Skip to content

core: bump astral-sh/uv from 0.9.17 to 0.9.18#18898

Merged
BeryJu merged 1 commit intomainfrom
dependabot/docker/astral-sh/uv-0.9.18
Dec 17, 2025
Merged

core: bump astral-sh/uv from 0.9.17 to 0.9.18#18898
BeryJu merged 1 commit intomainfrom
dependabot/docker/astral-sh/uv-0.9.18

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 17, 2025

Bumps astral-sh/uv from 0.9.17 to 0.9.18.

Release notes

Sourced from astral-sh/uv's releases.

0.9.18

Release Notes

Released on 2025-12-16.

Enhancements

  • Add value hints to command line arguments to improve shell completion accuracy (#17080)
  • Improve error handling in uv publish (#17096)
  • Improve rendering of multiline error messages (#17132)
  • Support redirects in uv publish (#17130)
  • Include Docker images with the alpine version, e.g., python3.x-alpine3.23 (#17100)

Configuration

  • Accept --torch-backend in [tool.uv] (#17116)

Performance

  • Speed up uv cache size (#17015)
  • Initialize S3 signer once (#17092)

Bug fixes

  • Avoid panics due to reads on failed requests (#17098)
  • Enforce latest-version in @latest requests (#17114)
  • Explicitly set EntryType for file entries in tar (#17043)
  • Ignore pyproject.toml index username in lockfile comparison (#16995)
  • Relax error when using uv add with UV_GIT_LFS set (#17127)
  • Support file locks on ExFAT on macOS (#17115)
  • Change schema for exclude-newer into optional string (#17121)

Documentation

  • Drop arm musl caveat from Docker documentation (#17111)
  • Fix version reference in resolver example (#17085)
  • Better documentation for exclude-newer* (#17079)

Install uv 0.9.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.9.18/uv-installer.ps1 | iex"
</tr></table> 

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.9.18

Released on 2025-12-16.

Enhancements

  • Add value hints to command line arguments to improve shell completion accuracy (#17080)
  • Improve error handling in uv publish (#17096)
  • Improve rendering of multiline error messages (#17132)
  • Support redirects in uv publish (#17130)
  • Include Docker images with the alpine version, e.g., python3.x-alpine3.23 (#17100)

Configuration

  • Accept --torch-backend in [tool.uv] (#17116)

Performance

  • Speed up uv cache size (#17015)
  • Initialize S3 signer once (#17092)

Bug fixes

  • Avoid panics due to reads on failed requests (#17098)
  • Enforce latest-version in @latest requests (#17114)
  • Explicitly set EntryType for file entries in tar (#17043)
  • Ignore pyproject.toml index username in lockfile comparison (#16995)
  • Relax error when using uv add with UV_GIT_LFS set (#17127)
  • Support file locks on ExFAT on macOS (#17115)
  • Change schema for exclude-newer into optional string (#17121)

Documentation

  • Drop arm musl caveat from Docker documentation (#17111)
  • Fix version reference in resolver example (#17085)
  • Better documentation for exclude-newer* (#17079)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [astral-sh/uv](https://github.com/astral-sh/uv) from 0.9.17 to 0.9.18.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.9.17...0.9.18)

---
updated-dependencies:
- dependency-name: astral-sh/uv
  dependency-version: 0.9.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 17, 2025
@dependabot dependabot bot requested a review from a team as a code owner December 17, 2025 04:24
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 17, 2025
@codecov
Copy link

codecov bot commented Dec 17, 2025

❌ 3 Tests Failed:

Tests completed Failed Passed Skipped
2862 3 2859 2
View the top 3 failed test(s) by shortest run time
authentik.providers.proxy.tests.ProxyProviderTests::test_sa_perms_cert
Stack Traces | 3.1s run time
self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']
ignored_wrapper_args = (False, {'connection': <DatabaseWrapper vendor='postgresql' alias='default'>, 'cursor': <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>})

    def _execute(self, sql, params, *ignored_wrapper_args):
        # Raise a warning during app initialization (stored_app_configs is only
        # ever set during testing).
        if not apps.ready and not apps.stored_app_configs:
            warnings.warn(self.APPS_NOT_READY_WARNING_MSG, category=RuntimeWarning)
        self.db.validate_no_broken_transaction()
        with self.db.wrap_database_errors:
            if params is None:
                # params default might be backend specific.
                return self.cursor.execute(sql)
            else:
>               return self.cursor.execute(sql, params)

.venv/lib/python3.13.../db/backends/utils.py:105: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_prometheus.db.common.ExportingCursorWrapper.<locals>.CursorWrapper [closed] [INTRANS] (host=localhost database=authentik) at 0x7f56b3eba450>
args = ('SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)', ['public::1:goauthentik.io/enterprise/license'])
kwargs = {}

    def execute(self, *args, **kwargs):
        execute_total.labels(alias, vendor).inc()
        with (
            query_duration_seconds.labels(**labels).time(),
            ExceptionCounterByType(errors_total, extra_labels=labels),
        ):
>           return super().execute(*args, **kwargs)

.venv/lib/python3.13.../django_prometheus/db/common.py:69: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_prometheus.db.common.ExportingCursorWrapper.<locals>.CursorWrapper [closed] [INTRANS] (host=localhost database=authentik) at 0x7f56b3eba450>
query = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']

    def execute(
        self,
        query: Query,
        params: Params | None = None,
        *,
        prepare: bool | None = None,
        binary: bool | None = None,
    ) -> Self:
        """
        Execute a query or command to the database.
        """
        try:
            with self._conn.lock:
                self._conn.wait(
                    self._execute_gen(query, params, prepare=prepare, binary=binary)
                )
        except e._NO_TRACEBACK as ex:
>           raise ex.with_traceback(None)
E           psycopg.errors.InFailedSqlTransaction: current transaction is aborted, commands ignored until end of transaction block

.venv/lib/python3.13....../site-packages/psycopg/cursor.py:97: InFailedSqlTransaction

The above exception was the direct cause of the following exception:

self = <unittest.case._Outcome object at 0x7f56a25d6c10>
test_case = <authentik.providers.proxy.tests.ProxyProviderTests testMethod=test_sa_perms_cert>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.providers.proxy.tests.ProxyProviderTests testMethod=test_sa_perms_cert>
result = <TestCaseFunction test_sa_perms_cert>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.providers.proxy.tests.ProxyProviderTests testMethod=test_sa_perms_cert>
method = <bound method ProxyProviderTests.test_sa_perms_cert of <authentik.providers.proxy.tests.ProxyProviderTests testMethod=test_sa_perms_cert>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.providers.proxy.tests.ProxyProviderTests testMethod=test_sa_perms_cert>

    def test_sa_perms_cert(self):
        """Test permissions to access a configured certificate"""
        cert = create_test_cert()
        outpost = Outpost.objects.create(name=generate_id(), type=OutpostType.PROXY)
        provider = ProxyProvider.objects.create(name=generate_id(), certificate=cert)
        Application.objects.create(name=generate_id(), slug=generate_id(), provider=provider)
        outpost.providers.add(provider)
    
        res = self.client.get(
            reverse("authentik_api:proxyprovideroutpost-list"),
            HTTP_AUTHORIZATION=f"Bearer {outpost.token.key}",
        )
        body = loads(res.content)
        self.assertEqual(body["pagination"]["count"], 1)
        cert_id = body["results"][0]["certificate"]
        self.assertEqual(cert_id, str(cert.pk))
    
>       res = self.client.get(
            reverse(
                "authentik_api:certificatekeypair-view-certificate",
                kwargs={
                    "pk": cert_id,
                },
            ),
            HTTP_AUTHORIZATION=f"Bearer {outpost.token.key}",
        )

.../providers/proxy/tests.py:166: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
path = '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'
data = None, follow = False
extra = {'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdWDL1NJCXt7aicTyPej'}

    def get(self, path, data=None, follow=False, **extra):
>       response = super().get(path, data=data, **extra)

.venv/lib/python3.13.............../site-packages/rest_framework/test.py:292: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
path = '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'
data = None
extra = {'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdWDL1NJCXt7aicTyPej'}
r = {'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdWDL1NJCXt7aicTyPej', 'QUERY_STRING': ''}

    def get(self, path, data=None, **extra):
        r = {
            'QUERY_STRING': urlencode(data or {}, doseq=True),
        }
        if not data and '?' in path:
            # Fix to support old behavior where you have the arguments in the
            # url. See #1461.
            query_string = force_bytes(path.split('?')[1])
            query_string = query_string.decode('iso-8859-1')
            r['QUERY_STRING'] = query_string
        r.update(extra)
>       return self.generic('GET', path, **r)

.venv/lib/python3.13.............../site-packages/rest_framework/test.py:209: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>, method = 'GET'
path = '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'
data = '', content_type = 'application/octet-stream', secure = False
extra = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdWDL1NJCXt7aicTyPej', 'QUERY_STRING': ''}

    def generic(self, method, path, data='',
                content_type='application/octet-stream', secure=False, **extra):
        # Include the CONTENT_TYPE, regardless of whether or not data is empty.
        if content_type is not None:
            extra['CONTENT_TYPE'] = str(content_type)
    
>       return super().generic(
            method, path, data, content_type, secure, **extra)

.venv/lib/python3.13.............../site-packages/rest_framework/test.py:237: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>, method = 'GET'
path = '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'
data = b'', content_type = 'application/octet-stream', secure = False
headers = None, query_params = None
extra = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdWDL1NJCXt7aicTyPej', 'QUERY_STRING': ''}
parsed = SplitResult(scheme='', netloc='', path='.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', query='', fragment='')
r = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdW...: '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', 'QUERY_STRING': '', ...}

    def generic(
        self,
        method,
        path,
        data="",
        content_type="application/octet-stream",
        secure=False,
        *,
        headers=None,
        query_params=None,
        **extra,
    ):
        """Construct an arbitrary HTTP request."""
        parsed = urlsplit(str(path))  # path can be lazy
        data = force_bytes(data, settings.DEFAULT_CHARSET)
        r = {
            "PATH_INFO": self._get_path(parsed),
            "REQUEST_METHOD": method,
            "SERVER_PORT": "443" if secure else "80",
            "wsgi.url_scheme": "https" if secure else "http",
        }
        if data:
            r.update(
                {
                    "CONTENT_LENGTH": str(len(data)),
                    "CONTENT_TYPE": content_type,
                    "wsgi.input": FakePayload(data),
                }
            )
        if headers:
            extra.update(HttpHeaders.to_wsgi_names(headers))
        if query_params:
            extra["QUERY_STRING"] = urlencode(query_params, doseq=True)
        r.update(extra)
        # If QUERY_STRING is absent or empty, we want to extract it from the URL.
        if not r.get("QUERY_STRING"):
            # WSGI requires latin-1 encoded strings. See get_path_info().
            r["QUERY_STRING"] = parsed.query.encode().decode("iso-8859-1")
>       return self.request(**r)

.venv/lib/python3.13.../django/test/client.py:671: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
kwargs = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdW...: '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', 'QUERY_STRING': '', ...}

    def request(self, **kwargs):
        # Ensure that any credentials set get added to every request.
        kwargs.update(self._credentials)
>       return super().request(**kwargs)

.venv/lib/python3.13.............../site-packages/rest_framework/test.py:289: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
kwargs = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdW...: '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', 'QUERY_STRING': '', ...}

    def request(self, **kwargs):
>       request = super().request(**kwargs)

.venv/lib/python3.13.............../site-packages/rest_framework/test.py:241: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
request = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdW...: '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', 'QUERY_STRING': '', ...}
environ = {'CONTENT_TYPE': 'application/octet-stream', 'HTTP_AUTHORIZATION': 'Bearer FxNEuj6BiJIhNCQgGfWQDkSRPjIb2xQUW1X7M5o0pdW...bbhxc5', 'PATH_INFO': '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/', ...}
data = {'context': [[{'True': True, 'False': False, 'None': None}, {'csrf_token': <SimpleLazyObject: <function csrf.<locals>.......">, <Template template_string="{% load static %}{%...">, <Template template_string="{% extends 'login/ba...">, ...]}
on_template_render = functools.partial(<function store_rendered_templates at 0x7f56ba856d40>, {'templates': [<Template template_string="{% ...tik.core.views.error.ServerErrorView object at 0x7f56a1332210>, 'title': 'Server Error', 'LANGUAGE_CODE': 'en'}, {}]]})
signal_uid = 'template-render-140010365889792'
exception_uid = 'request-exception-140010365889792'
response = <ServerErrorTemplateResponse status_code=500, "text/html; charset=utf-8">

    def request(self, **request):
        """
        Make a generic request. Compose the environment dictionary and pass
        to the handler, return the result of the handler. Assume defaults for
        the query environment, which can be overridden using the arguments to
        the request.
        """
        environ = self._base_environ(**request)
    
