthentik/authentik/pull/19170
* lifecycle: fix migration conn_options for psycopg connection by @D-Tasker207 in https://github.com/goauthentik/authentik/pull/19134
* web: bump knip from 5.78.0 to 5.79.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19181
* ci: bump getsentry/action-release from 3.4.0 to 3.5.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19183
* web: bump @formatjs/intl-listformat from 8.1.0 to 8.1.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19182
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19179
* lib: update error logging by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/18628
* website/integrations: make grafana terraform section expand by @BeryJu in https://github.com/goauthentik/authentik/pull/19192
* core: add prettier failure on duplicate group names by @gergosimonyi in https://github.com/goauthentik/authentik/pull/18941
* web/maintenance: no missing element type definitions by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/18950
* root: codespell: ignore Python virtual env, group patterns. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19180
* web: Merge branch -- Stale notifications, synchronized context objects, rendering fixes by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19141
* website/docs: Add docs for roles by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19196
* web: Defer table refresh, visibility checks. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19194
* rbac: Add show all to roles tab, add role tab to groups by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19097
* website/docs: rewrite section about users and perms by @tanberry in https://github.com/goauthentik/authentik/pull/19195
* core: add last_login filter to users API by @dominic-r in https://github.com/goauthentik/authentik/pull/18993
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19205
* admin/files: support %(theme)s variable in media file paths by @dominic-r in https://github.com/goauthentik/authentik/pull/19108
* website/integrations: glpi: add step by @dewi-tik in https://github.com/goauthentik/authentik/pull/19208
* web: bump knip from 5.79.0 to 5.80.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19207
* core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19204
* lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19203
* core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19202
* translate: Updates for project authentik and language pt_BR by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/19082
* web/maintenance: lint pass to add missing HTMLElementEventMap entries by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/18953
* outpost/proxyv2: reduce max number of postgres connections by @rissson in https://github.com/goauthentik/authentik/pull/19211
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19200
* website/docs: revisit endpoint docs the nth by @BeryJu in https://github.com/goauthentik/authentik/pull/19116
* ci: bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19221
* endpoints: include license status in agent config by @BeryJu in https://github.com/goauthentik/authentik/pull/19227
* web: bump @formatjs/intl-listformat from 8.1.1 to 8.1.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19220
* lifecycle/aws: bump aws-cdk from 2.1100.2 to 2.1100.3 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19219
* core: bump goauthentik.io/api/v3 from 3.2026020.7 to 3.2026020.8 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19218
* stages/authenticator_static: set max token length to 100 chars by @dominic-r in https://github.com/goauthentik/authentik/pull/19162
* website/glossary: improve by @dominic-r in https://github.com/goauthentik/authentik/pull/18969
* core: fix read replica routing during transactions by @dominic-r in https://github.com/goauthentik/authentik/pull/19086
* website: Fix typos. by @dominic-r in https://github.com/goauthentik/authentik/pull/19243
* core: bump goauthentik.io/api/v3 from 3.2026020.8 to 3.2026020.10 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19242
* website/integrations: update AWS by @dewi-tik in https://github.com/goauthentik/authentik/pull/17861
* website/docs: update github social login script example by @busybox11 in https://github.com/goauthentik/authentik/pull/19246
* web: bump vite from 7.3.0 to 7.3.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19245
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19206
* stages/prompt: optimize API endpoints by @rissson in https://github.com/goauthentik/authentik/pull/19251
* website/docs: update entra id provider docs by @dewi-tik in https://github.com/goauthentik/authentik/pull/18366
* website/integations: fix aws spelling by @dewi-tik in https://github.com/goauthentik/authentik/pull/19253
* stages/password: replace session-based retries with reputation by @BeryJu in https://github.com/goauthentik/authentik/pull/18643
* web: bump chromedriver from 143.0.3 to 143.0.4 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19244
* web/admin: add banner to flow import form by @BeryJu in https://github.com/goauthentik/authentik/pull/19288
* core: bump django from v5.2.9 to 5.2.10 by @melizeche in https://github.com/goauthentik/authentik/pull/19290
* endpoints: show agent version by @BeryJu in https://github.com/goauthentik/authentik/pull/19239
* core: bump urllib3 from 2.5.0 to v2.6.3 by @melizeche in https://github.com/goauthentik/authentik/pull/19287
* web: bump knip from 5.80.0 to 5.80.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19301
* web: Fix flow inspector advancement event. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19309
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19237
* website/docs: deprecate GCDT auth stage by @dewi-tik in https://github.com/goauthentik/authentik/pull/19306
* website/docs: Fix typo in GitHub OAuth Source instructions by @tcrasset in https://github.com/goauthentik/authentik/pull/18936
* website/docs: update m2m doc by @dewi-tik in https://github.com/goauthentik/authentik/pull/18963
* website/docs: Fix documentation example for `app_entitlements_attributes`. by @sebastianw in https://github.com/goauthentik/authentik/pull/19316
* website/docs: add flow import warnings by @dewi-tik in https://github.com/goauthentik/authentik/pull/19307
* web: bump pino from 10.1.0 to 10.1.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19333
* web: bump knip from 5.80.1 to 5.80.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19332
* core: bump axllent/mailpit from v1.28.1 to v1.28.2 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19329
* web: bump @types/node from 25.0.3 to 25.0.6 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19331
* core: bump library/nginx from `ca871a8` to `7272239` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19334
* website/docs: update unique email policy by @dewi-tik in https://github.com/goauthentik/authentik/pull/19305
* web: bump @types/react from 19.2.7 to 19.2.8 in /web in the react group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19330
* web: Images styles, theming by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19233
* website/docs: update LDAP provider docs by @dewi-tik in https://github.com/goauthentik/authentik/pull/18272
* web: Flow info, localization, back button. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19234
* web: bump type-fest from 5.3.1 to 5.4.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19354
* core: bump goauthentik.io/api/v3 from 3.2026020.10 to 3.2026020.11 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19300
* ci: bump actions/setup-go from 6.1.0 to 6.2.0 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19352
* web: bump the bundler group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19349
* ci: bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19351
* web: bump @sentry/browser from 10.32.1 to 10.33.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19347
* web: bump @types/node from 25.0.6 to 25.0.7 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19353
* core: bump library/nginx from `7272239` to `06eb0c8` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19350
* packages/django-dramatiq-postgres: broker: empty message after task completed successfully by @rissson in https://github.com/goauthentik/authentik/pull/19340
* core: bump jsii from 1.120.0 to v1.125.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19268
* core: bump microsoft-kiota-abstractions from 1.9.7 to v1.9.8 by @melizeche in https://github.com/goauthentik/authentik/pull/19270
* core: bump microsoft-kiota-serialization-json from 1.9.7 to v1.9.8 by @melizeche in https://github.com/goauthentik/authentik/pull/19272
* core: bump orjson from 3.11.4 to v3.11.5 by @melizeche in https://github.com/goauthentik/authentik/pull/19276
* core: bump platformdirs from 4.5.0 to v4.5.1 by @melizeche in https://github.com/goauthentik/authentik/pull/19278
* core: bump protobuf from 6.33.1 to v6.33.2 by @melizeche in https://github.com/goauthentik/authentik/pull/19280
* core: bump ua-parser-builtins from 0.18.0.post1 to v202601 by @melizeche in https://github.com/goauthentik/authentik/pull/19286
* core: bump cbor2 from 5.7.1 to v5.8.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19263
