core: remove filter_not_expired for QS by BeryJu · Pull Request #18274 · goauthentik/authentik

BeryJu · 2025-11-19T23:55:37Z

in wake of the recent CVE due to a missing filter_not_expired, I think it's a better DX to filter out expired objects by default and make getting expired objects an opt-in. This PR does that.

Adds .objects.including_expired(), this will return a queryset with all objects
Default .objects will exclude expired objects by default

Models to check:

netlify · 2025-11-19T23:55:41Z

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	`6d204f3`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/69337223b667820008a196d7

netlify · 2025-11-19T23:55:42Z

✅ Deploy Preview for authentik-integrations canceled.

Name	Link
🔨 Latest commit	`6d204f3`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/69337223051ba10008273ef1

netlify · 2025-11-19T23:55:43Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`9b52e1a`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/69c28c822a7e5d0008d92d7c
😎 Deploy Preview	https://deploy-preview-18274--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2025-11-20T00:01:53Z

Codecov Report

❌ Patch coverage is 98.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 92.81%. Comparing base (fb9e1e6) to head (9b52e1a).
⚠️ Report is 12 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/providers/saml/views/flows.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #18274      +/-   ##
==========================================
- Coverage   92.82%   92.81%   -0.01%     
==========================================
  Files        1000     1000              
  Lines       56560    56588      +28     
  Branches      425      425              
==========================================
+ Hits        52499    52523      +24     
- Misses       4061     4065       +4

Flag	Coverage Δ
conformance	`37.39% <26.25%> (-0.01%)`	⬇️
e2e	`42.88% <42.50%> (-0.03%)`	⬇️
integration	`22.22% <11.25%> (-0.01%)`	⬇️
rust	`0.23% <ø> (ø)`
unit	`91.71% <98.75%> (+<0.01%)`	⬆️
unit-migrate	`91.81% <98.75%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # authentik/api/authentication.py # authentik/core/models.py

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # authentik/core/models.py # authentik/core/tests/test_token_api.py # authentik/enterprise/endpoints/connectors/agent/auth.py # authentik/recovery/views.py

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

github-actions · 2026-03-23T20:06:58Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-9b52e1a1f40b44d647e540686c251a47af7264ce
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-9b52e1a1f40b44d647e540686c251a47af7264ce

Afterwards, run the upgrade commands from the latest release notes.

authentik/core/models.py

Signed-off-by: Jens L. <jens@beryju.org>

* main: core: remove filter_not_expired for QS (#18274) tenants: fix default schema in initial migration (#21114) core: bump django-stubs[compatible-mypy] from 5.2.9 to 6.0.1 (#21099) core, web: update translations (#21097) lifecycle/aws: bump aws-cdk from 2.1112.0 to 2.1113.0 in /lifecycle/aws (#21098) core: bump types-requests from 2.32.4.20260107 to 2.32.4.20260324 (#21100) core: bump constructs from 10.5.1 to 10.6.0 (#21101) core: bump astral-sh/uv from 0.10.12 to 0.11.0 in /lifecycle/container (#21103) ci: bump taiki-e/install-action from 2.69.6 to 2.69.7 in /.github/actions/setup (#21104) web: bump flatted from 3.4.1 to 3.4.2 (#21076) core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1774286095 (#21089) core: bump cbor2 from 5.8.0 to 5.9.0 (#21094) ci: fix cherry-pick action generating empty title (#21091) web: bump the swc group across 1 directory with 11 updates (#21070) web: bump yaml from 2.8.2 to 2.8.3 in /web (#21071) core: add flag for future default behaviour of requiring a binding to access an application (#16247)

BeryJu requested a review from a team as a code owner November 19, 2025 23:55

github-project-automation bot added this to authentik Core Nov 19, 2025

github-project-automation bot moved this to Todo in authentik Core Nov 19, 2025

BeryJu added this to the Release 2026.2 milestone Nov 27, 2025

core: remove filter_not_expired for QS

6e3494a

Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # authentik/api/authentication.py # authentik/core/models.py

BeryJu force-pushed the core/replace-filter_not_expired branch from ff0359d to 6e3494a Compare December 5, 2025 14:50

BeryJu added 6 commits December 5, 2025 15:51

remove more

bcc6639

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix invitation

e1e3754

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix more

b139073

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

more

8585c18

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix reputation

6d204f3

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

format

ef1cfa7

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

gergosimonyi assigned BeryJu Jan 14, 2026

BeryJu force-pushed the core/replace-filter_not_expired branch from 315bba1 to 42b2701 Compare March 23, 2026 18:29

Merge branch 'main' into core/replace-filter_not_expired

d158a0e

Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # authentik/core/models.py # authentik/core/tests/test_token_api.py # authentik/enterprise/endpoints/connectors/agent/auth.py # authentik/recovery/views.py

BeryJu force-pushed the core/replace-filter_not_expired branch from 42b2701 to d158a0e Compare March 23, 2026 18:30

BeryJu added 2 commits March 23, 2026 20:18

add deprecation warning

4ae95d0

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix tests

c520c20

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

rissson reviewed Mar 24, 2026

View reviewed changes

authentik/core/models.py Outdated Show resolved Hide resolved

Apply suggestion from @BeryJu

9b52e1a

Signed-off-by: Jens L. <jens@beryju.org>

rissson approved these changes Mar 24, 2026

View reviewed changes

github-project-automation bot moved this from Todo to In Progress in authentik Core Mar 24, 2026

rissson added the area:backend label Mar 24, 2026

rissson removed this from the Release 2026.2.0: Nice to have milestone Mar 24, 2026

BeryJu enabled auto-merge (squash) March 24, 2026 13:37

BeryJu merged commit 752a349 into main Mar 24, 2026
108 checks passed

BeryJu deleted the core/replace-filter_not_expired branch March 24, 2026 13:43

github-project-automation bot moved this from In Progress to Done in authentik Core Mar 24, 2026

BeryJu mentioned this pull request Mar 24, 2026

events: add helper to log deprecation configuration_warning message #21115

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

core: remove filter_not_expired for QS#18274

core: remove filter_not_expired for QS#18274
BeryJu merged 11 commits intomainfrom
core/replace-filter_not_expired

BeryJu commented Nov 19, 2025 •

edited

Loading

Uh oh!

netlify bot commented Nov 19, 2025 •

edited

Loading

Uh oh!

netlify bot commented Nov 19, 2025 •

edited

Loading

Uh oh!

netlify bot commented Nov 19, 2025 •

edited

Loading

Uh oh!

codecov bot commented Nov 20, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

BeryJu commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs canceled.

Uh oh!

netlify bot commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations canceled.

Uh oh!

netlify bot commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

codecov bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BeryJu commented Nov 19, 2025 •

edited

Loading

netlify bot commented Nov 19, 2025 •

edited

Loading

netlify bot commented Nov 19, 2025 •

edited

Loading

netlify bot commented Nov 19, 2025 •

edited

Loading

codecov bot commented Nov 20, 2025 •

edited

Loading

github-actions bot commented Mar 23, 2026 •

edited

Loading