        # Curry a data dictionary into an instance of the template renderer
        # callback function.
        data = {}
        on_template_render = partial(store_rendered_templates, data)
        signal_uid = "template-render-%s" % id(request)
        signals.template_rendered.connect(on_template_render, dispatch_uid=signal_uid)
        # Capture exceptions created by the handler.
        exception_uid = "request-exception-%s" % id(request)
        got_request_exception.connect(self.store_exc_info, dispatch_uid=exception_uid)
        try:
            response = self.handler(environ)
        finally:
            signals.template_rendered.disconnect(dispatch_uid=signal_uid)
            got_request_exception.disconnect(dispatch_uid=exception_uid)
        # Check for signaled exceptions.
>       self.check_exception(response)

.venv/lib/python3.13.../django/test/client.py:1087: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <rest_framework.test.APIClient object at 0x7f56b248d9c0>
response = <ServerErrorTemplateResponse status_code=500, "text/html; charset=utf-8">

    def check_exception(self, response):
        """
        Look for a signaled exception, clear the current context exception
        data, re-raise the signaled exception, and clear the signaled exception
        from the local cache.
        """
        response.exc_info = self.exc_info
        if self.exc_info:
            _, exc_value, _ = self.exc_info
            self.exc_info = None
            if self.raise_request_exception:
>               raise exc_value

.venv/lib/python3.13.../django/test/client.py:802: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

request = <WSGIRequest: GET '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'>

    @wraps(get_response)
    def inner(request):
        try:
>           response = get_response(request)

.venv/lib/python3.13.../core/handlers/exception.py:55: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware object at 0x7f56b408c1a0>
args = (<WSGIRequest: GET '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'>,)
kwargs = {}
f = <bound method AuditMiddleware.__call__ of <authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware object at 0x7f56b247e330>>
middleware_span = <Span(op='middleware.django', description:'authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware.__call__', ...d59f948d53ea', span_id='95b07927331775a5', parent_span_id='a68988a33966d665', sampled=None, origin='auto.http.django')>

    def __call__(self, *args, **kwargs):
        # type: (*Any, **Any) -> Any
        if hasattr(self, "async_route_check") and self.async_route_check():
            return self.__acall__(*args, **kwargs)
    
        f = self._call_method
        if f is None:
            self._call_method = f = self._inner.__call__
    
        middleware_span = _check_middleware_span(old_method=f)
    
        if middleware_span is None:
            return f(*args, **kwargs)
    
        with middleware_span:
>           return f(*args, **kwargs)

.venv/lib/python3.13.../integrations/django/middleware.py:177: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware object at 0x7f56b247e330>
request = <WSGIRequest: GET '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'>

    def __call__(self, request: HttpRequest) -> HttpResponse:
        _CTX_REQUEST.set(request)
        self.connect(request)
    
        response = self.get_response(request)
    
>       self.disconnect(request)

authentik/events/middleware.py:158: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware object at 0x7f56b247e330>
request = <WSGIRequest: GET '.../certificatekeypairs/92e7d8db-0f92-4fe4-b736-72c9e2b4f14a/view_certificate/'>

    def disconnect(self, request: HttpRequest):
        super().disconnect(request)
>       if not self.enabled:

.../enterprise/audit/middleware.py:41: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware object at 0x7f56b247e330>

    @property
    def enabled(self):
        """Check if audit logging is enabled"""
>       return apps.get_app_config("authentik_enterprise").enabled()

.../enterprise/audit/middleware.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <AuthentikEnterpriseConfig: authentik_enterprise>

    def enabled(self):
        """Return true if enterprise is enabled and valid"""
>       return self.check_enabled() or settings.TEST

authentik/enterprise/apps.py:34: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <AuthentikEnterpriseConfig: authentik_enterprise>

    def check_enabled(self):
        """Actual enterprise check, cached"""
        from authentik.enterprise.license import LicenseKey
    
>       return LicenseKey.cached_summary().status.is_valid

authentik/enterprise/apps.py:40: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

    @staticmethod
    def cached_summary() -> LicenseSummary:
        """Helper method which looks up the last summary"""
>       summary = cache.get(CACHE_KEY_ENTERPRISE_LICENSE)

authentik/enterprise/license.py:232: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = ('goauthentik.io/enterprise/license',), kwargs = {}

    @functools.wraps(original_method)
    def sentry_method(*args, **kwargs):
        # type: (*Any, **Any) -> Any
>       return _instrument_call(
            cache, method_name, original_method, args, kwargs, address, port
        )

.venv/lib/python3.13.../integrations/django/caching.py:95: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>, 'get', <bound method DatabaseCache.get of <dj...postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>>, ('goauthentik.io/enterprise/license',), {}, None, ...)
kwargs = {}

    def runner(*args: "P.args", **kwargs: "P.kwargs"):
        # type: (...) -> R
        if sentry_sdk.get_client().get_integration(integration) is None:
            return original_function(*args, **kwargs)
    
>       return sentry_patched_function(*args, **kwargs)

.venv/lib/python3.13........./site-packages/sentry_sdk/utils.py:1816: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

cache = <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>
method_name = 'get'
original_method = <bound method DatabaseCache.get of <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>>
args = ('goauthentik.io/enterprise/license',), kwargs = {}, address = None
port = None

    @ensure_integration_enabled(DjangoIntegration, original_method)
    def _instrument_call(
        cache, method_name, original_method, args, kwargs, address, port
    ):
        # type: (CacheHandler, str, Callable[..., Any], tuple[Any, ...], dict[str, Any], Optional[str], Optional[int]) -> Any
        is_set_operation = method_name.startswith("set")
        is_get_operation = not is_set_operation
    
        op = OP.CACHE_PUT if is_set_operation else OP.CACHE_GET
        description = _get_span_description(method_name, args, kwargs)
    
        with sentry_sdk.start_span(
            op=op,
            name=description,
            origin=DjangoIntegration.origin,
        ) as span:
>           value = original_method(*args, **kwargs)

.venv/lib/python3.13.../integrations/django/caching.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>
key = 'goauthentik.io/enterprise/license', default = None, version = None

    def get(self, key: str, default: Any | None = None, version: int | None = None) -> Any:
        try:
>           return super().get(key, default=default, version=version)

.../django-postgres-cache/django_postgres_cache/backend.py:31: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>
key = 'goauthentik.io/enterprise/license', default = None, version = None

    def get(self, key, default=None, version=None):
>       return self.get_many([key], version).get(key, default)

.venv/lib/python3.13.../cache/backends/db.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (['goauthentik.io/enterprise/license'], None), kwargs = {}

    @functools.wraps(original_method)
    def sentry_method(*args, **kwargs):
        # type: (*Any, **Any) -> Any
>       return _instrument_call(
            cache, method_name, original_method, args, kwargs, address, port
        )

.venv/lib/python3.13.../integrations/django/caching.py:95: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>, 'get_many', <bound method DatabaseCache.get_m...s_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>>, (['goauthentik.io/enterprise/license'], None), {}, None, ...)
kwargs = {}

    def runner(*args: "P.args", **kwargs: "P.kwargs"):
        # type: (...) -> R
        if sentry_sdk.get_client().get_integration(integration) is None:
            return original_function(*args, **kwargs)
    
>       return sentry_patched_function(*args, **kwargs)

.venv/lib/python3.13........./site-packages/sentry_sdk/utils.py:1816: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

cache = <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>
method_name = 'get_many'
original_method = <bound method DatabaseCache.get_many of <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>>
args = (['goauthentik.io/enterprise/license'], None), kwargs = {}
address = None, port = None

    @ensure_integration_enabled(DjangoIntegration, original_method)
    def _instrument_call(
        cache, method_name, original_method, args, kwargs, address, port
    ):
        # type: (CacheHandler, str, Callable[..., Any], tuple[Any, ...], dict[str, Any], Optional[str], Optional[int]) -> Any
        is_set_operation = method_name.startswith("set")
        is_get_operation = not is_set_operation
    
        op = OP.CACHE_PUT if is_set_operation else OP.CACHE_GET
        description = _get_span_description(method_name, args, kwargs)
    
        with sentry_sdk.start_span(
            op=op,
            name=description,
            origin=DjangoIntegration.origin,
        ) as span:
>           value = original_method(*args, **kwargs)

.venv/lib/python3.13.../integrations/django/caching.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_postgres_cache.backend.DatabaseCache object at 0x7f56b4a4b8c0>
keys = ['goauthentik.io/enterprise/license'], version = None

    def get_many(self, keys, version=None):
        if not keys:
            return {}
    
        key_map = {
            self.make_and_validate_key(key, version=version): key for key in keys
        }
    
        db = router.db_for_read(self.cache_model_class)
        connection = connections[db]
        quote_name = connection.ops.quote_name
        table = quote_name(self._table)
    
        with connection.cursor() as cursor:
>           cursor.execute(
                "SELECT %s, %s, %s FROM %s WHERE %s IN (%s)"
                % (
                    quote_name("cache_key"),
                    quote_name("value"),
                    quote_name("expires"),
                    table,
                    quote_name("cache_key"),
                    ", ".join(["%s"] * len(key_map)),
                ),
                list(key_map),
            )

.venv/lib/python3.13.../cache/backends/db.py:69: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>, 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)', ['public::1:goauthentik.io/enterprise/license'])
kwargs = {}

    def runner(*args: "P.args", **kwargs: "P.kwargs"):
        # type: (...) -> R
        if sentry_sdk.get_client().get_integration(integration) is None:
            return original_function(*args, **kwargs)
    
>       return sentry_patched_function(*args, **kwargs)

.venv/lib/python3.13........./site-packages/sentry_sdk/utils.py:1816: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']

    @ensure_integration_enabled(DjangoIntegration, real_execute)
    def execute(self, sql, params=None):
        # type: (CursorWrapper, Any, Optional[Any]) -> Any
        with record_sql_queries(
            cursor=self.cursor,
            query=sql,
            params_list=params,
            paramstyle="format",
            executemany=False,
            span_origin=DjangoIntegration.origin_db,
        ) as span:
            _set_db_data(span, self)
>           result = real_execute(self, sql, params)

.venv/lib/python3.13.../integrations/django/__init__.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']

    def execute(self, sql, params=None):
>       return self._execute_with_wrappers(
            sql, params, many=False, executor=self._execute
        )

.venv/lib/python3.13.../db/backends/utils.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license'], many = False
executor = <bound method CursorWrapper._execute of <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>>

    def _execute_with_wrappers(self, sql, params, many, executor):
        context = {"connection": self.db, "cursor": self}
        for wrapper in reversed(self.db.execute_wrappers):
            executor = functools.partial(wrapper, executor)
>       return executor(sql, params, many, context)

.venv/lib/python3.13.../db/backends/utils.py:92: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']
ignored_wrapper_args = (False, {'connection': <DatabaseWrapper vendor='postgresql' alias='default'>, 'cursor': <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>})

    def _execute(self, sql, params, *ignored_wrapper_args):
        # Raise a warning during app initialization (stored_app_configs is only
        # ever set during testing).
        if not apps.ready and not apps.stored_app_configs:
            warnings.warn(self.APPS_NOT_READY_WARNING_MSG, category=RuntimeWarning)
        self.db.validate_no_broken_transaction()
>       with self.db.wrap_database_errors:

.venv/lib/python3.13.../db/backends/utils.py:100: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.utils.DatabaseErrorWrapper object at 0x7f56b752a660>
exc_type = <class 'psycopg.errors.InFailedSqlTransaction'>
exc_value = InFailedSqlTransaction('current transaction is aborted, commands ignored until end of transaction block')
traceback = <traceback object at 0x7f56b1884280>

    def __exit__(self, exc_type, exc_value, traceback):
        if exc_type is None:
            return
        for dj_exc_type in (
            DataError,
            OperationalError,
            IntegrityError,
            InternalError,
            ProgrammingError,
            NotSupportedError,
            DatabaseError,
            InterfaceError,
            Error,
        ):
            db_exc_type = getattr(self.wrapper.Database, dj_exc_type.__name__)
            if issubclass(exc_type, db_exc_type):
                dj_exc_value = dj_exc_type(*exc_value.args)
                # Only set the 'errors_occurred' flag for errors that may make
                # the connection unusable.
                if dj_exc_type not in (DataError, IntegrityError):
                    self.wrapper.errors_occurred = True
>               raise dj_exc_value.with_traceback(traceback) from exc_value