* core: bump microsoft-kiota-serialization-multipart from 1.9.7 to v1.9.8 by @melizeche in https://github.com/goauthentik/authentik/pull/19273
* core: bump microsoft-kiota-serialization-form from 1.9.7 to v1.9.8 by @melizeche in https://github.com/goauthentik/authentik/pull/19271
* core: bump boto3 from 1.42.1 to v1.42.24 by @melizeche in https://github.com/goauthentik/authentik/pull/19261
* core: bump pynacl from 1.6.1 to v1.6.2 by @melizeche in https://github.com/goauthentik/authentik/pull/19281
* core: bump opentelemetry-api from 1.39.0 to v1.39.1 by @melizeche in https://github.com/goauthentik/authentik/pull/19275
* core: bump pathspec from 0.12.1 to v1.0.2 by @melizeche in https://github.com/goauthentik/authentik/pull/19277
* core: bump jsonschema from 4.25.1 to v4.26.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19269
* core: bump txaio from 25.9.2 to v25.12.2 by @melizeche in https://github.com/goauthentik/authentik/pull/19284
* core: bump anyio from 4.12.0 to v4.12.1 by @melizeche in https://github.com/goauthentik/authentik/pull/19258
* core: bump aiohttp from 3.13.2 to v3.13.3 by @melizeche in https://github.com/goauthentik/authentik/pull/19257
* core: bump google-auth-httplib2 from 0.2.1 to v0.3.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19266
* core: bump sqlparse from 0.5.4 to v0.5.5 by @melizeche in https://github.com/goauthentik/authentik/pull/19283
* core: bump certifi from 2025.11.12 to v2026.1.4 by @melizeche in https://github.com/goauthentik/authentik/pull/19264
* core: bump autobahn from 25.11.1 to v25.12.2 by @melizeche in https://github.com/goauthentik/authentik/pull/19259
* core: bump pyparsing from 3.2.5 to v3.3.1 by @melizeche in https://github.com/goauthentik/authentik/pull/19282
* core: bump types-requests from 2.32.4.20250913 to v2.32.4.20260107 by @melizeche in https://github.com/goauthentik/authentik/pull/19285
* core: bump greenlet from 3.2.4 to v3.3.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19267
* core: bump google-auth from 2.43.0 to v2.47.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19265
* core: bump azure-core from 1.36.0 to v1.37.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19260
* internal: rework liveness probe and proxy by @BeryJu in https://github.com/goauthentik/authentik/pull/19312
* core: bump proto-plus from 1.26.1 to v1.27.0 by @melizeche in https://github.com/goauthentik/authentik/pull/19279
* core: bump microsoft-kiota-serialization-text from 1.9.7 to v1.9.8 by @melizeche in https://github.com/goauthentik/authentik/pull/19274
* core: bump google-api-core from 2.28.1 to v2.29.0 by @rissson in https://github.com/goauthentik/authentik/pull/19359
* core: bump pathspec from 1.0.2 to v1.0.3 by @rissson in https://github.com/goauthentik/authentik/pull/19363
* core: bump azure-core from 1.37.0 to v1.38.0 by @rissson in https://github.com/goauthentik/authentik/pull/19357
* web/admin: always retrieve selected provider when editing the application by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/19341
* revert: web: disable user settings fields when changes are not allowed by @BeryJu in https://github.com/goauthentik/authentik/pull/19230
* core: bump zope-interface from 8.1.1 to v8.2 by @rissson in https://github.com/goauthentik/authentik/pull/19367
* core: bump protobuf from 6.33.2 to v6.33.4 by @rissson in https://github.com/goauthentik/authentik/pull/19365
* core: bump prometheus-client from 0.23.1 to v0.24.0 by @rissson in https://github.com/goauthentik/authentik/pull/19364
* internal/outpost: improve PostgreSQL connection options parsing by @dominic-r in https://github.com/goauthentik/authentik/pull/19118
* outpost/proxyv2: fix stale session cookie causing 400 error in createState by @dominic-r in https://github.com/goauthentik/authentik/pull/19026
* website/docs: update location for logs on windows by @BeryJu in https://github.com/goauthentik/authentik/pull/19371
* core: bump boto3 from 1.42.24 to v1.42.26 by @rissson in https://github.com/goauthentik/authentik/pull/19358
* web/elements: hidden secrets not propagating by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/19029
* core: bump websockets from 15.0.1 to v16.0 by @rissson in https://github.com/goauthentik/authentik/pull/19366
* core: bump httplib2 from 0.31.0 to v0.31.1 by @rissson in https://github.com/goauthentik/authentik/pull/19360
* core: bump microsoft-kiota-authentication-azure from 1.9.7 to v1.9.8 by @rissson in https://github.com/goauthentik/authentik/pull/19361
* stages/authenticator_validate: decrease reputation on failed MFA attempt by @BeryJu in https://github.com/goauthentik/authentik/pull/19378
* core: bump microsoft-kiota-http from 1.9.7 to v1.9.8 by @rissson in https://github.com/goauthentik/authentik/pull/19362
* web: UI Locale Fixes by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19235
* website/integrations: Add DataDog by @dominic-r in https://github.com/goauthentik/authentik/pull/19320
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19348
* core: Update supported versions in SECURITY.md by @melizeche in https://github.com/goauthentik/authentik/pull/19385
* website/docs: update gws provider docs by @dewi-tik in https://github.com/goauthentik/authentik/pull/18286
* web/admin: Pluralize Certificate-Key Pair deletion confirmation by @dominic-r in https://github.com/goauthentik/authentik/pull/19389
* website/docs: mention dynamic overrides in redirect stage documentation by @severin in https://github.com/goauthentik/authentik/pull/19368
* web: bump @types/node from 25.0.7 to 25.0.8 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19392
* website/docs: add import to discord policy by @dewi-tik in https://github.com/goauthentik/authentik/pull/19397
* website/docs: remove "beta" tag from 2025.12 by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19404
* core: bump library/node from `03729a7` to `6222695` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19393
* core: bump library/nginx from `06eb0c8` to `e3a22a7` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19394
* core: bump xmlsec from 1.3.16 to 1.3.17 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19411
* core: bump lxml from 6.0.0 to 6.0.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19409
* core: bump black from 25.1.0 to 25.12.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19412
* core: bump drf-orjson-renderer from 1.7.3 to 1.8.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19415
* core: bump python-kadmin-rs from 0.6.1 to 0.6.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19416
* core: bump ruff from 0.11.9 to 0.14.11 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19410
* core: bump pdoc from 15.0.3 to 16.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19413
* core: bump bpython from 0.25 to 0.26 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19408
* core: bump wsproto from 1.2.0 to 1.3.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19417
* website/docs: add 2026.2 release notes draft page by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19418
* core: remove session migration by @rissson in https://github.com/goauthentik/authentik/pull/14568
* core: bump debugpy from 1.8.14 to 1.8.19 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19414
* core: bump geoip2 from 5.1.0 to 5.2.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19429
* core: bump importlib-metadata from 8.6.1 to 8.7.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19430
* web/startup: deprecated theme names break theming by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/19431
* core: bump freezegun from 1.5.1 to 1.5.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19423
* core: bump bandit from 1.8.3 to 1.9.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19422
* core: bump pyyaml from 6.0.2 to 6.0.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19426
* core: bump django-stubs[compatible-mypy] from 5.2.5 to 5.2.8 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19424
* core: bump django-pgtrigger from 4.15.2 to 4.17.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19428
* core: bump aws-cdk-lib from 2.188.0 to 2.234.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19427
* core: bump pytest from 8.3.5 to 9.0.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19425
* core: bump types-ldap3 from 2.9.13.20250622 to 2.9.13.20251121 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19438
* core: bump django-pglock from 1.7.2 to 1.8.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19437
* core: bump cryptography from 45.0.5 to 46.0.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19439
* core: bump pydantic from 2.11.7 to 2.12.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19435
* core: bump twilio from 9.7.0 to 9.9.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19434
* core: bump sentry-sdk from 2.33.2 to 2.49.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19441
* core: bump coverage[toml] from 7.8.0 to 7.13.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19446
* core: bump setproctitle from 1.3.6 to 1.3.7 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19447
