version/2026.5.7

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202657


## What's Changed
* ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24322
* endpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24330
* enterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24366
* brands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24407
* core: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container by @emilburzo in https://github.com/goauthentik/authentik/pull/24414
* providers/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24485
* core: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24532
* fix pipeline for version 2026.5 by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/24601
* endpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24592
* endpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24589
* website/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24572
* providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24442
* website/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24627
* packages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24663
* core: fix group source connection source object (cherry-pick #24626 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24674
* root: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24670
* website/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24680
* website/docs: document API scope and domain join required by the authentik Agent (cherry-pick #24599 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24714
* website/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24736
* web/admin: drop misleading delete consequences from user activation review (cherry-pick #24273 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24786
* blueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24751
* core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24815
* blueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24820
* providers/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24823
* rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24947
* web/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24836
* providers/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24954
* core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24957
* endpoints: handle error in facts (cherry-pick #25028 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25031
* core: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25059
* packages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25105
* core: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25185
* stages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25189
* providers/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25196
* enterprise: increase cache duration and ensure summary is cached (cherry-pick #25187 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25198
* endpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25339
* server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25364
* core: add user type-active-username index (cherry-pick #25223 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25241
* core: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25386
* web/elements/table: show scrollbar instead of overflowing off the page (cherry-pick #25232 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25392
* core: bump goauthentik/fips-python from 6abe1b to 3ebb7c in /lifecycle/container (cherry-pick #25504 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25507
* crypto: don't dispatch discovery if one is queued (cherry-pick #25483 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25511
* ci: bump golangci lint (cherry-pick #25513 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25521
* website: drop openapi-to-postmanv2 override to fix docs build (2026.5) by @emilburzo in https://github.com/goauthentik/authentik/pull/25540
* core: bump goauthentik/fips-debian from f18dbc4 to ed780d in /lifecycle/container (cherry-pick #25503 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25508
* stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25500
* lib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25466
* worker: fix healthcheck paths (cherry-pick #24481 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25677
* lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25760
* tenants/settings: fix `flags` response (cherry-pick #25616 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25829
* web/admin: fix schedule form (cherry-pick #25778 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25831
* web: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25001
* web: preserve custom event action labels (cherry-pick #25655 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25834
* security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25961
* security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25962
* security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25964
* lifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25896
* security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25963
* security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25960
* website/docs: add release notes for `2026.2.7` (cherry-pick #25979 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25983
* website/docs: add release notes for `2026.5.7` (cherry-pick #25980 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25985


**Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2026.5.6...version/2026.5.7