authentik 2026.5.7

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202657

What's Changed

• ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24322
• endpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24330
• enterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24366
• brands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24407
• core: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container by @emilburzo in https://github.com/goauthentik/authentik/pull/24414
• providers/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24485
• core: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24532
• fix pipeline for version 2026.5 by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/24601
• endpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24592
• endpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24589
• website/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24572
• providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24442
• website/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24627
• packages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24663
• core: fix group source connection source object (cherry-pick #24626 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24674
• root: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24670
• website/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24680
• website/docs: document API scope and domain join required by the authentik Agent (cherry-pick #24599 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24714
• website/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24736
• web/admin: drop misleading delete consequences from user activation review (cherry-pick #24273 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24786
• blueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24751
• core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24815
• blueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24820
• providers/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24823
• rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24947
• web/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24836
• providers/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24954
• core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24957
• endpoints: handle error in facts (cherry-pick #25028 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25031
• core: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25059
• packages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25105
• core: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25185
• stages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25189
• providers/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25196
• enterprise: increase cache duration and ensure summary is cached (cherry-pick #25187 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25198
• endpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25339
• server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25364
• core: add user type-active-username index (cherry-pick #25223 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25241
• core: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25386
• web/elements/table: show scrollbar instead of overflowing off the page (cherry-pick #25232 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25392
• core: bump goauthentik/fips-python from 6abe1b to 3ebb7c in /lifecycle/container (cherry-pick #25504 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25507
• crypto: don't dispatch discovery if one is queued (cherry-pick #25483 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25511
• ci: bump golangci lint (cherry-pick #25513 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25521
• website: drop openapi-to-postmanv2 override to fix docs build (2026.5) by @emilburzo in https://github.com/goauthentik/authentik/pull/25540
• core: bump goauthentik/fips-debian from f18dbc4 to ed780d in /lifecycle/container (cherry-pick #25503 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25508
• stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25500
• lib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25466
• worker: fix healthcheck paths (cherry-pick #24481 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25677
• lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25760
• tenants/settings: fix flags response (cherry-pick #25616 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25829
• web/admin: fix schedule form (cherry-pick #25778 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25831
• web: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25001
• web: preserve custom event action labels (cherry-pick #25655 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25834
• security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25961
• security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25962
• security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25964
• lifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25896
• security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25963
• security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25960
• website/docs: add release notes for 2026.2.7 (cherry-pick #25979 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25983
• website/docs: add release notes for 2026.5.7 (cherry-pick #25980 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25985

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.5.6...version/2026.5.7