* core: bump django-filter from 25.1 to 25.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19444
* core: bump paramiko from 3.5.1 to 4.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19440
* core: bump gssapi from 1.9.0 to 1.10.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19436
* core: bump fido2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19445
* core: bump webauthn from 2.6.0 to 2.7.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19442
* core: bump uvicorn[standard] from 0.35.0 to 0.40.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19453
* core: bump psycopg[c,pool] from 3.2.9 to 3.3.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19452
* core: bump djangorestframework-stubs[compatible-mypy] from 3.16.3 to 3.16.7 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19449
* core: bump pytest-randomly from 3.16.0 to 4.0.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19456
* core: bump structlog from 25.4.0 to 25.5.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19450
* core: bump constructs from 10.4.2 to 10.4.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19451
* core: bump msgraph-sdk from 1.39.0 to 1.52.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19454
* core: bump selenium from 4.32.0 to 4.39.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19455
* core: bump google-api-python-client from 2.177.0 to 2.188.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19443
* core: bump mypy from 1.18.2 to 1.19.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19457
* core: bump channels from 4.3.1 to 4.3.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19458
* root: Python 3.14 by @BeryJu in https://github.com/goauthentik/authentik/pull/17313
* ci: fix checkout stable (for 2025.12) by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19448
* lib: use orjson for structlog json by @BeryJu in https://github.com/goauthentik/authentik/pull/19462
* root: upgrade ruff lint for 3.14 by @BeryJu in https://github.com/goauthentik/authentik/pull/19461
* website/integrations: add MinIO AIStor configuration via environment variables by @Fredouye in https://github.com/goauthentik/authentik/pull/19337
* web: bump prettier from 3.7.4 to 3.8.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19471
* core: bump library/node from 25.2.1-trixie to 25.3.0-trixie in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19468
* core: bump library/nginx from `e3a22a7` to `c881927` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19469
* stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19464
* revert: lib: use orjson for structlog json by @BeryJu in https://github.com/goauthentik/authentik/pull/19478
* providers/oauth2: allow property mappings to override scope claim in access tokens by @JMLX42 in https://github.com/goauthentik/authentik/pull/19226
* root: adjust makefile for non-brew macos by @BeryJu in https://github.com/goauthentik/authentik/pull/19479
* endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext by @BeryJu in https://github.com/goauthentik/authentik/pull/19482
* website/docs: limiting permissions of AD service account by @dewi-tik in https://github.com/goauthentik/authentik/pull/19483
* endpoints/connectors/agent: add tests for IA endpoint stage by @BeryJu in https://github.com/goauthentik/authentik/pull/19487
* web: Z-Index Fixes, Mobile Sidebar Behavior. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19460
* web/admin: fix switches by @BeryJu in https://github.com/goauthentik/authentik/pull/19493
* lifecycle: re-add quoted types for gunicorn config by @BeryJu in https://github.com/goauthentik/authentik/pull/19500
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19386
* website/docs: release notes: Update release notes for version 2025.12.1 by @melizeche in https://github.com/goauthentik/authentik/pull/19502
* sources/kerberos: update to new python-kadmin-rs by @rissson in https://github.com/goauthentik/authentik/pull/19491
* root, web: Bump package-lock.json by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19501
* lifecycle/aws: bump aws-cdk from 2.1100.3 to 2.1101.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19510
* core: bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19507
* web: bump @sentry/browser from 10.33.0 to 10.34.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19466
* web: bump pino from 10.1.1 to 10.2.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19474
* web: bump knip from 5.80.2 to 5.81.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19475
* core: bump aws-cdk-lib from 2.234.1 to 2.235.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19511
* core: bump github.com/getsentry/sentry-go from 0.40.0 to 0.41.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19508
* core: bump ruff from 0.14.11 to 0.14.13 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19513
* core: bump kubernetes from 33.1.0 to 35.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19514
* ci: bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19470
* ci: bump actions/setup-node from 6.1.0 to 6.2.0 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19472
* web: bump @types/node from 25.0.8 to 25.0.9 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19516
* web: bump @formatjs/intl-listformat from 8.1.2 to 8.2.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19515
* website: Omit Drafts From Version Picker by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19505
* tests/e2e: Add delay and serialized rollback to saml e2e test by @melizeche in https://github.com/goauthentik/authentik/pull/18840
* core: bump pyasn1 from 0.6.1 to 0.6.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19531
* website/integrations: portainer: add automatic team management instructions by @DonQuinleone in https://github.com/goauthentik/authentik/pull/19530
* website/docs: endpoint devices: update device code flow instructions by @dewi-tik in https://github.com/goauthentik/authentik/pull/19528
* *: Auto compress images by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19533
* admin/files: fix manageable check blocking file creation on fresh installs by @dominic-r in https://github.com/goauthentik/authentik/pull/19547
* admin/files: fix duplicate bucket name in presigned URLs with custom domain by @dominic-r in https://github.com/goauthentik/authentik/pull/19537
* ci: bump actions/cache from 5.0.1 to 5.0.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19571
* core: bump constructs from 10.4.4 to 10.4.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19563
* core: bump axllent/mailpit from v1.28.2 to v1.28.3 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19565
* ci: bump int128/docker-manifest-create-action from 2.12.0 to 2.13.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19572
* website/docs: add s3 perms by @dewi-tik in https://github.com/goauthentik/authentik/pull/19579
* web/forms: fix invalid date error for empty datetime-local inputs by @dominic-r in https://github.com/goauthentik/authentik/pull/19561
* website/docs: add Arcane integration by @steilerDev in https://github.com/goauthentik/authentik/pull/19584
* core: bump black from 25.12.0 to 26.1.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19567
* core: bump bandit from 1.9.2 to 1.9.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19566
* web: update @goauthentik/api by @Ma27 in https://github.com/goauthentik/authentik/pull/19542
* tests: improve e2e/integration test reliability by @BeryJu in https://github.com/goauthentik/authentik/pull/19540
* web: bump knip from 5.81.0 to 5.82.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19603
* web: bump pino from 10.2.0 to 10.2.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19602
* web: bump the swc group across 1 directory with 12 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19601
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19600
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19599
* core: bump aws-cdk-lib from 2.235.0 to 2.235.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19598
* web: bump @sentry/browser from 10.34.0 to 10.35.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19597
* core: bump fido2 from 2.1.0 to 2.1.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19596
* core: bump openapitools/openapi-generator-cli from v7.18.0 to v7.19.0 in /scripts/api by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19595
* core: bump goauthentik.io/api/v3 from 3.2026020.11 to 3.2026020.12 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19594
* core: bump selenium from 4.39.0 to 4.40.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19564
* endpoints: fix endpoints stage marked as enterprise by @BeryJu in https://github.com/goauthentik/authentik/pull/19607
* web: bump type-fest from 5.4.0 to 5.4.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19473
* policies: fix Providers authentication_flow not used when set by @BeryJu in https://github.com/goauthentik/authentik/pull/19609
* integrations: add saml steps to mattermost by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19590
* providers/saml: allow encryption certificates without private keys by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19526