.venv/lib/python3.13.../django/db/utils.py:91: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>
sql = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']
ignored_wrapper_args = (False, {'connection': <DatabaseWrapper vendor='postgresql' alias='default'>, 'cursor': <django.db.backends.utils.CursorWrapper object at 0x7f56b247edb0>})

    def _execute(self, sql, params, *ignored_wrapper_args):
        # Raise a warning during app initialization (stored_app_configs is only
        # ever set during testing).
        if not apps.ready and not apps.stored_app_configs:
            warnings.warn(self.APPS_NOT_READY_WARNING_MSG, category=RuntimeWarning)
        self.db.validate_no_broken_transaction()
        with self.db.wrap_database_errors:
            if params is None:
                # params default might be backend specific.
                return self.cursor.execute(sql)
            else:
>               return self.cursor.execute(sql, params)

.venv/lib/python3.13.../db/backends/utils.py:105: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_prometheus.db.common.ExportingCursorWrapper.<locals>.CursorWrapper [closed] [INTRANS] (host=localhost database=authentik) at 0x7f56b3eba450>
args = ('SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)', ['public::1:goauthentik.io/enterprise/license'])
kwargs = {}

    def execute(self, *args, **kwargs):
        execute_total.labels(alias, vendor).inc()
        with (
            query_duration_seconds.labels(**labels).time(),
            ExceptionCounterByType(errors_total, extra_labels=labels),
        ):
>           return super().execute(*args, **kwargs)

.venv/lib/python3.13.../django_prometheus/db/common.py:69: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <django_prometheus.db.common.ExportingCursorWrapper.<locals>.CursorWrapper [closed] [INTRANS] (host=localhost database=authentik) at 0x7f56b3eba450>
query = 'SELECT "cache_key", "value", "expires" FROM "django_postgres_cache_cacheentry" WHERE "cache_key" IN (%s)'
params = ['public::1:goauthentik.io/enterprise/license']

    def execute(
        self,
        query: Query,
        params: Params | None = None,
        *,
        prepare: bool | None = None,
        binary: bool | None = None,
    ) -> Self:
        """
        Execute a query or command to the database.
        """
        try:
            with self._conn.lock:
                self._conn.wait(
                    self._execute_gen(query, params, prepare=prepare, binary=binary)
                )
        except e._NO_TRACEBACK as ex:
>           raise ex.with_traceback(None)
E           django.db.utils.InternalError: current transaction is aborted, commands ignored until end of transaction block

.venv/lib/python3.13....../site-packages/psycopg/cursor.py:97: InternalError
tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit::test_authorization_consent_implied
Stack Traces | 56.7s run time
self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/implicit/")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        provider.save()
        Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009/implicit/")
        self.wait.until(ec.title_contains("authentik"))
        self.login()
    
>       body = self.parse_json_content()

tests/e2e/test_provider_oidc_implicit.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
context = <selenium.webdriver.remote.webelement.WebElement (session="8ebe5b2d8cf04acd1605b400e0b7c66d", element="f.09630A4691D3EC706FB0672BD6E201B1.d.0A24579D5BD69A41E25AC58930072819.e.29")>
timeout = 10

    def parse_json_content(
        self, context: WebElement | None = None, timeout: float | None = 10
    ) -> JSONType:
        """
        Parse JSON from a Selenium element's text content.
    
        If `context` is not provided, defaults to the <body> element.
        Raises a clear test failure if the element isn't found, the text doesn't appear
        within `timeout` seconds, or the text is not valid JSON.
        """
    
        try:
            if context is None:
                context = self.driver.find_element(By.TAG_NAME, "body")
        except NoSuchElementException:
            self.fail(
                f"No element found (defaulted to <body>). Current URL: {self.driver.current_url}"
            )
    
        wait_timeout = timeout or self.wait_timeout
        wait = WebDriverWait(context, wait_timeout)
    
        try:
            wait.until(lambda d: len(d.text.strip()) != 0)
        except TimeoutException:
            snippet = context.text.strip()[:500].replace("\n", " ")
            self.fail(
                f"Timed out waiting for element text to appear at {self.driver.current_url}. "
                f"Current content: {snippet or '<empty>'}"
            )
    
>       body_text = context.text.strip()

tests/e2e/utils.py:273: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webelement.WebElement (session="8ebe5b2d8cf04acd1605b400e0b7c66d", element="f.09630A4691D3EC706FB0672BD6E201B1.d.0A24579D5BD69A41E25AC58930072819.e.29")>

    @property
    def text(self) -> str:
        """The text of the element.
    
        Returns:
        --------
        str : The text of the element.
    
        Example:
        --------
        >>> element = driver.find_element(By.ID, 'foo')
        >>> print(element.text)
        """
>       return self._execute(Command.GET_ELEMENT_TEXT)["value"]

.venv/lib/python3.13.../webdriver/remote/webelement.py:109: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webelement.WebElement (session="8ebe5b2d8cf04acd1605b400e0b7c66d", element="f.09630A4691D3EC706FB0672BD6E201B1.d.0A24579D5BD69A41E25AC58930072819.e.29")>
command = 'getElementText'
params = {'id': 'f.09630A4691D3EC706FB0672BD6E201B1.d.0A24579D5BD69A41E25AC58930072819.e.29'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Parameters:
        -----------
        command : any
            The name of the command to _execute as a string.
    
        params : dict
            A dictionary of named Parameters to send with the command.
    
        Returns:
        -------
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["id"] = self._id
>       return self._parent.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/webelement.py:572: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="8ebe5b2d8cf04acd1605b400e0b7c66d")>
driver_command = 'getElementText', params = {}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f1a81e50>
response = {'status': 404, 'value': '{"value":{"error":"stale element reference","message":"stale element reference: stale elemen...\\n#25 0x557b7472b7f5 \\u003Cunknown>\\n#26 0x557b7473d229 \\u003Cunknown>\\n#27 0x7fc1b97b17db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found
E         (Session info: chrome=143.0.7499.40); For documentation on this error, please visit: https://www.selenium..../webdriver/troubleshooting/errors#stale-element-reference-exception
E       Stacktrace:
E       #0 0x557b7473df52 <unknown>
E       #1 0x557b7418321b <unknown>
E       #2 0x557b74196d07 <unknown>
E       #3 0x557b74195910 <unknown>
E       #4 0x557b74197219 <unknown>
E       #5 0x557b7418a764 <unknown>
E       #6 0x557b74189373 <unknown>
E       #7 0x557b7418c86f <unknown>
E       #8 0x557b7418c955 <unknown>
E       #9 0x557b741cd81f <unknown>
E       #10 0x557b741f79b6 <unknown>
E       #11 0x557b741c7681 <unknown>
E       #12 0x557b741f7ba2 <unknown>
E       #13 0x557b74219662 <unknown>
E       #14 0x557b741f7767 <unknown>
E       #15 0x557b741c5b47 <unknown>
E       #16 0x557b741c6915 <unknown>
E       #17 0x557b74708b84 <unknown>
E       #18 0x557b7470be74 <unknown>
E       #19 0x557b7470b92e <unknown>
E       #20 0x557b7470c309 <unknown>
E       #21 0x557b746f259a <unknown>
E       #22 0x557b7470c67a <unknown>
E       #23 0x557b746db149 <unknown>
E       #24 0x557b7472b609 <unknown>
E       #25 0x557b7472b7f5 <unknown>
E       #26 0x557b7473d229 <unknown>
E       #27 0x7fc1b97b17db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: StaleElementReferenceException

During handling of the above exception, another exception occurred:

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/implicit/")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        provider.save()
        Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009/implicit/")
        self.wait.until(ec.title_contains("authentik"))
        self.login()
    
>       body = self.parse_json_content()

tests/e2e/test_provider_oidc_implicit.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
context = <selenium.webdriver.remote.webelement.WebElement (session="7f75e3c5278f57486ee623b1955719e4", element="f.5BC55C50D89493A1EC19AE3F49B5F1BB.d.ABEB7A97789DA7260F7219B1BC7BF97C.e.29")>
timeout = 10

    def parse_json_content(
        self, context: WebElement | None = None, timeout: float | None = 10
    ) -> JSONType:
        """
        Parse JSON from a Selenium element's text content.
    
        If `context` is not provided, defaults to the <body> element.
        Raises a clear test failure if the element isn't found, the text doesn't appear
        within `timeout` seconds, or the text is not valid JSON.
        """
    
        try:
            if context is None:
                context = self.driver.find_element(By.TAG_NAME, "body")
        except NoSuchElementException:
            self.fail(
                f"No element found (defaulted to <body>). Current URL: {self.driver.current_url}"
            )
    
        wait_timeout = timeout or self.wait_timeout
        wait = WebDriverWait(context, wait_timeout)
    
        try:
            wait.until(lambda d: len(d.text.strip()) != 0)
        except TimeoutException:
            snippet = context.text.strip()[:500].replace("\n", " ")
            self.fail(
                f"Timed out waiting for element text to appear at {self.driver.current_url}. "
                f"Current content: {snippet or '<empty>'}"
            )
    
        body_text = context.text.strip()
>       inner_html = context.get_attribute("innerHTML") or ""

tests/e2e/utils.py:274: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webelement.WebElement (session="7f75e3c5278f57486ee623b1955719e4", element="f.5BC55C50D89493A1EC19AE3F49B5F1BB.d.ABEB7A97789DA7260F7219B1BC7BF97C.e.29")>
name = 'innerHTML'

    def get_attribute(self, name) -> str | None:
        """Gets the given attribute or property of the element.
    
        This method will first try to return the value of a property with the
        given name. If a property with that name doesn't exist, it returns the
        value of the attribute with the same name. If there's no attribute with
        that name, ``None`` is returned.
    
        Values which are considered truthy, that is equals "true" or "false",
        are returned as booleans.  All other non-``None`` values are returned
        as strings.  For attributes or properties which do not exist, ``None``
        is returned.
    
        To obtain the exact value of the attribute or property,
        use :func:`~selenium.webdriver.remote.BaseWebElement.get_dom_attribute` or
        :func:`~selenium.webdriver.remote.BaseWebElement.get_property` methods respectively.
    
        Parameters:
        -----------
        name : str
            - Name of the attribute/property to retrieve.
    
        Returns:
        -------
        str | bool | None : The value of the attribute/property.
    
        Example:
        --------
        >>> # Check if the "active" CSS class is applied to an element.
        >>> is_active = "active" in target_element.get_attribute("class")
        """
        if getAttribute_js is None:
            _load_js()
>       attribute_value = self.parent.execute_script(
            f"/* getAttribute */return ({getAttribute_js}).apply(null, arguments);", self, name
        )

.venv/lib/python3.13.../webdriver/remote/webelement.py:231: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="7f75e3c5278f57486ee623b1955719e4")>
script = '/* getAttribute */return (function(){return (function(){var d=this||self;function f(a,b){function c(){}c.prototype=b....; return this.se_exportedFunctionSymbol.apply(null,arguments);}).apply(window, arguments);}\n).apply(null, arguments);'
args = (<selenium.webdriver.remote.webelement.WebElement (session="7f75e3c5278f57486ee623b1955719e4", element="f.5BC55C50D89493A1EC19AE3F49B5F1BB.d.ABEB7A97789DA7260F7219B1BC7BF97C.e.29")>, 'innerHTML')
converted_args = [<selenium.webdriver.remote.webelement.WebElement (session="7f75e3c5278f57486ee623b1955719e4", element="f.5BC55C50D89493A1EC19AE3F49B5F1BB.d.ABEB7A97789DA7260F7219B1BC7BF97C.e.29")>, 'innerHTML']
command = 'w3cExecuteScript'

    def execute_script(self, script, *args):
        """Synchronously Executes JavaScript in the current window/frame.
    
        Parameters:
        -----------
        script : str
            - The javascript to execute.
    
        *args : tuple
            - Any applicable arguments for your JavaScript.
    
