version/2026.2.7
umputun/ralphexversion/2026.2.7Sep 9, 2026by authentik-automation[bot]
Upgrading?
AI Summary
A maintenance release for authentik version 2026.2 including security backports, dependency removals, and performance optimizations.
Key Highlights
- Drop curl and runit from lifecycle
- Filter policy engine
- Fix SCIM changed detection for nested attributes
- Fix dynamic captcha keys in identification stage
- Security backports (group hierarchy, email recipient, SAML, secrets read, libxml2)
New Features
- Dependency removal (curl, runit)
- Policy engine filtering
- SCIM nested attribute fix
- Identification stage captcha fix
- Multiple security patches
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202627 ## What's Changed * lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24113 * policies: filter policy engine (cherry-pick #24025 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24169 * ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24321 * providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24443 * core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24817 * rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24946 * core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24956 * server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25363 * stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25499 * lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25759 * ci: bump golangci lint (cherry-pick #25513 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25975 * security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25956 * security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25958 * security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25957 * security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25955 * security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25959 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2026.2.6...version/2026.2.7
Related Repositories
asheshgoplani/agent-deck★ 359,427
Terminal session manager for AI coding agents. One TUI for Claude, Gemini, OpenCode, Codex, and more.
ollama/ollama★ 184,229
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,060
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,627
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,197
The world’s fastest framework for building websites.