* providers/saml: fix structure of encrypted saml assertion by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19592
* sources/saml: Fix signature verification order to accommodate encrypted assertions by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19593
* lib/sync/outgoing: handle deletions even if object does not exist in database by @rissson in https://github.com/goauthentik/authentik/pull/18968
* website/docs: endpoints devices: typo fix by @fheisler in https://github.com/goauthentik/authentik/pull/19621
* website/docs: sources: add keycloak by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19591
* web/user: fix Firefox for Android infinite render loop in user library by @Gulianrdgd in https://github.com/goauthentik/authentik/pull/19379
* web/forms: fix forms not resetting state when modal closes by @dominic-r in https://github.com/goauthentik/authentik/pull/19562
* web/elements: reduce spacing between collapsible form groups by @dominic-r in https://github.com/goauthentik/authentik/pull/19627
* website/docs: Update saml google workspace guide by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19624
* website/integrations: update qnap by @dewi-tik in https://github.com/goauthentik/authentik/pull/19644
* core: bump sentry-sdk from 2.49.0 to 2.50.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19630
* web: bump @types/react from 19.2.8 to 19.2.9 in /web in the react group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19631
* core: bump django-stubs[compatible-mypy] from 5.2.8 to 5.2.9 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19629
* core: bump github.com/pires/go-proxyproto from 0.8.1 to 0.9.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19628
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19535
* core: bump library/node from 25.3.0-trixie to 25.4.0-trixie in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19632
* website/docs: update endpoint agent windows log location by @BeryJu in https://github.com/goauthentik/authentik/pull/19645
* sources/saml: Set AuthnRequest ProtocolBinding to HTTP-POST instead of HTTP-Redirect by @ikob in https://github.com/goauthentik/authentik/pull/17378
* sources/saml: properly catch InvalidSignature exception by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19641
* web: Reduce Sentry Development Errors by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19504
* web/a11y: Locale selector select styles, contrast. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19634
* web/elements: remove pfbase everywhere by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/19623
* web/flows: update icon and text for device classes by @BeryJu in https://github.com/goauthentik/authentik/pull/19648
* web/admin: fix captcha stage provider selector not showing saved value by @dominic-r in https://github.com/goauthentik/authentik/pull/19555
* web: bump chromedriver from 143.0.4 to 144.0.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19668
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19654
* core: bump packaging from 25.0 to 26.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19659
* web: bump @sentry/browser from 10.35.0 to 10.36.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19660
* ci: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19662
* ci: bump actions/setup-python from 6.1.0 to 6.2.0 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19664
* core, web: bump lodash from 4.17.21 to 4.17.23 in /packages/docusaurus-config by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19655
* web: bump @types/node from 25.0.9 to 25.0.10 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19669
* web: bump prettier from 3.8.0 to 3.8.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19667
* web: bump country-flag-icons from 1.6.4 to 1.6.7 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19666
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19661
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19663
* web: bump core-js from 3.47.0 to 3.48.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19665
* providers/oauth2: add `logout+jwt` token type for oidc logout token. by @jeroen1602 in https://github.com/goauthentik/authentik/pull/19554
* website/docs: update LDAP search permission instructions by @dewi-tik in https://github.com/goauthentik/authentik/pull/19676
* sources/oauth: add fallback for id_token when profile URL is not available by @BeryJu in https://github.com/goauthentik/authentik/pull/19311
* website/docs: endpoint devices: add serial number note by @dewi-tik in https://github.com/goauthentik/authentik/pull/19677
* core: add bulk session revocation by @cdmx-in in https://github.com/goauthentik/authentik/pull/18564
* providers/proxy: Fix incorrect comparison of redirect URL and CookieDomain by @vitSkalicky in https://github.com/goauthentik/authentik/pull/15686
* web/admin: fix brand form sending "undefined" string for blank default application by @dominic-r in https://github.com/goauthentik/authentik/pull/19658
* web/admin: fix file upload not preserving extension for custom names with dots by @dominic-r in https://github.com/goauthentik/authentik/pull/19548
* web/common: add dev middleware to show warnings for consecutive identical requests by @BeryJu in https://github.com/goauthentik/authentik/pull/19671
* web: Form Modal Independence: Part 1 by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19395
* ci: bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19696
* web: bump globals from 17.0.0 to 17.1.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19695
* web: bump unist-util-visit from 5.0.0 to 5.1.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19694
* web: bump the bundler group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19693
* core: bump gunicorn from 23.0.0 to 24.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19692
* core: bump twilio from 9.9.1 to 9.10.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19691
* core: bump ruff from 0.14.13 to 0.14.14 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19690
* core: bump msgraph-sdk from 1.52.0 to 1.53.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19689
* core: bump goauthentik/selenium from 143.0-ak-0.35.3 to 144.0-ak-0.35.7 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19688
* lifecycle/aws: bump aws-cdk from 2.1101.0 to 2.1102.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19687
* core: bump goauthentik.io/api/v3 from 3.2026020.12 to 3.2026020.14 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19686
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19684
* internal: fix incorrect metric calculation by @BeryJu in https://github.com/goauthentik/authentik/pull/19701
* core: return bad request when user is authenticated and not active by @BeryJu in https://github.com/goauthentik/authentik/pull/19706
* web/admin: fix impersonation form requesting data without being opened by @BeryJu in https://github.com/goauthentik/authentik/pull/19673
* endpoints: FleetDM connector by @BeryJu in https://github.com/goauthentik/authentik/pull/18589
* endpoints/connectors/agent: fix icon by @BeryJu in https://github.com/goauthentik/authentik/pull/19722
* Makefile: add optional uv prefix by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19738
* website/integrations: paperless-ngx: Update by @dominic-r in https://github.com/goauthentik/authentik/pull/19718
* web: bump playwright from 1.57.0 to 1.58.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19755
* web: bump country-flag-icons from 1.6.7 to 1.6.8 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19754
* web: bump pino from 10.2.1 to 10.3.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19752
* core: bump gunicorn from 24.0.0 to 24.1.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19751
* core: bump coverage[toml] from 7.13.1 to 7.13.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19749
* core: bump cachetools from 6.2.4 to 6.2.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19750
* core: bump goauthentik/selenium from 144.0-ak-0.35.7 to 144.0-ak-0.35.8 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19747
* core: bump aws-cdk-lib from 2.235.1 to 2.236.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19745
* lifecycle/aws: bump aws-cdk from 2.1102.0 to 2.1103.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19744
* core: bump github.com/pires/go-proxyproto from 0.9.0 to 0.9.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19743
* core: bump axllent/mailpit from v1.28.3 to v1.28.4 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19748
* core: bump goauthentik.io/api/v3 from 3.2026020.14 to 3.2026020.15 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19742
* ci: fix typo in volume path by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19741
* core: bump djangoql from 0.18.1 to 0.18.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19746
* web: bump @playwright/test from 1.57.0 to 1.58.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19753
* enterprise/audit: Expanded Diff by @BeryJu in https://github.com/goauthentik/authentik/pull/19726
* root: make logged HTTP headers configurable by @BeryJu in https://github.com/goauthentik/authentik/pull/19716