        Example:
        --------
        >>> input_id = "username"
        >>> input_value = "test_user"
        >>> driver.execute_script(
        ...     "document.getElementById(arguments[0]).value = arguments[1];", input_id, input_value
        ... )
        """
        if isinstance(script, ScriptKey):
            try:
                script = self.pinned_scripts[script.id]
            except KeyError:
                raise JavascriptException("Pinned script could not be found")
    
        converted_args = list(args)
        command = Command.W3C_EXECUTE_SCRIPT
    
>       return self.execute(command, {"script": script, "args": converted_args})["value"]

.venv/lib/python3.13.../webdriver/remote/webdriver.py:547: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="7f75e3c5278f57486ee623b1955719e4")>
driver_command = 'w3cExecuteScript'
params = {'args': [{'element-6066-11e4-a52e-4f735466cecf': 'f.5BC55C50D89493A1EC19AE3F49B5F1BB.d.ABEB7A97789DA7260F7219B1BC7BF9... return this.se_exportedFunctionSymbol.apply(null,arguments);}).apply(window, arguments);}\n).apply(null, arguments);'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f134cb50>
response = {'status': 404, 'value': '{"value":{"error":"stale element reference","message":"stale element reference: stale elemen...\\n#24 0x55d5ff77f7f5 \\u003Cunknown>\\n#25 0x55d5ff791229 \\u003Cunknown>\\n#26 0x7f289c3527db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found
E         (Session info: chrome=143.0.7499.40); For documentation on this error, please visit: https://www.selenium..../webdriver/troubleshooting/errors#stale-element-reference-exception
E       Stacktrace:
E       #0 0x55d5ff791f52 <unknown>
E       #1 0x55d5ff1d721b <unknown>
E       #2 0x55d5ff1ead07 <unknown>
E       #3 0x55d5ff1e9910 <unknown>
E       #4 0x55d5ff1eb219 <unknown>
E       #5 0x55d5ff1de764 <unknown>
E       #6 0x55d5ff1eb1eb <unknown>
E       #7 0x55d5ff1de764 <unknown>
E       #8 0x55d5ff1dd373 <unknown>
E       #9 0x55d5ff1e0bdc <unknown>
E       #10 0x55d5ff26e4a3 <unknown>
E       #11 0x55d5ff24b9b6 <unknown>
E       #12 0x55d5ff26d662 <unknown>
E       #13 0x55d5ff24b767 <unknown>
E       #14 0x55d5ff219b47 <unknown>
E       #15 0x55d5ff21a915 <unknown>
E       #16 0x55d5ff75cb84 <unknown>
E       #17 0x55d5ff75fe74 <unknown>
E       #18 0x55d5ff75f92e <unknown>
E       #19 0x55d5ff760309 <unknown>
E       #20 0x55d5ff74659a <unknown>
E       #21 0x55d5ff76067a <unknown>
E       #22 0x55d5ff72f149 <unknown>
E       #23 0x55d5ff77f609 <unknown>
E       #24 0x55d5ff77f7f5 <unknown>
E       #25 0x55d5ff791229 <unknown>
E       #26 0x7f289c3527db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: StaleElementReferenceException

During handling of the above exception, another exception occurred:

self = <unittest.case._Outcome object at 0x7fd5f243b0b0>
test_case = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
result = <TestCaseFunction test_authorization_consent_implied>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
method = <bound method TestProviderOAuth2OIDCImplicit.test_authorization_consent_implied of <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:481: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:481: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
>               raise exc

tests/e2e/utils.py:475: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/implicit/")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        provider.save()
        Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009/implicit/")
        self.wait.until(ec.title_contains("authentik"))
        self.login()
    
>       body = self.parse_json_content()

tests/e2e/test_provider_oidc_implicit.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
context = <selenium.webdriver.remote.webelement.WebElement (session="fe65869cd9e8fb4011b0913f077d150f", element="f.39311F6111ECAD631843319958304FF9.d.08E67EFF54BD20A0B2923DA783DEE29A.e.29")>
timeout = 10

    def parse_json_content(
        self, context: WebElement | None = None, timeout: float | None = 10
    ) -> JSONType:
        """
        Parse JSON from a Selenium element's text content.
    
        If `context` is not provided, defaults to the <body> element.
        Raises a clear test failure if the element isn't found, the text doesn't appear
        within `timeout` seconds, or the text is not valid JSON.
        """
    
        try:
            if context is None:
                context = self.driver.find_element(By.TAG_NAME, "body")
        except NoSuchElementException:
            self.fail(
                f"No element found (defaulted to <body>). Current URL: {self.driver.current_url}"
            )
    
        wait_timeout = timeout or self.wait_timeout
        wait = WebDriverWait(context, wait_timeout)
    
        try:
            wait.until(lambda d: len(d.text.strip()) != 0)
        except TimeoutException:
            snippet = context.text.strip()[:500].replace("\n", " ")
            self.fail(
                f"Timed out waiting for element text to appear at {self.driver.current_url}. "
                f"Current content: {snippet or '<empty>'}"
            )
    
>       body_text = context.text.strip()

tests/e2e/utils.py:273: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webelement.WebElement (session="fe65869cd9e8fb4011b0913f077d150f", element="f.39311F6111ECAD631843319958304FF9.d.08E67EFF54BD20A0B2923DA783DEE29A.e.29")>

    @property
    def text(self) -> str:
        """The text of the element.
    
        Returns:
        --------
        str : The text of the element.
    
        Example:
        --------
        >>> element = driver.find_element(By.ID, 'foo')
        >>> print(element.text)
        """
>       return self._execute(Command.GET_ELEMENT_TEXT)["value"]

.venv/lib/python3.13.../webdriver/remote/webelement.py:109: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webelement.WebElement (session="fe65869cd9e8fb4011b0913f077d150f", element="f.39311F6111ECAD631843319958304FF9.d.08E67EFF54BD20A0B2923DA783DEE29A.e.29")>
command = 'getElementText'
params = {'id': 'f.39311F6111ECAD631843319958304FF9.d.08E67EFF54BD20A0B2923DA783DEE29A.e.29'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Parameters:
        -----------
        command : any
            The name of the command to _execute as a string.
    
        params : dict
            A dictionary of named Parameters to send with the command.
    
        Returns:
        -------
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["id"] = self._id
>       return self._parent.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/webelement.py:572: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="fe65869cd9e8fb4011b0913f077d150f")>
driver_command = 'getElementText', params = {}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f20b9130>
response = {'status': 404, 'value': '{"value":{"error":"stale element reference","message":"stale element reference: stale elemen...\\n#25 0x5643983aa7f5 \\u003Cunknown>\\n#26 0x5643983bc229 \\u003Cunknown>\\n#27 0x7f3de2e647db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found
E         (Session info: chrome=143.0.7499.40); For documentation on this error, please visit: https://www.selenium..../webdriver/troubleshooting/errors#stale-element-reference-exception
E       Stacktrace:
E       #0 0x5643983bcf52 <unknown>
E       #1 0x564397e0221b <unknown>
E       #2 0x564397e15d07 <unknown>
E       #3 0x564397e14910 <unknown>
E       #4 0x564397e16219 <unknown>
E       #5 0x564397e09764 <unknown>
E       #6 0x564397e08373 <unknown>
E       #7 0x564397e0b86f <unknown>
E       #8 0x564397e0b955 <unknown>
E       #9 0x564397e4c81f <unknown>
E       #10 0x564397e769b6 <unknown>
E       #11 0x564397e46681 <unknown>
E       #12 0x564397e76ba2 <unknown>
E       #13 0x564397e98662 <unknown>
E       #14 0x564397e76767 <unknown>
E       #15 0x564397e44b47 <unknown>
E       #16 0x564397e45915 <unknown>
E       #17 0x564398387b84 <unknown>
E       #18 0x56439838ae74 <unknown>
E       #19 0x56439838a92e <unknown>
E       #20 0x56439838b309 <unknown>
E       #21 0x56439837159a <unknown>
E       #22 0x56439838b67a <unknown>
E       #23 0x56439835a149 <unknown>
E       #24 0x5643983aa609 <unknown>
E       #25 0x5643983aa7f5 <unknown>
E       #26 0x5643983bc229 <unknown>
E       #27 0x7f3de2e647db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: StaleElementReferenceException
tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC::test_authorization_consent_explicit
Stack Traces | 158s run time
self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="4e49e3ae7ada46fa26f57ebc4417810f", element="f.7AE2129EE51563181338EBDCB956CC33.d.6BF1CAC081D49ECA63674BC5F0B1AA81.e.7")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fd5f2897350>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fd5f13b4b80>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="4e49e3ae7ada46fa26f57ebc4417810f", element="f.7AE2129EE51563181338EBDCB956CC33.d.6BF1CAC081D49ECA63674BC5F0B1AA81.e.7")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="4e49e3ae7ada46fa26f57ebc4417810f", element="f.7AE2129EE51563181338EBDCB956CC33.d.6BF1CAC081D49ECA63674BC5F0B1AA81.e.7")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="4e49e3ae7ada46fa26f57ebc4417810f", element="f.7AE2129EE51563181338EBDCB956CC33.d.6BF1CAC081D49ECA63674BC5F0B1AA81.e.7")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.7AE2129EE51563181338EBDCB956CC33.d.6BF1CAC081D49ECA63674BC5F0B1AA81.e.7', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="4e49e3ae7ada46fa26f57ebc4417810f")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f2b16a50>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x562baa08e7f5 \\u003Cunknown>\\n#28 0x562baa0a0229 \\u003Cunknown>\\n#29 0x7f8744e547db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.40)
E       Stacktrace:
E       #0 0x562baa0a0f52 <unknown>
E       #1 0x562ba9ae621b <unknown>
E       #2 0x562ba9af9d07 <unknown>
E       #3 0x562ba9af8910 <unknown>
E       #4 0x562ba9afa219 <unknown>
E       #5 0x562ba9aed764 <unknown>
E       #6 0x562ba9aec373 <unknown>
E       #7 0x562ba9aef86f <unknown>
E       #8 0x562ba9aef955 <unknown>
E       #9 0x562ba9b358a4 <unknown>
E       #10 0x562ba9b362d5 <unknown>
E       #11 0x562ba9b2a7aa <unknown>
E       #12 0x562ba9b5a9e1 <unknown>
E       #13 0x562ba9b2a681 <unknown>
E       #14 0x562ba9b5aba2 <unknown>
E       #15 0x562ba9b7c662 <unknown>
E       #16 0x562ba9b5a767 <unknown>
E       #17 0x562ba9b28b47 <unknown>
E       #18 0x562ba9b29915 <unknown>
E       #19 0x562baa06bb84 <unknown>
E       #20 0x562baa06ee74 <unknown>
E       #21 0x562baa06e92e <unknown>
E       #22 0x562baa06f309 <unknown>
E       #23 0x562baa05559a <unknown>
E       #24 0x562baa06f67a <unknown>
E       #25 0x562baa03e149 <unknown>
E       #26 0x562baa08e609 <unknown>
E       #27 0x562baa08e7f5 <unknown>
E       #28 0x562baa0a0229 <unknown>
E       #29 0x7f8744e547db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="950aa8b444e325a5d71a715ce95b2a3b", element="f.260EE7153C335000E2E980E42E254B77.d.BC851E07E49FD0B477A1ABCCEE8992C3.e.7")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fd5f165c310>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fd5f202b560>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="950aa8b444e325a5d71a715ce95b2a3b", element="f.260EE7153C335000E2E980E42E254B77.d.BC851E07E49FD0B477A1ABCCEE8992C3.e.7")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="950aa8b444e325a5d71a715ce95b2a3b", element="f.260EE7153C335000E2E980E42E254B77.d.BC851E07E49FD0B477A1ABCCEE8992C3.e.7")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="950aa8b444e325a5d71a715ce95b2a3b", element="f.260EE7153C335000E2E980E42E254B77.d.BC851E07E49FD0B477A1ABCCEE8992C3.e.7")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.260EE7153C335000E2E980E42E254B77.d.BC851E07E49FD0B477A1ABCCEE8992C3.e.7', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="950aa8b444e325a5d71a715ce95b2a3b")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f1518e10>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x55738bd757f5 \\u003Cunknown>\\n#28 0x55738bd87229 \\u003Cunknown>\\n#29 0x7f943379d7db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.40)
E       Stacktrace:
E       #0 0x55738bd87f52 <unknown>
E       #1 0x55738b7cd21b <unknown>
E       #2 0x55738b7e0d07 <unknown>
E       #3 0x55738b7df910 <unknown>
E       #4 0x55738b7e1219 <unknown>
E       #5 0x55738b7d4764 <unknown>
E       #6 0x55738b7d3373 <unknown>
E       #7 0x55738b7d686f <unknown>
E       #8 0x55738b7d6955 <unknown>
E       #9 0x55738b81c8a4 <unknown>
E       #10 0x55738b81d2d5 <unknown>
E       #11 0x55738b8117aa <unknown>
E       #12 0x55738b8419e1 <unknown>
E       #13 0x55738b811681 <unknown>
E       #14 0x55738b841ba2 <unknown>
E       #15 0x55738b863662 <unknown>
E       #16 0x55738b841767 <unknown>
E       #17 0x55738b80fb47 <unknown>
E       #18 0x55738b810915 <unknown>
E       #19 0x55738bd52b84 <unknown>
E       #20 0x55738bd55e74 <unknown>
E       #21 0x55738bd5592e <unknown>
E       #22 0x55738bd56309 <unknown>
E       #23 0x55738bd3c59a <unknown>
E       #24 0x55738bd5667a <unknown>
E       #25 0x55738bd25149 <unknown>
E       #26 0x55738bd75609 <unknown>
E       #27 0x55738bd757f5 <unknown>
E       #28 0x55738bd87229 <unknown>
E       #29 0x7f943379d7db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <unittest.case._Outcome object at 0x7fd5f2b170e0>
test_case = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
result = <TestCaseFunction test_authorization_consent_explicit>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
method = <bound method TestProviderOAuth2OIDC.test_authorization_consent_explicit of <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:481: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:481: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
>               raise exc

