See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202657
What's Changed
- ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5) by @authentik-cherry-pick[bot] in #24322
- endpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5) by @authentik-cherry-pick[bot] in #24330
- enterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5) by @authentik-cherry-pick[bot] in #24366
- brands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5) by @authentik-cherry-pick[bot] in #24407
- core: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container by @emilburzo in #24414
- providers/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5) by @authentik-cherry-pick[bot] in #24485
- core: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5) by @authentik-cherry-pick[bot] in #24532
- fix pipeline for version 2026.5 by @PeshekDotDev in #24601
- endpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5) by @authentik-cherry-pick[bot] in #24592
- endpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5) by @authentik-cherry-pick[bot] in #24589
- website/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5) by @authentik-cherry-pick[bot] in #24572
- providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5) by @authentik-cherry-pick[bot] in #24442
- website/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5) by @authentik-cherry-pick[bot] in #24627
- packages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5) by @authentik-cherry-pick[bot] in #24663
- core: fix group source connection source object (cherry-pick #24626 to version-2026.5) by @authentik-cherry-pick[bot] in #24674
- root: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5) by @authentik-cherry-pick[bot] in #24670
- website/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5) by @authentik-cherry-pick[bot] in #24680
- website/docs: document API scope and domain join required by the authentik Agent (cherry-pick #24599 to version-2026.5) by @authentik-cherry-pick[bot] in #24714
- website/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5) by @authentik-cherry-pick[bot] in #24736
- web/admin: drop misleading delete consequences from user activation review (cherry-pick #24273 to version-2026.5) by @authentik-cherry-pick[bot] in #24786
- blueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5) by @authentik-cherry-pick[bot] in #24751
- core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.5) by @authentik-cherry-pick[bot] in #24815
- blueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5) by @authentik-cherry-pick[bot] in #24820
- providers/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5) by @authentik-cherry-pick[bot] in #24823
- rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.5) by @authentik-cherry-pick[bot] in #24947
- web/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5) by @authentik-cherry-pick[bot] in #24836
- providers/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5) by @authentik-cherry-pick[bot] in #24954
- core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.5) by @authentik-cherry-pick[bot] in #24957
- endpoints: handle error in facts (cherry-pick #25028 to version-2026.5) by @authentik-cherry-pick[bot] in #25031
- core: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.5) by @authentik-cherry-pick[bot] in #25059
- packages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.5) by @authentik-cherry-pick[bot] in #25105
- core: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.5) by @authentik-cherry-pick[bot] in #25185
- stages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5) by @authentik-cherry-pick[bot] in #25189
- providers/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5) by @authentik-cherry-pick[bot] in #25196
- enterprise: increase cache duration and ensure summary is cached (cherry-pick #25187 to version-2026.5) by @authentik-cherry-pick[bot] in #25198
- endpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5) by @authentik-cherry-pick[bot] in #25339
- server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.5) by @authentik-cherry-pick[bot] in #25364
- core: add user type-active-username index (cherry-pick #25223 to version-2026.5) by @authentik-cherry-pick[bot] in #25241
- core: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5) by @authentik-cherry-pick[bot] in #25386
- web/elements/table: show scrollbar instead of overflowing off the page (cherry-pick #25232 to version-2026.5) by @authentik-cherry-pick[bot] in #25392
- core: bump goauthentik/fips-python from 6abe1b to 3ebb7c in /lifecycle/container (cherry-pick #25504 to version-2026.5) by @authentik-cherry-pick[bot] in #25507
- crypto: don't dispatch discovery if one is queued (cherry-pick #25483 to version-2026.5) by @authentik-cherry-pick[bot] in #25511
- ci: bump golangci lint (cherry-pick #25513 to version-2026.5) by @authentik-cherry-pick[bot] in #25521
- website: drop openapi-to-postmanv2 override to fix docs build (2026.5) by @emilburzo in #25540
- core: bump goauthentik/fips-debian from f18dbc4 to ed780d in /lifecycle/container (cherry-pick #25503 to version-2026.5) by @authentik-cherry-pick[bot] in #25508
- stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.5) by @authentik-cherry-pick[bot] in #25500
- lib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5) by @authentik-cherry-pick[bot] in #25466
- worker: fix healthcheck paths (cherry-pick #24481 to version-2026.5) by @authentik-cherry-pick[bot] in #25677
- lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.5) by @authentik-cherry-pick[bot] in #25760
- tenants/settings: fix
flagsresponse (cherry-pick #25616 to version-2026.5) by @authentik-cherry-pick[bot] in #25829 - web/admin: fix schedule form (cherry-pick #25778 to version-2026.5) by @authentik-cherry-pick[bot] in #25831
- web: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.5) by @authentik-cherry-pick[bot] in #25001
- web: preserve custom event action labels (cherry-pick #25655 to version-2026.5) by @authentik-cherry-pick[bot] in #25834
- security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #25961
- security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #25962
- security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #25964
- lifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5) by @authentik-cherry-pick[bot] in #25896
- security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #25963
- security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 by @authentik-automation[bot] in #25960
- website/docs: add release notes for
2026.2.7(cherry-pick #25979 to version-2026.5) by @authentik-cherry-pick[bot] in #25983 - website/docs: add release notes for
2026.5.7(cherry-pick #25980 to version-2026.5) by @authentik-cherry-pick[bot] in #25985
Full Changelog: version/2026.5.6...version/2026.5.7