* web/sfe: downgrade bootstrap, add access denied test by @BeryJu in https://github.com/goauthentik/authentik/pull/19763
* internal: fix certificate not refetched if fingerprint changes by @BeryJu in https://github.com/goauthentik/authentik/pull/19761
* root: update client-go generation by @rissson in https://github.com/goauthentik/authentik/pull/19762
* website/integrations: Add Elastic Cloud by @dominic-r in https://github.com/goauthentik/authentik/pull/19719
* website/docs: fix Transifex link in translation guide by @dominic-r in https://github.com/goauthentik/authentik/pull/19735
* web/table: align row action icons and tooltip color by @dominic-r in https://github.com/goauthentik/authentik/pull/19736
* web/a11y: CAPTCHA Stage Form by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19670
* web/elements: stabilize dual-select status height by @dominic-r in https://github.com/goauthentik/authentik/pull/19734
* web: Enforce `challenge` nullish types. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19768
* website/docs: endpoint devices: fix local device login by @dewi-tik in https://github.com/goauthentik/authentik/pull/19698
* ci: bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19783
* core: bump gssapi from 1.10.1 to 1.11.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19781
* core: bump openapitools/openapi-diff from 2.1.6 to 2.1.7 in /scripts/api by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19779
* core: bump github.com/pires/go-proxyproto from 0.9.1 to 0.9.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19778
* admin/files: add centralized theme variable support for file URLs by @dominic-r in https://github.com/goauthentik/authentik/pull/19657
* providers/oauth2: Support login_hint by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19498
* web: bump country-flag-icons from 1.6.8 to 1.6.9 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19785
* web: bump the react group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19784
* web: bump the eslint group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19782
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19717
* web: Vendor SFE Bootstrap by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19766
* core: bump djangoql from 0.18.2 to 0.19.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19780
* web: bump API Client version by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19760
* revert: website/integrations: wazuh: Change exchange key generation to 64 bytes by @dewi-tik in https://github.com/goauthentik/authentik/pull/19759
* sources/saml: Add testcases for PR #19593 by @ikob in https://github.com/goauthentik/authentik/pull/19647
* website/docs: fix authenticator sms docs by @macmoritz in https://github.com/goauthentik/authentik/pull/19797
* web: bump globals from 17.1.0 to 17.2.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19811
* web: bump type-fest from 5.4.1 to 5.4.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19810
* web: bump @types/react from 19.2.9 to 19.2.10 in /web in the react group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19809
* web: bump @goauthentik/api from 2025.12.0-rc1-1765566302 to 2026.2.0-rc1-1769523342 in /web in the goauthentik group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19808
* web: bump the swc group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19807
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19806
* core: bump library/node from 25.4.0-trixie to 25.5.0-trixie in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19805
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19804
* core: bump cachetools from 6.2.5 to 6.2.6 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19803
* core: bump cryptography from 46.0.3 to 46.0.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19801
* core: bump github.com/getsentry/sentry-go from 0.41.0 to 0.42.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19800
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19799
* web: bump @sentry/browser from 10.36.0 to 10.37.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19802
* web: bump @floating-ui/dom from 1.7.4 to 1.7.5 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19812
* enterprise/providers: WS-Federation by @BeryJu in https://github.com/goauthentik/authentik/pull/19583
* web: Session UI Config Lifecycle by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19788
* web/admin: fix toggle-group for bindings now showing up by @BeryJu in https://github.com/goauthentik/authentik/pull/19820
* core: add CC and BCC support to ak_send_email and TemplateEmailMessage by @melizeche in https://github.com/goauthentik/authentik/pull/19633
* web: display custom attributes on admin view pages by @dominic-r in https://github.com/goauthentik/authentik/pull/19720
* web: bump @types/node from 25.0.10 to 25.1.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19838
* web: bump chromedriver from 144.0.0 to 144.0.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19837
* web: bump country-flag-icons from 1.6.9 to 1.6.12 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19836
* web: bump @goauthentik/api from 2026.2.0-rc1-1769523342 to 2026.2.0-rc1-1769650973 in /web in the goauthentik group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19834
* core: bump sentry-sdk from 2.50.0 to 2.51.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19833
* ci: bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19835
* core: bump pyrad from 2.4 to 2.5.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19831
* core: bump goauthentik/selenium from 144.0-ak-0.35.8 to 144.0-ak-0.35.9 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19832
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19824
* core: bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19829
* lifecycle/aws: bump aws-cdk from 2.1103.0 to 2.1104.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19830
* providers/scim: import SCIM groups by @bitpavel-l25 in https://github.com/goauthentik/authentik/pull/19846
* providers/scim: modify user- and group syncing behavior by @ImmanuelVonNeumann in https://github.com/goauthentik/authentik/pull/13947
* providers/scim: fix email validation mismatch by @BeryJu in https://github.com/goauthentik/authentik/pull/19848
* sources/oauth: Fix an issue where wechat may crash duing login. by @Anduin2017 in https://github.com/goauthentik/authentik/pull/18973
* website/docs: add more info to entra id scim doc by @dewi-tik in https://github.com/goauthentik/authentik/pull/19849
* web: bump API Client version by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19851
* rbac: clean up roles and permissions by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19588
* web: bump API Client version by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19857
* website/docs: add tip for recovering from accidental main branch work by @dominic-r in https://github.com/goauthentik/authentik/pull/19865
* web: Fix development theme overrides by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19826
* web: Lit Development Mode, performance fixes. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19825
* root: assign cherry-pick PRs to original author by @melizeche in https://github.com/goauthentik/authentik/pull/19858
* web: Captcha Refinements, Part 2  by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19757
* web: bump chromedriver from 144.0.1 to 145.0.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19874
* ci: bump actions/cache from 5.0.2 to 5.0.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19873
* core: bump debugpy from 1.8.19 to 1.8.20 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19872
* web: bump @sentry/browser from 10.37.0 to 10.38.0 in /web in the sentry group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19871
* common: introduce common by @BeryJu in https://github.com/goauthentik/authentik/pull/19852
* website/docs: endpoint devices: add version command by @dewi-tik in https://github.com/goauthentik/authentik/pull/19767
* website/integrations: immich: add signing algorithm by @dewi-tik in https://github.com/goauthentik/authentik/pull/19187
* website: QL Search keyboard interactions docs, examples. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/16259
* website/docs: Remove stale 2024 version directives by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19888
* web: fix Brand CSS not applied to nested Shadow DOM components by @Mmx233 in https://github.com/goauthentik/authentik/pull/19892
* stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19897
* core: bump protobuf from 6.33.4 to 6.33.5 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19886
* ci: fix cherry-pick assignee by @BeryJu in https://github.com/goauthentik/authentik/pull/19905
* website/docs: Color Palette Test Page by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19879
* ci: bump astral-sh/setup-uv from 7.2.0 to 7.2.1 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19929
* web: bump globals from 17.2.0 to 17.3.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19928
* web: bump type-fest from 5.4.2 to 5.4.3 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19927