tests/e2e/utils.py:475: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:468: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="64beccde3d02d6717c013a41e3898e61", element="f.49A7797BC0D000C89F53C08348641138.d.165B7466E8C857B6ECA576549EA3993D.e.7")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fd5f1aaaac0>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fd5f23fe200>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="64beccde3d02d6717c013a41e3898e61", element="f.49A7797BC0D000C89F53C08348641138.d.165B7466E8C857B6ECA576549EA3993D.e.7")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:323: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="64beccde3d02d6717c013a41e3898e61", element="f.49A7797BC0D000C89F53C08348641138.d.165B7466E8C857B6ECA576549EA3993D.e.7")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="64beccde3d02d6717c013a41e3898e61", element="f.49A7797BC0D000C89F53C08348641138.d.165B7466E8C857B6ECA576549EA3993D.e.7")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.49A7797BC0D000C89F53C08348641138.d.165B7466E8C857B6ECA576549EA3993D.e.7', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="64beccde3d02d6717c013a41e3898e61")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fd5f15191d0>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x55d8f2edd7f5 \\u003Cunknown>\\n#28 0x55d8f2eef229 \\u003Cunknown>\\n#29 0x7fab2df9e7db \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.40)
E       Stacktrace:
E       #0 0x55d8f2eeff52 <unknown>
E       #1 0x55d8f293521b <unknown>
E       #2 0x55d8f2948d07 <unknown>
E       #3 0x55d8f2947910 <unknown>
E       #4 0x55d8f2949219 <unknown>
E       #5 0x55d8f293c764 <unknown>
E       #6 0x55d8f293b373 <unknown>
E       #7 0x55d8f293e86f <unknown>
E       #8 0x55d8f293e955 <unknown>
E       #9 0x55d8f29848a4 <unknown>
E       #10 0x55d8f29852d5 <unknown>
E       #11 0x55d8f29797aa <unknown>
E       #12 0x55d8f29a99e1 <unknown>
E       #13 0x55d8f2979681 <unknown>
E       #14 0x55d8f29a9ba2 <unknown>
E       #15 0x55d8f29cb662 <unknown>
E       #16 0x55d8f29a9767 <unknown>
E       #17 0x55d8f2977b47 <unknown>
E       #18 0x55d8f2978915 <unknown>
E       #19 0x55d8f2ebab84 <unknown>
E       #20 0x55d8f2ebde74 <unknown>
E       #21 0x55d8f2ebd92e <unknown>
E       #22 0x55d8f2ebe309 <unknown>
E       #23 0x55d8f2ea459a <unknown>
E       #24 0x55d8f2ebe67a <unknown>
E       #25 0x55d8f2e8d149 <unknown>
E       #26 0x55d8f2edd609 <unknown>
E       #27 0x55d8f2edd7f5 <unknown>
E       #28 0x55d8f2eef229 <unknown>
E       #29 0x7fab2df9e7db <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@netlify
Copy link

netlify bot commented Dec 17, 2025

Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit ca97ab4
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6942307500449d00089b9b7c
😎 Deploy Preview https://deploy-preview-18898--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@BeryJu BeryJu merged commit d64a3aa into main Dec 17, 2025
88 of 95 checks passed
@BeryJu BeryJu deleted the dependabot/docker/astral-sh/uv-0.9.18 branch December 17, 2025 11:28
enchantednatures pushed a commit to enchantednatures/HomeCluster that referenced this pull request Feb 26, 2026
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [authentik](https://goauthentik.io)
([source](https://redirect.github.com/goauthentik/helm)) | major |
`2025.12.4` → `2026.2.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>goauthentik/helm (authentik)</summary>

###
[`v2026.2.0`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.0)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: add fields auto-added by Kubernetes to httproute by
[@&#8203;cfi2017](https://redirect.github.com/cfi2017) in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)
- chore(deps): update helm/kind-action action to v1.14.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;454](https://redirect.github.com/goauthentik/helm/pull/454)
- charts/authentik: add note how to set version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[#&#8203;456](https://redirect.github.com/goauthentik/helm/pull/456)
- charts/authentik: bump to 2026.2.0 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;457](https://redirect.github.com/goauthentik/helm/pull/457)

#### New Contributors

- [@&#8203;cfi2017](https://redirect.github.com/cfi2017) made their
first contribution in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2>