* web: bump playwright from 1.58.0 to 1.58.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19925
* core: bump goauthentik/selenium from 144.0-ak-0.35.9 to 144.0-ak-0.40.0 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19917
* core: bump axllent/mailpit from v1.28.4 to v1.29.0 in /tests/e2e by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19918
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19921
* web: bump @formatjs/intl-listformat from 8.2.0 to 8.2.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19924
* core: bump cachetools from 6.2.6 to 7.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19919
* core: bump pyjwt from 2.10.1 to 2.11.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19920
* core: bump gunicorn from 24.1.1 to 25.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19916
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19868
* providers/scim: add configuration warning for migration by @BeryJu in https://github.com/goauthentik/authentik/pull/19859
* ci: always generate API clients by @BeryJu in https://github.com/goauthentik/authentik/pull/19906
* web: bump the rollup group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19922
* web: bump @playwright/test from 1.58.0 to 1.58.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19926
* web: bump @types/node from 25.1.0 to 25.2.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19923
* website/docs: Update location of media storage and outdated references by @dominic-r in https://github.com/goauthentik/authentik/pull/19885
* lifecycle/aws: add /data volume by @rissson in https://github.com/goauthentik/authentik/pull/19936
* lifecycle/ak: make sure /data has the correct permissions by @rissson in https://github.com/goauthentik/authentik/pull/19935
* core: fix non-expiring service accounts and app passwords by @dominic-r in https://github.com/goauthentik/authentik/pull/19913
* lib: Add ssh/sftp schemas in to DomainlessFormattedURLValidator by @PopovSergeyS in https://github.com/goauthentik/authentik/pull/19881
* ci: fix test_docker.sh by @rissson in https://github.com/goauthentik/authentik/pull/19944
* web/admin: fix default binding order by @BeryJu in https://github.com/goauthentik/authentik/pull/19943
* website/docs: Add `NODE_ENV: production` to workflow. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19889
* website/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes by @melizeche in https://github.com/goauthentik/authentik/pull/19949
* web: add "Copy Secret" button to TOTP configuration stage by @dominic-r in https://github.com/goauthentik/authentik/pull/19863
* root: fix NPM_VERSION in Makefile by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19844
* web: refactor TOTP clipboard handlers and secret parsing by @dominic-r in https://github.com/goauthentik/authentik/pull/19953
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19954
* web: bump knip from 5.82.1 to 5.83.0 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19962
* web/admin: Merge branch -- Stage elements, linter warnings by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19948
* crypto: Add ED25519 and ED448 support to the certificate builder by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19465
* lifecycle: bump shm size by @BeryJu in https://github.com/goauthentik/authentik/pull/19369
* core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770129730 by @rissson in https://github.com/goauthentik/authentik/pull/19973
* core: bump gunicorn from 25.0.0 to 25.0.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19959
* core: bump library/nginx from `c881927` to `7fe5dda` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19961
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19960
* core: bump aws-cdk-lib from 2.236.0 to 2.237.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19958
* core: ask for token duration on recovery link/email by admin by @gergosimonyi in https://github.com/goauthentik/authentik/pull/19875
* recovery: consume token in transaction by @kolega-ai-dev in https://github.com/goauthentik/authentik/pull/19967
* providers/oauth2: use compare_digest for client_secret comparison by @kolega-ai-dev in https://github.com/goauthentik/authentik/pull/19979
* web/flows: update flow background by @BeryJu in https://github.com/goauthentik/authentik/pull/19974
* root: revert enterprise loading behaviour by @BeryJu in https://github.com/goauthentik/authentik/pull/19485
* ci: allow setting assignee to fail by @BeryJu in https://github.com/goauthentik/authentik/pull/19985
* core: bump django from 5.2.10 to 5.2.11 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19988
* stages/authenticator_webauthn: fix double JSON encoding of webauthn options by @BeryJu in https://github.com/goauthentik/authentik/pull/19952
* web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19989
* core, web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /packages/prettier-config by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/19990
* providers/saml: auto pull signature algorithm options by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/17614
* outposts: fix docker_tls created files permission by @kolega-ai-dev in https://github.com/goauthentik/authentik/pull/19978
* web: bump @goauthentik/api from 2026.2.0-rc1-1769710374 to 2026.2.0-rc1-1770134072 in /web in the goauthentik group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20009
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19998
* website/docs: fix typos by @dominic-r in https://github.com/goauthentik/authentik/pull/20000
* ci: bump calibreapp/image-actions from 420075c115b26f8785e293c5bd5bef0911c506e5 to d9c8ee5c3dc52ae4622c82ead88d658f4b16b65f by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20008
* core: bump library/nginx from `7fe5dda` to `9dd2888` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20006
* core: bump coverage[toml] from 7.13.2 to 7.13.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20002
* core: bump aws-cdk-lib from 2.237.0 to 2.237.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20003
* core: bump google-api-python-client from 2.188.0 to 2.189.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20004
* core: bump djangorestframework-stubs[compatible-mypy] from 3.16.7 to 3.16.8 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20005
* core: bump library/node from 25.5.0-trixie to 25.6.0-trixie in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20007
* core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770134534 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19980
* core: bump ruff from 0.14.14 to 0.15.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20001
* brands: fix Domain Matching in Brand Resolution by @kolega-ai-dev in https://github.com/goauthentik/authentik/pull/19976
* website/docs: add a new page to help people get started after install is complete  by @tanberry in https://github.com/goauthentik/authentik/pull/19217
* website/docs: endpoint devices: more updates by @dewi-tik in https://github.com/goauthentik/authentik/pull/19971
* flows: add option for flow layout with frame background by @BeryJu in https://github.com/goauthentik/authentik/pull/19527
* web: bump API Client version by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20017
* website/docs: dont throw exception for outdated version badges by @BeryJu in https://github.com/goauthentik/authentik/pull/20024
* website/docs: endpoint devices: specify name and slug by @dewi-tik in https://github.com/goauthentik/authentik/pull/20016
* web/flows: revisit agent stage fallback delay by @BeryJu in https://github.com/goauthentik/authentik/pull/20028
* ci: bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20037
* lib: add helper for creating events in migration by @BeryJu in https://github.com/goauthentik/authentik/pull/20044
* web: bump @types/react from 19.2.10 to 19.2.11 in /web in the react group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20038
* core: bump library/nginx from `9dd2888` to `b17697e` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20036
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20035
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20032
* website/docs: endpoint devices: fix non debian wording by @dewi-tik in https://github.com/goauthentik/authentik/pull/20046
* core: bump sentry-sdk from 2.51.0 to 2.52.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20034
* lib: fix migration event by @BeryJu in https://github.com/goauthentik/authentik/pull/20047
* core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770223759 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20018
* core: bump django-tenants from 3.9.0 to 3.10.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20033
* website/docs: endpoint devices: update device authentication location by @dewi-tik in https://github.com/goauthentik/authentik/pull/20049
* website/docs: capturing outpost logs by @dewi-tik in https://github.com/goauthentik/authentik/pull/20045
* web/admin: fix rendering for configuration_warning event by @BeryJu in https://github.com/goauthentik/authentik/pull/20050
* docs: add instructions for configuring rp-initiated single logout by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/20040
* outpost/proxyv2: revalidate auth if session fails to load by @chetan in https://github.com/goauthentik/authentik/pull/18063
* website/docs: automated install: mention no file:// vars by @tcrasset in https://github.com/goauthentik/authentik/pull/20043
* providers/saml: fix signing order for encrypted saml responses by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19620
* providers/saml: update metadata parser for single logout and encryption certificate by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/20031
* blueprints: don't exclude default values by @BeryJu in https://github.com/goauthentik/authentik/pull/20057
* sources/saml: update handling statusmessage by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19739
* website/docs: remove redundant RC notice by @gergosimonyi in https://github.com/goauthentik/authentik/pull/20052
* sources/saml: prevent authnrequest signature being inside body on redirect by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19898
* enterprise/providers: WSFed configurable realm, default wreply by @BeryJu in https://github.com/goauthentik/authentik/pull/19996
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20069
* core, web: bump webpack from 5.103.0 to 5.105.0 in /packages/docusaurus-config by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20068
* core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770333724 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20067
* core: bump library/nginx from `b17697e` to `341bf0f` in /website by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20077
* core: bump pyrad from 2.5.2 to 2.5.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20073
* core: bump msgraph-sdk from 1.53.0 to 1.54.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20072
* core: bump twilio from 9.10.0 to 9.10.1 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20071
* lifecycle/aws: bump aws-cdk from 2.1104.0 to 2.1105.0 in /lifecycle/aws by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20070
* web: bump chromedriver from 145.0.0 to 145.0.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20082
* web: bump semver from 7.7.3 to 7.7.4 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20081
* web: bump @types/node from 25.2.0 to 25.2.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20080
* web: bump @goauthentik/api from 2026.2.0-rc1-1770223158 to 2026.2.0-rc1-1770333267 in /web in the goauthentik group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20078
* web: bump the bundler group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20076
* web: bump the storybook group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20075
* core: bump django-cte from 2.0.0 to 3.0.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20074
* web: bump @types/react from 19.2.11 to 19.2.13 in /web in the react group across 1 directory by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20079
* web: Allow unused spreaded properties to strict unsafe. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/20084
* web/i18n: Fix Japanese and Korean font overrides. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19994
* web: Fix locale selector in compatibility mode. by @GirlBossRush in https://github.com/goauthentik/authentik/pull/19946
* sources/saml: truncate transient username longer than 150 chars by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19930
* providers/saml: move sp acs binding down in form by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/20039
* website/docs: generate CVE sidebar by @BeryJu in https://github.com/goauthentik/authentik/pull/20098
* sources/oauth: Fix InvalidAudienceError in id_token fallback by @ryanpesek in https://github.com/goauthentik/authentik/pull/20096
* web: bump type-fest from 5.4.3 to 5.4.4 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20113
* web: bump knip from 5.83.0 to 5.83.1 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20112
* web: bump @types/node from 25.2.1 to 25.2.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20111
* web: bump @playwright/test from 1.58.1 to 1.58.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20110
* web: bump playwright from 1.58.1 to 1.58.2 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20109
* web: bump the swc group across 2 directories with 1 update by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20108
* ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20106
* ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20105
* core: bump gunicorn from 25.0.1 to 25.0.3 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20104
* core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20103
* core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20102
* tasks/middlewares: call monitoring_set upon metrics request by @rissson in https://github.com/goauthentik/authentik/pull/20117
* website/docs: endpoint devices: add fleet connector doc by @dewi-tik in https://github.com/goauthentik/authentik/pull/20086
* tasks: add queued tasks metrics by @rissson in https://github.com/goauthentik/authentik/pull/20118
* web/admin: source forms not rendering by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/19887
* website/docs/social-logins: add shibboleth integration guide by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/19909
* web/sfe: bug: polyfill needed to supply Object.assign() to IE11. by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/20126
* web: bump axios from 1.13.2 to 1.13.5 in /web by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20137
* ci: bump tj-actions/changed-files from 47.0.1 to 47.0.2 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20132
* core: bump coverage[toml] from 7.13.3 to 7.13.4 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20129
* core: bump aws-cdk-lib from 2.237.1 to 2.238.0 by @dependabot[bot] in https://github.com/goauthentik/authentik/pull/20128
* website/integrations: add AFFiNE by @akaSorin in https://github.com/goauthentik/authentik/pull/20143
* website/docs: endpoint/devices: add authentik version tags by @dewi-tik in https://github.com/goauthentik/authentik/pull/20144
* enterprise/lifecycle: implement Object Lifecycle Management by @atereshkin in https://github.com/goauthentik/authentik/pull/20015
* web: bump API Client version by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20149
* website/docs: release notes for `2026.2.0` by @gergosimonyi in https://github.com/goauthentik/authentik/pull/20013
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20152
* stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20155
* translate: Updates for project authentik and language pt_BR by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20170
* translate: Updates for project authentik and language fi_FI by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20158
* translate: Updates for project authentik and language fr_FR by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20163
* translate: Updates for project authentik and language es_ES by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20159
* translate: Updates for project authentik and language de_DE by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20157
* translate: Updates for project authentik and language ja_JP by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20160
* translate: Updates for project authentik and language ko_KR by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20162
* translate: Updates for project authentik and language ru_RU by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20161
* translate: Updates for project authentik and language zh-Hans by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20164
* translate: Updates for project authentik and language tr_TR by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20167
* translate: Updates for project authentik and language cs_CZ by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20166
* translate: Updates for project authentik and language pt_PT by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20169
* translate: Updates for project authentik and language it_IT by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20168
* translate: Updates for project authentik and language pl_PL by @transifex-integration[bot] in https://github.com/goauthentik/authentik/pull/20165
* core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770745754 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20150
* core, web: update translations by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20172
* core: fix `test_docker.sh` (cherry-pick #20179 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20192
* core: bump cryptography from 46.0.4 to 46.0.5 (cherry-pick #20171 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20193
* api: fix `test_build_schema` (cherry-pick #20196 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20199
* website/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20203
* website/docs: add email verification scope doc (cherry-pick #20141 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20206
* website/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20211