#### What's Changed

- root: bump version to 2026.2.0-rc1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18794](https://redirect.github.com/goauthentik/authentik/pull/18794)
- tests/e2e: retry detached shadow roots by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18796](https://redirect.github.com/goauthentik/authentik/pull/18796)
- website/release notes: Update v2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18797](https://redirect.github.com/goauthentik/authentik/pull/18797)
- web/admin: fix read-only provider selection for application form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18768](https://redirect.github.com/goauthentik/authentik/pull/18768)
- web: bump the react group across 1 directory with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18775](https://redirect.github.com/goauthentik/authentik/pull/18775)
- web: bump chromedriver from 143.0.0 to 143.0.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18776](https://redirect.github.com/goauthentik/authentik/pull/18776)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18774](https://redirect.github.com/goauthentik/authentik/pull/18774)
- internal: don't warn on empty outpost for embedded by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18786](https://redirect.github.com/goauthentik/authentik/pull/18786)
- lifecycle/aws: bump aws-cdk from 2.1033.0 to 2.1034.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18771](https://redirect.github.com/goauthentik/authentik/pull/18771)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18804](https://redirect.github.com/goauthentik/authentik/pull/18804)
- root: Add macOS support for sed in Makefile by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18795](https://redirect.github.com/goauthentik/authentik/pull/18795)
- ci: bump astral-sh/setup-uv from 7.1.5 to 7.1.6 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18826](https://redirect.github.com/goauthentik/authentik/pull/18826)
- ci: bump actions/upload-artifact from 5.0.0 to 6.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18824](https://redirect.github.com/goauthentik/authentik/pull/18824)
- core: bump goauthentik/fips-debian from `07f41ce` to `c10cd2c` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18822](https://redirect.github.com/goauthentik/authentik/pull/18822)
- ci: bump actions/download-artifact from 6.0.0 to 7.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18825](https://redirect.github.com/goauthentik/authentik/pull/18825)
- ci: bump actions/cache from 5.0.0 to 5.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18823](https://redirect.github.com/goauthentik/authentik/pull/18823)
- core: list applications fix by
[@&#8203;ryanpesek](https://redirect.github.com/ryanpesek) in
[goauthentik/authentik#18798](https://redirect.github.com/goauthentik/authentik/pull/18798)
- website/docs: add icon info to style guide by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18832](https://redirect.github.com/goauthentik/authentik/pull/18832)
- core: remove superuser check from `Token` list by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18684](https://redirect.github.com/goauthentik/authentik/pull/18684)
- packages/django-dramatiq-postgres: broker: close django connections on
consumer close by [@&#8203;rissson](https://redirect.github.com/rissson)
in
[goauthentik/authentik#18833](https://redirect.github.com/goauthentik/authentik/pull/18833)
- core: bump goauthentik.io/api/v3 from 3.2025120.26 to 3.2026020.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18815](https://redirect.github.com/goauthentik/authentik/pull/18815)
- admin/files: revert add check for /media existence
([#&#8203;18636](https://redirect.github.com/goauthentik/helm/issues/18636))
by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18829](https://redirect.github.com/goauthentik/authentik/pull/18829)
- website/docs: add jellyseer integration doc by
[@&#8203;gabay](https://redirect.github.com/gabay) in
[goauthentik/authentik#18812](https://redirect.github.com/goauthentik/authentik/pull/18812)
- crypto: Store details parsed from includeDetails in database instead
by [@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18013](https://redirect.github.com/goauthentik/authentik/pull/18013)
- core: skip s3 tests if endpoint isn't available by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18841](https://redirect.github.com/goauthentik/authentik/pull/18841)
- admin/files: fix get\_objects\_for\_user queryset argument in
FileUsedByView by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18845](https://redirect.github.com/goauthentik/authentik/pull/18845)
- core: bump goauthentik/fips-debian from `c10cd2c` to `2f19fc1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18856](https://redirect.github.com/goauthentik/authentik/pull/18856)
- ci: replace codecov test-results action by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18862](https://redirect.github.com/goauthentik/authentik/pull/18862)
- core: add skip s3\_test\_server\_available to
TestResolveFileUrlS3Backend by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18858](https://redirect.github.com/goauthentik/authentik/pull/18858)
- rbac: alter migrated direct permission roles by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18860](https://redirect.github.com/goauthentik/authentik/pull/18860)
- core: bump library/golang from `5d35fb8` to `8e8f9c8` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18855](https://redirect.github.com/goauthentik/authentik/pull/18855)
- web/admin/rbac: misc object permission fixes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18859](https://redirect.github.com/goauthentik/authentik/pull/18859)
- outposts: fix permission errors for related certificates by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18861](https://redirect.github.com/goauthentik/authentik/pull/18861)
- website/docs: adjust RBAC-related details in 2025.12 release notes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18863](https://redirect.github.com/goauthentik/authentik/pull/18863)
- website/docs: Add docs for passkey autofill (WebauthN Conditional UI)
by [@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18805](https://redirect.github.com/goauthentik/authentik/pull/18805)
- website/docs: 2025.10.3 release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18868](https://redirect.github.com/goauthentik/authentik/pull/18868)
- web: add custom message with links for empty data export list by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18830](https://redirect.github.com/goauthentik/authentik/pull/18830)
- web: fix notification counter by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18781](https://redirect.github.com/goauthentik/authentik/pull/18781)
- web: bump vite from 7.2.7 to 7.3.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18854](https://redirect.github.com/goauthentik/authentik/pull/18854)
- stages/authenticator\_\*: fix code input field not string by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18875](https://redirect.github.com/goauthentik/authentik/pull/18875)
- web: fix file upload form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18808](https://redirect.github.com/goauthentik/authentik/pull/18808)
- web/admin: endpoint: change wording and add helper text by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18871](https://redirect.github.com/goauthentik/authentik/pull/18871)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18807](https://redirect.github.com/goauthentik/authentik/pull/18807)
- website/integrations: bookstack: fix redir url by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18891](https://redirect.github.com/goauthentik/authentik/pull/18891)
- core: bump astral-sh/uv from 0.9.17 to 0.9.18 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18898](https://redirect.github.com/goauthentik/authentik/pull/18898)
- core: bump goauthentik/fips-debian from `2f19fc1` to `189345a` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18897](https://redirect.github.com/goauthentik/authentik/pull/18897)
- web: bump knip from 5.73.3 to 5.74.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18896](https://redirect.github.com/goauthentik/authentik/pull/18896)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.0 to 25.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18895](https://redirect.github.com/goauthentik/authentik/pull/18895)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18852](https://redirect.github.com/goauthentik/authentik/pull/18852)
- web: bump the bundler group across 1 directory with 7 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18894](https://redirect.github.com/goauthentik/authentik/pull/18894)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.30.0 to 10.31.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18893](https://redirect.github.com/goauthentik/authentik/pull/18893)
- lifecycle/aws: bump aws-cdk from 2.1034.0 to 2.1100.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18850](https://redirect.github.com/goauthentik/authentik/pull/18850)
- web: bump the goauthentik group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18819](https://redirect.github.com/goauthentik/authentik/pull/18819)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18818](https://redirect.github.com/goauthentik/authentik/pull/18818)
- web: bump the eslint group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18851](https://redirect.github.com/goauthentik/authentik/pull/18851)
- core: bump goauthentik.io/api/v3 from 3.2026020.1 to 3.2026020.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18892](https://redirect.github.com/goauthentik/authentik/pull/18892)
- tasks/middleware: close connections on worker status update database
error by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18881](https://redirect.github.com/goauthentik/authentik/pull/18881)
- website/docs: added list of Int Guide contributors (also edited
frontmatter) by [@&#8203;tanberry](https://redirect.github.com/tanberry)
in
[goauthentik/authentik#18888](https://redirect.github.com/goauthentik/authentik/pull/18888)
- api: fix page\_size with invalid query param by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18879](https://redirect.github.com/goauthentik/authentik/pull/18879)
- ci/release-tag: checkout correct branch for make test-docker by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18880](https://redirect.github.com/goauthentik/authentik/pull/18880)
- api: fix latest version for public schema by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18902](https://redirect.github.com/goauthentik/authentik/pull/18902)
- website/docs: 2025.12: remove superfluous changes by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18910](https://redirect.github.com/goauthentik/authentik/pull/18910)
- web/admin: reword some things on the device view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18785](https://redirect.github.com/goauthentik/authentik/pull/18785)
- core/groups: optimize prefetch queries to fetch only required fields
by [@&#8203;joaocfernandes](https://redirect.github.com/joaocfernandes)
in
[goauthentik/authentik#18448](https://redirect.github.com/goauthentik/authentik/pull/18448)
- root: fix docker-compose data mount by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18903](https://redirect.github.com/goauthentik/authentik/pull/18903)
- web/admin: add UI copy to RBAC modal by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#18917](https://redirect.github.com/goauthentik/authentik/pull/18917)
- tests/e2e: handle StaleElementReferenceException in
parse\_json\_content by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18842](https://redirect.github.com/goauthentik/authentik/pull/18842)
- core: bump goauthentik/fips-debian from `189345a` to `10dadf1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18927](https://redirect.github.com/goauthentik/authentik/pull/18927)
- web: bump chromedriver from 143.0.1 to 143.0.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18926](https://redirect.github.com/goauthentik/authentik/pull/18926)
- web: bump knip from 5.74.0 to 5.75.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18924](https://redirect.github.com/goauthentik/authentik/pull/18924)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18920](https://redirect.github.com/goauthentik/authentik/pull/18920)
- lifecycle/aws: bump aws-cdk from 2.1100.0 to 2.1100.1 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18922](https://redirect.github.com/goauthentik/authentik/pull/18922)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18923](https://redirect.github.com/goauthentik/authentik/pull/18923)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18817](https://redirect.github.com/goauthentik/authentik/pull/18817)
- stages: remove more global state by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18641](https://redirect.github.com/goauthentik/authentik/pull/18641)
- packages/ak-guardian: cast safely by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18929](https://redirect.github.com/goauthentik/authentik/pull/18929)
- web/flow: Fix spurious double submit on ak-stage-autosubmit by
[@&#8203;dminuoso](https://redirect.github.com/dminuoso) in
[goauthentik/authentik#18727](https://redirect.github.com/goauthentik/authentik/pull/18727)
- website/integrations: Add launch URL for Immich by
[@&#8203;optix2000](https://redirect.github.com/optix2000) in
[goauthentik/authentik#18921](https://redirect.github.com/goauthentik/authentik/pull/18921)
- crypto: fix extra cert data in db migration by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18937](https://redirect.github.com/goauthentik/authentik/pull/18937)
- web/elements: progress-bar and table loading header by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18934](https://redirect.github.com/goauthentik/authentik/pull/18934)
- stages/identification: replace sleep with make\_password by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18883](https://redirect.github.com/goauthentik/authentik/pull/18883)
- website/docs: endpoint devices by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18634](https://redirect.github.com/goauthentik/authentik/pull/18634)
- website/docs: Fix labels, Pre-Release detection by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18945](https://redirect.github.com/goauthentik/authentik/pull/18945)
- website/docs: release notes: add endpoint device links to 2025.12
notes by [@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18940](https://redirect.github.com/goauthentik/authentik/pull/18940)
- website/docs: Fix version parsing. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18948](https://redirect.github.com/goauthentik/authentik/pull/18948)
- web/admin: fix endpoints user binding by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18935](https://redirect.github.com/goauthentik/authentik/pull/18935)
- flows/executor: fix KeyError when session has no existing plan by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18951](https://redirect.github.com/goauthentik/authentik/pull/18951)
- root: move docker files to lifecycle/containers and change
docker-compose to compose by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#16624](https://redirect.github.com/goauthentik/authentik/pull/16624)
- core: bump goauthentik.io/api/v3 from 3.2026020.3 to 3.2026020.4 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18956](https://redirect.github.com/goauthentik/authentik/pull/18956)
- web: bump chromedriver from 143.0.2 to 143.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18959](https://redirect.github.com/goauthentik/authentik/pull/18959)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18958](https://redirect.github.com/goauthentik/authentik/pull/18958)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.31.0 to 10.32.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18957](https://redirect.github.com/goauthentik/authentik/pull/18957)
- ci: bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18960](https://redirect.github.com/goauthentik/authentik/pull/18960)
- website/docs: add note to active directory source doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18787](https://redirect.github.com/goauthentik/authentik/pull/18787)
- web/maintenance: fix missing custom web component imports by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18942](https://redirect.github.com/goauthentik/authentik/pull/18942)
- web/maintenance: no unknown tag names by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18944](https://redirect.github.com/goauthentik/authentik/pull/18944)
- website/integrations: Fix path for Cloudflare Access by
[@&#8203;stijn220](https://redirect.github.com/stijn220) in
[goauthentik/authentik#18979](https://redirect.github.com/goauthentik/authentik/pull/18979)
- blueprints: add InternallyManagedMixin instead of large list by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18983](https://redirect.github.com/goauthentik/authentik/pull/18983)
- web/admin: fix dark theme on map by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18985](https://redirect.github.com/goauthentik/authentik/pull/18985)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm by
[@&#8203;hskrtich](https://redirect.github.com/hskrtich) in
[goauthentik/authentik#18984](https://redirect.github.com/goauthentik/authentik/pull/18984)
- events: notifications live update by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18980](https://redirect.github.com/goauthentik/authentik/pull/18980)
- web: fix Open button selecting row instead of navigating by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18992](https://redirect.github.com/goauthentik/authentik/pull/18992)
- blueprints: fix flaky tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19002](https://redirect.github.com/goauthentik/authentik/pull/19002)
- ci: bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18999](https://redirect.github.com/goauthentik/authentik/pull/18999)
- providers/oauth2: Automated OpenID Conformance tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#14785](https://redirect.github.com/goauthentik/authentik/pull/14785)
- enterprise/reports: improve export list, confirmation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18981](https://redirect.github.com/goauthentik/authentik/pull/18981)
- enterprise/search: add static autocomplete structure by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19008](https://redirect.github.com/goauthentik/authentik/pull/19008)
- website/docs: improve endpoint devices docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19007](https://redirect.github.com/goauthentik/authentik/pull/19007)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18994](https://redirect.github.com/goauthentik/authentik/pull/18994)
- core: bump openapitools/openapi-generator-cli from v7.16.0 to v7.18.0
in /scripts/api by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19018](https://redirect.github.com/goauthentik/authentik/pull/19018)
- web: bump globby from 16.0.0 to 16.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18995](https://redirect.github.com/goauthentik/authentik/pull/18995)
- api: rework schema generation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18977](https://redirect.github.com/goauthentik/authentik/pull/18977)
- web/admin: prevent file upload attempt when backend not managed by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18646](https://redirect.github.com/goauthentik/authentik/pull/18646)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19019](https://redirect.github.com/goauthentik/authentik/pull/19019)
- core: bump goauthentik.io/api/v3 from 3.2026020.4 to 3.2026020.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19017](https://redirect.github.com/goauthentik/authentik/pull/19017)
- website/docs: Prioritize "Release Candidate" over "Current Release" by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18975](https://redirect.github.com/goauthentik/authentik/pull/18975)
- web: Locale selector UI fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18972](https://redirect.github.com/goauthentik/authentik/pull/18972)
- web: Fix Storybook package resolution with `npm link` by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19016](https://redirect.github.com/goauthentik/authentik/pull/19016)
- core: use chunked\_queryset for expired message deletion by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19028](https://redirect.github.com/goauthentik/authentik/pull/19028)
- web/admin: use consistent icon for inactive user status by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19032](https://redirect.github.com/goauthentik/authentik/pull/19032)
- web: bump lit from 3.3.1 to 3.3.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19038](https://redirect.github.com/goauthentik/authentik/pull/19038)
- web: bump
[@&#8203;lit/reactive-element](https://redirect.github.com/lit/reactive-element)
from 2.1.1 to 2.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19037](https://redirect.github.com/goauthentik/authentik/pull/19037)
- web: bump knip from 5.75.1 to 5.77.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19041](https://redirect.github.com/goauthentik/authentik/pull/19041)
- core: bump goauthentik.io/api/v3 from 3.2026020.5 to 3.2026020.6 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19036](https://redirect.github.com/goauthentik/authentik/pull/19036)
- docs/release notes: update 2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19043](https://redirect.github.com/goauthentik/authentik/pull/19043)
- lib/sync: fix sync\_dispatch by
[@&#8203;krejcar25](https://redirect.github.com/krejcar25) in
[goauthentik/authentik#19053](https://redirect.github.com/goauthentik/authentik/pull/19053)
- endpoints/devices: cleanup by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19047](https://redirect.github.com/goauthentik/authentik/pull/19047)
- blueprints: set enrollment token key by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19061](https://redirect.github.com/goauthentik/authentik/pull/19061)
- website/integrations: Add Wallos by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19013](https://redirect.github.com/goauthentik/authentik/pull/19013)
- website/docs: FreeIPA documentation updates by
[@&#8203;borutmrak](https://redirect.github.com/borutmrak) in
[goauthentik/authentik#15183](https://redirect.github.com/goauthentik/authentik/pull/15183)
- \*: Auto compress images by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19065](https://redirect.github.com/goauthentik/authentik/pull/19065)
- blueprints: fix deadlock and task context error in MetaApplyBlueprint
by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19033](https://redirect.github.com/goauthentik/authentik/pull/19033)
- web: fix file search input not resetting results properly by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19034](https://redirect.github.com/goauthentik/authentik/pull/19034)
- website/integrations: owncloud: fix php by
[@&#8203;ocmateusz](https://redirect.github.com/ocmateusz) in
[goauthentik/authentik#19073](https://redirect.github.com/goauthentik/authentik/pull/19073)
- tests/e2e: add endpoint tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19072](https://redirect.github.com/goauthentik/authentik/pull/19072)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18991](https://redirect.github.com/goauthentik/authentik/pull/18991)
- web: bump knip from 5.77.0 to 5.77.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19049](https://redirect.github.com/goauthentik/authentik/pull/19049)
- web: bump
[@&#8203;lit/localize-tools](https://redirect.github.com/lit/localize-tools)
from 0.8.0 to 0.8.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19040](https://redirect.github.com/goauthentik/authentik/pull/19040)
- internal: update TLS Suite by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19076](https://redirect.github.com/goauthentik/authentik/pull/19076)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 7.7.13 to 8.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19054](https://redirect.github.com/goauthentik/authentik/pull/19054)
- web/admin: fix button alignment on user view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19079](https://redirect.github.com/goauthentik/authentik/pull/19079)
- website/docs: endpoints: mention connector key required for stage to
work by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19084](https://redirect.github.com/goauthentik/authentik/pull/19084)
- website/docs: rel notes .12: add wallos by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19063](https://redirect.github.com/goauthentik/authentik/pull/19063)
- website/docs: endpoint devices: update features table by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19094](https://redirect.github.com/goauthentik/authentik/pull/19094)
- website/docs: endpoint devices: add path to macos setup by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19093](https://redirect.github.com/goauthentik/authentik/pull/19093)
- web: bump knip from 5.77.1 to 5.78.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19090](https://redirect.github.com/goauthentik/authentik/pull/19090)
- web: fix promoted source button hover losing blue color by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19048](https://redirect.github.com/goauthentik/authentik/pull/19048)
- web: Fix stale flow background by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19015](https://redirect.github.com/goauthentik/authentik/pull/19015)
- Update Vaultwarden documentation by removing warning by
[@&#8203;austin-dudzik](https://redirect.github.com/austin-dudzik) in
[goauthentik/authentik#19102](https://redirect.github.com/goauthentik/authentik/pull/19102)
- web/maintenance/no unknown attributes (part 1) by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18970](https://redirect.github.com/goauthentik/authentik/pull/18970)
- website/integrations: Add Pulse by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19105](https://redirect.github.com/goauthentik/authentik/pull/19105)
- website/integrations: Add Audiobookshelf by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19104](https://redirect.github.com/goauthentik/authentik/pull/19104)
- website/docs: release notes: Add more integrations by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19109](https://redirect.github.com/goauthentik/authentik/pull/19109)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19111](https://redirect.github.com/goauthentik/authentik/pull/19111)
- core: bump library/nginx from `fb01117` to `ad85427` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19112](https://redirect.github.com/goauthentik/authentik/pull/19112)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19110](https://redirect.github.com/goauthentik/authentik/pull/19110)
- web: Fix Impersonation, Lit Reactive Controller Contexts by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19114](https://redirect.github.com/goauthentik/authentik/pull/19114)
- web: Capitalize language display names, code owner fix by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19119](https://redirect.github.com/goauthentik/authentik/pull/19119)
- core: bump library/nginx from `ad85427` to `ca871a8` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19126](https://redirect.github.com/goauthentik/authentik/pull/19126)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19124](https://redirect.github.com/goauthentik/authentik/pull/19124)
- core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19088](https://redirect.github.com/goauthentik/authentik/pull/19088)
- core: bump library/node from `ccfd9da` to `03729a7` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19125](https://redirect.github.com/goauthentik/authentik/pull/19125)
- core, web: bump qs from 6.14.0 to 6.14.1 in
/packages/docusaurus-config by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19130](https://redirect.github.com/goauthentik/authentik/pull/19130)
- website/integrations: karakeep: don't hardcode wellknown's slug by
[@&#8203;pippo73](https://redirect.github.com/pippo73) in
[goauthentik/authentik#19127](https://redirect.github.com/goauthentik/authentik/pull/19127)
- web: disable user settings fields when changes are not allowed by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19132](https://redirect.github.com/goauthentik/authentik/pull/19132)
- website/docs: endpoint agent release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19042](https://redirect.github.com/goauthentik/authentik/pull/19042)
- website/docs: fix build by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19148](https://redirect.github.com/goauthentik/authentik/pull/19148)
- web: Token Form Fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19121](https://redirect.github.com/goauthentik/authentik/pull/19121)
- web/user: fix consent delete form missing details by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19147](https://redirect.github.com/goauthentik/authentik/pull/19147)
- web: bump globals from 16.5.0 to 17.0.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19154](https://redirect.github.com/goauthentik/authentik/pull/19154)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19135](https://redirect.github.com/goauthentik/authentik/pull/19135)
- ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19138](https://redirect.github.com/goauthentik/authentik/pull/19138)
- website/integrations: vaultwarden: add custom email scope by
[@&#8203;williamkray](https://redirect.github.com/williamkray) in
[goauthentik/authentik#19160](https://redirect.github.com/goauthentik/authentik/pull/19160)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid
blobs by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19137](https://redirect.github.com/goauthentik/authentik/pull/19137)
- core: handle deserialization errors from FileField migration by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19067](https://redirect.github.com/goauthentik/authentik/pull/19067)
- web: fix slug auto-updating when editing existing applications by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19169](https://redirect.github.com/goauthentik/authentik/pull/19169)
- web: Fix user library colors, modal z-indexes, table progress bars by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19152](https://redirect.github.com/goauthentik/authentik/pull/19152)
- web/admin: adjust sync threshold, add tooltip by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19131](https://redirect.github.com/goauthentik/authentik/pull/19131)
- website/docs: remove duplicates in slo docs by
[@&#8203;nmasnadithya](https://redirect.github.com/nmasnadithya) in
[goauthentik/authentik#19170](https://redirect.github.com/goauthentik/authentik/pull/19170)
- lifecycle: fix migration conn\_options for psycopg connection by
[@&#8203;D-Tasker207](https://redirect.github.com/D-Tasker207) in
[goauthentik/authentik#19134](https://redirect.github.com/goauthentik/authentik/pull/19134)
- web: bump knip from 5.78.0 to 5.79.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19181](https://redirect.github.com/goauthentik/authentik/pull/19181)
- ci: bump getsentry/action-release from 3.4.0 to 3.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19183](https://redirect.github.com/goauthentik/authentik/pull/19183)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.0 to 8.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19182](https://redirect.github.com/goauthentik/authentik/pull/19182)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19179](https://redirect.github.com/goauthentik/authentik/pull/19179)
- lib: update error logging by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18628](https://redirect.github.com/goauthentik/authentik/pull/18628)
- website/integrations: make grafana terraform section expand by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19192](https://redirect.github.com/goauthentik/authentik/pull/19192)
- core: add prettier failure on duplicate group names by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18941](https://redirect.github.com/goauthentik/authentik/pull/18941)
- web/maintenance: no missing element type definitions by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18950](https://redirect.github.com/goauthentik/authentik/pull/18950)
- root: codespell: ignore Python virtual env, group patterns. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19180](https://redirect.github.com/goauthentik/authentik/pull/19180)
- web: Merge branch -- Stale notifications, synchronized context
objects, rendering fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19141](https://redirect.github.com/goauthentik/authentik/pull/19141)
- website/docs: Add docs for roles by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19196](https://redirect.github.com/goauthentik/authentik/pull/19196)
- web: Defer table refresh, visibility checks. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19194](https://redirect.github.com/goauthentik/authentik/pull/19194)
- rbac: Add show all to roles tab, add role tab to groups by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19097](https://redirect.github.com/goauthentik/authentik/pull/19097)
- website/docs: rewrite section about users and perms by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#19195](https://redirect.github.com/goauthentik/authentik/pull/19195)
- core: add last\_login filter to users API by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18993](https://redirect.github.com/goauthentik/authentik/pull/18993)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19205](https://redirect.github.com/goauthentik/authentik/pull/19205)
- admin/files: support %(theme)s variable in media file paths by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19108](https://redirect.github.com/goauthentik/authentik/pull/19108)
- website/integrations: glpi: add step by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19208](https://redirect.github.com/goauthentik/authentik/pull/19208)
- web: bump knip from 5.79.0 to 5.80.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19207](https://redirect.github.com/goauthentik/authentik/pull/19207)
- core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19204](https://redirect.github.com/goauthentik/authentik/pull/19204)
- lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19203](https://redirect.github.com/goauthentik/authentik/pull/19203)
- core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19202](https://redirect.github.com/goauthentik/authentik/pull/19202)
- translate: Updates for project authentik and language pt\_BR by
[@&#8203;transifex-integration](https://redirect.github.com/transifex-integration)\[bot]
in
[goauthentik/authentik#19082](https://redirect.github.com/goauthentik/authentik/pull/19082)
- web/maintenance: lint pass to add missing HTMLElementEventMap entries
by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18953](https://redirect.github.com/goauthentik/authentik/pull/18953)
- outpost/proxyv2: reduce max number of postgres connections by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19211](https://redirect.github.com/goauthentik/authentik/pull/19211)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19200](https://redirect.github.com/goauthentik/authentik/pull/19200)
- website/docs: revisit endpoint docs the nth by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19116](https://redirect.github.com/goauthentik/authentik/pull/19116)
- ci: bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19221](https://redirect.github.com/goauthentik/authentik/pull/19221)
- endpoints: include license status in agent config by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19227](https://redirect.github.com/goauthentik/authentik/pull/19227)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.1 to 8.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19220](https://redirect.github.com/goauthentik/authentik/pull/19220)
- lifecycle/aws: bump aws-cdk from 2.1100.2 to 2.1100.3 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19219](https://redirect.github.com/goauthentik/authentik/pull/19219)
- core: bump goauthentik.io/api/v3 from 3.2026020.7 to 3.2026020.8 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19218](https://redirect.github.com/goauthentik/authentik/pull/19218)
- stages/authenticator\_static: set max token length to 100 chars by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19162](https://redirect.github.com/goauthentik/authentik/pull/19162)
- website/glossary: improve by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18969](https://redirect.github.com/goauthentik/authentik/pull/18969)
- core: fix read replica routing during transactions by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19086](https://redirect.github.com/goauthentik/authentik/pull/19086)
- website: Fix typos. by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19243](https://redirect.github.com/goauthentik/authentik/pull/19243)
- core: bump goauthentik.io/api/v3 from 3.2026020.8 to 3.2026020.10 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19242](https://redirect.github.com/goauthentik/authentik/pull/19242)
- website/integrations: update AWS by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#17861](https://redirect.github.com/goauthentik/authentik/pull/17861)
- website/docs: update github social login script example by
[@&#8203;busybox11](https://redirect.github.com/busybox11) in
[goauthentik/authentik#19246](https://redirect.github.com/goauthentik/authentik/pull/19246)
- web: bump vite from 7.3.0 to 7.3.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19245](https://redirect.github.com/goauthentik/authentik/pull/19245)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19206](https://redirect.github.com/goauthentik/authentik/pull/19206)
- stages/prompt: optimize API endpoints by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19251](https://redirect.github.com/goauthentik/authentik/pull/19251)
- website/docs: update entra id provider docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18366](https://redirect.github.com/goauthentik/authentik/pull/18366)
- website/integations: fix aws spelling by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19253](https://redirect.github.com/goauthentik/authentik/pull/19253)
- stages/password: replace session-based retries with reputation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18643](https://redirect.github.com/goauthentik/authentik/pull/18643)
- web: bump chromedriver from 143.0.3 to 143.0.4 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19244](https://redirect.github.com/goauthentik/authentik/pull/19244)
- web/admin: add banner to flow import form by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19288](https://redirect.github.com/goauthentik/authentik/pull/19288)
- core: bump django from v5.2.9 to 5.2.10 by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19290](https://redirect.github.com/goauthentik/authentik/pull/19290)
- endpoints: show agent version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19239](https://redirect.github.com/goauthentik/authentik/pull/19239)
- core: bump urllib3 from 2.5.0 to v2.6.3 by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19287](https://redirect.github.com/goauthentik/authentik/pull/19287)
- web: bump knip from 5.80.0 to 5.80.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19301](https://redirect.github.com/goauthentik/authentik/pull/19301)
- web: Fix flow inspector advancement event. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19309](https://redirect.github.com/goauthentik/authentik/pull/19309)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19237](https://redirect.github.com/goauthentik/authentik/pull/19237)
- website/docs: deprecate GCDT auth stage by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19306](https://redirect.github.com/goauthentik/authentik/pull/19306)
- website/docs: Fix typo in GitHub OAuth Source instructions by
[@&#8203;tcrasset](https://redirect.github.com/tcrasset) in
[goauthentik/authentik#18936](https://redirect.github.com/goauthentik/authentik/pull/18936)
- website/docs: update m2m doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18963](https://redirect.github.com/goauthentik/authentik/pull/18963)
- website/docs: Fix documentation example for
`app_entitlements_attributes`. by
[@&#8203;sebastianw](https://redirect.github.com/sebastianw) in
[goauthentik/authentik#19316](https://redirect.github.com/goauthentik/authentik/pull/19316)
- website/docs: add flow import warnings by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19307](https://redirect.github.com/goauthentik/authentik/pull/19307)
- web: bump pino from 10.1.0 to 10.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19333](https://redirect.github.com/goauthentik/authentik/pull/19333)
- web: bump knip from 5.80.1 to 5.80.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19332](https://redirect.github.com/goauthentik/authentik/pull/19332)
- core: bump axllent/mailpit from v1.28.1 to v1.28.2 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19329](https://redirect.github.com/goauthentik/authentik/pull/19329)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.3 to 25.0.6 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19331](https://redirect.github.com/goauthentik/authentik/pull/19331)
- core: bump library/nginx from `ca871a8` to `7272239` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19334](https://redirect.github.com/goauthentik/authentik/pull/19334)
- website/docs: update unique email policy by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19305](https://redirect.github.com/goauthentik/authentik/pull/19305)
- web: bump
[@&#8203;types/react](https://redirect.github.com/types/react) from
19.2.7 to 19.2.8 in /web in the react group across 1 directory by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19330](https://redirect.github.com/goauthentik/authentik/pull/19330)
- web: Images styles, theming by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19233](https://redirect.github.com/goauthentik/authentik/pull/19233)
- website/docs: update LDAP provider docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18272](https://redirect.github.com/goauthentik/authentik/pull/18272)
- web: Flow info, localization, back button. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19234](https://redirect.github.com/goauthentik/authentik/pull/19234)
- web: bump type-fest from 5.3.1 to 5.4.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19354](https://redirect.github.com/goauthentik/authentik/pull/19354)
- core: bump goauthentik.io/api/v3 from 3.2026020.10 to 3.2026020.11 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19300](https://redirect.github.com/goauthentik/authentik/pull/19300)
- ci: bump actions/setup-go from 6.1.0 to 6.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19352](https://redirect.github.com/goauthentik/authentik/pull/19352)
- web: bump the bundler group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19349](https://redirect.github.com/goauthentik/authentik/pull/19349)
- ci: bump actions/setup-go from 6.1.0 to 6.2.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19351](https://redirect.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" in timezone
America/New_York, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/enchantednatures/HomeCluster).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zNi4yIiwidXBkYXRlZEluVmVyIjoiNDMuMzYuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvbWFqb3IiXX0=-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fgeck pushed a commit to fgeck/homelab-k3s that referenced this pull request Mar 10, 2026
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [authentik](https://goauthentik.io)
([source](https://redirect.github.com/goauthentik/helm)) | major |
`^2025.0.0` → `^2026.0.0` |