* ci: fix release testing (cherry-pick #20207 to version-2026.2) by @rissson in https://github.com/goauthentik/authentik/pull/20224
* security: CVE-2026-25922 (2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20238
* security: CVE-2026-25748 (2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20237
* security: CVE-2026-25227 (2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20236
* web: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2026.2) by @rissson in https://github.com/goauthentik/authentik/pull/20246
* website/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20251
* website/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20253
* website/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20257
* website/docs: draft of new WS-Fed provider docs  (cherry-pick #20091 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20262
* ci: fix binary outpost build on release (cherry-pick #20248 to version-2026.2) by @rissson in https://github.com/goauthentik/authentik/pull/20279
* enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (cherry-pick #20266 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20278
* web: add pretty names for lifecycle review events in event logs (cherry-pick #20264 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20268
* website/docs: Custom CSS (cherry-pick #19991 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20287
* stage/identification: recovery: make wording more generic (cherry-pick #20209 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20293
* web: fix italic formatting in lifecycle rule help text (cherry-pick #20263 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20267
* website/docs: add affine to release notes (cherry-pick #20299 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20308
* root: do not rely on npm cli for version bump (cherry-pick #20276 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20321
* website/docs: add okta source doc (cherry-pick #20296 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20335
* website/docs: rac: update rac provider docs (cherry-pick #20225 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20337
* website/docs, integrations: fix language (cherry-pick #20338 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20347
* ci: fix setup altering package-lock (cherry-pick #20348 to version-2026.2) by @rissson in https://github.com/goauthentik/authentik/pull/20356
* web: revert `package-lock.json` by tag workflow by @gergosimonyi in https://github.com/goauthentik/authentik/pull/20349
* rbac: fix object permission request (cherry-pick #20304 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20366
* web: Flow Executor layout fixes (cherry-pick #20134 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20331
* enterprise/providers/ws_federation: fix incorrect metadata download URL (cherry-pick #20173 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20365
* website/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20370
* core: add cause to `ak_groups` deprecation event and logs (cherry-pick #20361 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20368
* website/docs: correct reference to overriden S3 variable (cherry-pick #20156 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20378
* web/admin: bug: stage update forms not rendering, several modal form buttons missing (cherry-pick #20373 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20394
* enterprise/providers/microsoft_entra: fix dangling comma (cherry-pick #20391 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20395
* ci: pull latest changes before tagging new version (cherry-pick #20413 to version-2026.2) by @rissson in https://github.com/goauthentik/authentik/pull/20414
* enterprise/providers/microsoft_entra: only check upn when set (cherry-pick #20441 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20442
* stages/user_login: log correct user when session binding is broken (cherry-pick #20094 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20453
* enterprise: monkey patch pyjwt to accept mismatching key (cherry-pick #20402 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20474
* enterprise/lifecycle: use datetime instead of date to track review cycles (cherry-pick #20283 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20473
* policies: measure policy process from manager (cherry-pick #20477 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20481
* providers/proxy: preserve URL-encoded path characters in redirect (cherry-pick #20476 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20482
* web: Center footer links. (cherry-pick #20345 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20425
* website/docs: add info about make install and recovery key (cherry-pick #20447 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20486
* providers/oauth2: device code flow client id via auth header (cherry-pick #20457 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20503
* enterprise: add `ES384` to enterprise license algorithms (cherry-pick #20507 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20510
* web/admin/bugfix: Edit Stage not working. Invoking IdentificationStageForm not working (cherry-pick #20429 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20512
* web: fix Edit Policy button on Flow view page (cherry-pick #20511 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20515
* endpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20514
* website/docs: fix linux setup docs (cherry-pick #20508 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20517
* website/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20505
* policies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20524
* providers/oauth2: deactivate locale after testing (cherry-pick #20518 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20526
* providers/oauth2: add jti claim (cherry-pick #20484 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20528
* website/docs: autogenerate release notes (cherry-pick #20527 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20531

## New Contributors
* @gabay made their first contribution in https://github.com/goauthentik/authentik/pull/18812
* @joaocfernandes made their first contribution in https://github.com/goauthentik/authentik/pull/18448
* @dminuoso made their first contribution in https://github.com/goauthentik/authentik/pull/18727
* @optix2000 made their first contribution in https://github.com/goauthentik/authentik/pull/18921
* @stijn220 made their first contribution in https://github.com/goauthentik/authentik/pull/18979
* @hskrtich made their first contribution in https://github.com/goauthentik/authentik/pull/18984
* @0skater0 made their first contribution in https://github.com/goauthentik/authentik/pull/19013
* @borutmrak made their first contribution in https://github.com/goauthentik/authentik/pull/15183
* @ocmateusz made their first contribution in https://github.com/goauthentik/authentik/pull/19073
* @austin-dudzik made their first contribution in https://github.com/goauthentik/authentik/pull/19102
* @pippo73 made their first contribution in https://github.com/goauthentik/authentik/pull/19127
* @williamkray made their first contribution in https://github.com/goauthentik/authentik/pull/19160
* @nmasnadithya made their first contribution in https://github.com/goauthentik/authentik/pull/19170
* @busybox11 made their first contribution in https://github.com/goauthentik/authentik/pull/19246
* @tcrasset made their first contribution in https://github.com/goauthentik/authentik/pull/18936
* @sebastianw made their first contribution in https://github.com/goauthentik/authentik/pull/19316
* @severin made their first contribution in https://github.com/goauthentik/authentik/pull/19368
* @Fredouye made their first contribution in https://github.com/goauthentik/authentik/pull/19337
* @JMLX42 made their first contribution in https://github.com/goauthentik/authentik/pull/19226
* @DonQuinleone made their first contribution in https://github.com/goauthentik/authentik/pull/19530
* @steilerDev made their first contribution in https://github.com/goauthentik/authentik/pull/19584
* @Ma27 made their first contribution in https://github.com/goauthentik/authentik/pull/19542
* @Gulianrdgd made their first contribution in https://github.com/goauthentik/authentik/pull/19379
* @jeroen1602 made their first contribution in https://github.com/goauthentik/authentik/pull/19554
* @vitSkalicky made their first contribution in https://github.com/goauthentik/authentik/pull/15686
* @ImmanuelVonNeumann made their first contribution in https://github.com/goauthentik/authentik/pull/13947
* @Mmx233 made their first contribution in https://github.com/goauthentik/authentik/pull/19892
* @PopovSergeyS made their first contribution in https://github.com/goauthentik/authentik/pull/19881
* @kolega-ai-dev made their first contribution in https://github.com/goauthentik/authentik/pull/19967
* @chetan made their first contribution in https://github.com/goauthentik/authentik/pull/18063
* @akaSorin made their first contribution in https://github.com/goauthentik/authentik/pull/20143

**Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.12.4...version/2026.2.0