---

### Release Notes

<details>
<summary>goauthentik/helm (authentik)</summary>

###
[`v2026.2.1`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.1)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2026.2.0...authentik-2026.2.1)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: Add weight to http route service by
[@&#8203;flipper](https://redirect.github.com/flipper) in
[#&#8203;458](https://redirect.github.com/goauthentik/helm/pull/458)
- chore(deps): update docker.io/library/postgres docker tag to v17.9 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;452](https://redirect.github.com/goauthentik/helm/pull/452)
- chore(deps): update prometheuscommunity/postgres-exporter docker tag
to v0.19.1 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;445](https://redirect.github.com/goauthentik/helm/pull/445)
- charts/authentik: bump to 2026.2.1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;459](https://redirect.github.com/goauthentik/helm/pull/459)

#### New Contributors

- [@&#8203;flipper](https://redirect.github.com/flipper) made their
first contribution in
[#&#8203;458](https://redirect.github.com/goauthentik/helm/pull/458)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2026.2.0...authentik-2026.2.1>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202621>

#### What's Changed

- website/docs: update supported versions (cherry-pick
[#&#8203;20534](https://redirect.github.com/goauthentik/helm/issues/20534)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20535](https://redirect.github.com/goauthentik/authentik/pull/20535)
- website/docs: fix upgrade link in `2026.2` release notes (cherry-pick
[#&#8203;20539](https://redirect.github.com/goauthentik/helm/issues/20539)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20542](https://redirect.github.com/goauthentik/authentik/pull/20542)
- website/docs: remove bad logs redirect (cherry-pick
[#&#8203;20522](https://redirect.github.com/goauthentik/helm/issues/20522)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20548](https://redirect.github.com/goauthentik/authentik/pull/20548)
- website/docs: revamp enterprise section (cherry-pick
[#&#8203;20379](https://redirect.github.com/goauthentik/helm/issues/20379)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20546](https://redirect.github.com/goauthentik/authentik/pull/20546)
- docs: fix typos and wording in docs and integrations (cherry-pick
[#&#8203;20550](https://redirect.github.com/goauthentik/helm/issues/20550)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20563](https://redirect.github.com/goauthentik/authentik/pull/20563)
- ci: add `reason` change to versions repo bump (cherry-pick
[#&#8203;20562](https://redirect.github.com/goauthentik/helm/issues/20562)
to version-2026.2) by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#20569](https://redirect.github.com/goauthentik/authentik/pull/20569)
- internal: make http timeouts configurable (cherry-pick
[#&#8203;20472](https://redirect.github.com/goauthentik/helm/issues/20472)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20567](https://redirect.github.com/goauthentik/authentik/pull/20567)
- packages/django-dramatiq-postgres: use fork (cherry-pick
[#&#8203;20606](https://redirect.github.com/goauthentik/helm/issues/20606)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20608](https://redirect.github.com/goauthentik/authentik/pull/20608)
- web/flows: fix source icons being always inverted (cherry-pick
[#&#8203;20419](https://redirect.github.com/goauthentik/helm/issues/20419)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20607](https://redirect.github.com/goauthentik/authentik/pull/20607)
- crypto: fix kid legacy signal (cherry-pick
[#&#8203;20627](https://redirect.github.com/goauthentik/helm/issues/20627)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20628](https://redirect.github.com/goauthentik/authentik/pull/20628)
- sources/ldap: add connection logging & downgrade message (cherry-pick
[#&#8203;20519](https://redirect.github.com/goauthentik/helm/issues/20519)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20636](https://redirect.github.com/goauthentik/authentik/pull/20636)
- packages/django-dramatiq-postgres: fix worker startup on macos
(cherry-pick
[#&#8203;20637](https://redirect.github.com/goauthentik/helm/issues/20637)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20641](https://redirect.github.com/goauthentik/authentik/pull/20641)
- enterprise/wsfed: Fix metadata export and signing logic (cherry-pick
[#&#8203;20643](https://redirect.github.com/goauthentik/helm/issues/20643)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20649](https://redirect.github.com/goauthentik/authentik/pull/20649)
- website/docs: entra id provider: add custom email domain info
(cherry-pick
[#&#8203;20444](https://redirect.github.com/goauthentik/helm/issues/20444)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20660](https://redirect.github.com/goauthentik/authentik/pull/20660)
- website/docs: kerberos: add note about caching (cherry-pick
[#&#8203;20663](https://redirect.github.com/goauthentik/helm/issues/20663)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20664](https://redirect.github.com/goauthentik/authentik/pull/20664)
- core: fix get\_provider returning base Provider instead of subclass
(cherry-pick
[#&#8203;19064](https://redirect.github.com/goauthentik/helm/issues/19064)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20670](https://redirect.github.com/goauthentik/authentik/pull/20670)
- packages/django-channels-postgres: eagerly delete messages
(cherry-pick
[#&#8203;20687](https://redirect.github.com/goauthentik/helm/issues/20687)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20688](https://redirect.github.com/goauthentik/authentik/pull/20688)
- outpost/proxyv2: prevent panic in handleSignOut (cherry-pick
[#&#8203;20097](https://redirect.github.com/goauthentik/helm/issues/20097)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20689](https://redirect.github.com/goauthentik/authentik/pull/20689)
- website/docs: add 2025 pentest (cherry-pick
[#&#8203;20626](https://redirect.github.com/goauthentik/helm/issues/20626)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20691](https://redirect.github.com/goauthentik/authentik/pull/20691)
- web: fix identification stage styling in compatibility mode
(cherry-pick
[#&#8203;20684](https://redirect.github.com/goauthentik/helm/issues/20684)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20694](https://redirect.github.com/goauthentik/authentik/pull/20694)
- providers/proxy: move search path to query instead of runtime
parameter (cherry-pick
[#&#8203;20662](https://redirect.github.com/goauthentik/helm/issues/20662)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20693](https://redirect.github.com/goauthentik/authentik/pull/20693)
- website/docs: add release notes for `2026.2.1` (cherry-pick
[#&#8203;20659](https://redirect.github.com/goauthentik/helm/issues/20659)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20695](https://redirect.github.com/goauthentik/authentik/pull/20695)

**Full Changelog**:
<https://github.com/goauthentik/authentik/compare/version/2026.2.0...version/2026.2.1>

###
[`v2026.2.0`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.0)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: add fields auto-added by Kubernetes to httproute by
[@&#8203;cfi2017](https://redirect.github.com/cfi2017) in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)
- chore(deps): update helm/kind-action action to v1.14.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;454](https://redirect.github.com/goauthentik/helm/pull/454)
- charts/authentik: add note how to set version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[#&#8203;456](https://redirect.github.com/goauthentik/helm/pull/456)
- charts/authentik: bump to 2026.2.0 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;457](https://redirect.github.com/goauthentik/helm/pull/457)

#### New Contributors

- [@&#8203;cfi2017](https://redirect.github.com/cfi2017) made their
first contribution in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2>

#### What's Changed

- root: bump version to 2026.2.0-rc1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18794](https://redirect.github.com/goauthentik/authentik/pull/18794)
- tests/e2e: retry detached shadow roots by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18796](https://redirect.github.com/goauthentik/authentik/pull/18796)
- website/release notes: Update v2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18797](https://redirect.github.com/goauthentik/authentik/pull/18797)
- web/admin: fix read-only provider selection for application form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18768](https://redirect.github.com/goauthentik/authentik/pull/18768)
- web: bump the react group across 1 directory with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18775](https://redirect.github.com/goauthentik/authentik/pull/18775)
- web: bump chromedriver from 143.0.0 to 143.0.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18776](https://redirect.github.com/goauthentik/authentik/pull/18776)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18774](https://redirect.github.com/goauthentik/authentik/pull/18774)
- internal: don't warn on empty outpost for embedded by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18786](https://redirect.github.com/goauthentik/authentik/pull/18786)
- lifecycle/aws: bump aws-cdk from 2.1033.0 to 2.1034.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18771](https://redirect.github.com/goauthentik/authentik/pull/18771)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18804](https://redirect.github.com/goauthentik/authentik/pull/18804)
- root: Add macOS support for sed in Makefile by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18795](https://redirect.github.com/goauthentik/authentik/pull/18795)
- ci: bump astral-sh/setup-uv from 7.1.5 to 7.1.6 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18826](https://redirect.github.com/goauthentik/authentik/pull/18826)
- ci: bump actions/upload-artifact from 5.0.0 to 6.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18824](https://redirect.github.com/goauthentik/authentik/pull/18824)
- core: bump goauthentik/fips-debian from `07f41ce` to `c10cd2c` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18822](https://redirect.github.com/goauthentik/authentik/pull/18822)
- ci: bump actions/download-artifact from 6.0.0 to 7.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18825](https://redirect.github.com/goauthentik/authentik/pull/18825)
- ci: bump actions/cache from 5.0.0 to 5.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18823](https://redirect.github.com/goauthentik/authentik/pull/18823)
- core: list applications fix by
[@&#8203;ryanpesek](https://redirect.github.com/ryanpesek) in
[goauthentik/authentik#18798](https://redirect.github.com/goauthentik/authentik/pull/18798)
- website/docs: add icon info to style guide by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18832](https://redirect.github.com/goauthentik/authentik/pull/18832)
- core: remove superuser check from `Token` list by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18684](https://redirect.github.com/goauthentik/authentik/pull/18684)
- packages/django-dramatiq-postgres: broker: close django connections on
consumer close by [@&#8203;rissson](https://redirect.github.com/rissson)
in
[goauthentik/authentik#18833](https://redirect.github.com/goauthentik/authentik/pull/18833)
- core: bump goauthentik.io/api/v3 from 3.2025120.26 to 3.2026020.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18815](https://redirect.github.com/goauthentik/authentik/pull/18815)
- admin/files: revert add check for /media existence
([#&#8203;18636](https://redirect.github.com/goauthentik/helm/issues/18636))
by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18829](https://redirect.github.com/goauthentik/authentik/pull/18829)
- website/docs: add jellyseer integration doc by
[@&#8203;gabay](https://redirect.github.com/gabay) in
[goauthentik/authentik#18812](https://redirect.github.com/goauthentik/authentik/pull/18812)
- crypto: Store details parsed from includeDetails in database instead
by [@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18013](https://redirect.github.com/goauthentik/authentik/pull/18013)
- core: skip s3 tests if endpoint isn't available by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18841](https://redirect.github.com/goauthentik/authentik/pull/18841)
- admin/files: fix get\_objects\_for\_user queryset argument in
FileUsedByView by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18845](https://redirect.github.com/goauthentik/authentik/pull/18845)
- core: bump goauthentik/fips-debian from `c10cd2c` to `2f19fc1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18856](https://redirect.github.com/goauthentik/authentik/pull/18856)
- ci: replace codecov test-results action by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18862](https://redirect.github.com/goauthentik/authentik/pull/18862)
- core: add skip s3\_test\_server\_available to
TestResolveFileUrlS3Backend by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18858](https://redirect.github.com/goauthentik/authentik/pull/18858)
- rbac: alter migrated direct permission roles by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18860](https://redirect.github.com/goauthentik/authentik/pull/18860)
- core: bump library/golang from `5d35fb8` to `8e8f9c8` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18855](https://redirect.github.com/goauthentik/authentik/pull/18855)
- web/admin/rbac: misc object permission fixes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18859](https://redirect.github.com/goauthentik/authentik/pull/18859)
- outposts: fix permission errors for related certificates by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18861](https://redirect.github.com/goauthentik/authentik/pull/18861)
- website/docs: adjust RBAC-related details in 2025.12 release notes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18863](https://redirect.github.com/goauthentik/authentik/pull/18863)
- website/docs: Add docs for passkey autofill (WebauthN Conditional UI)
by [@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18805](https://redirect.github.com/goauthentik/authentik/pull/18805)
- website/docs: 2025.10.3 release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18868](https://redirect.github.com/goauthentik/authentik/pull/18868)
- web: add custom message with links for empty data export list by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18830](https://redirect.github.com/goauthentik/authentik/pull/18830)
- web: fix notification counter by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18781](https://redirect.github.com/goauthentik/authentik/pull/18781)
- web: bump vite from 7.2.7 to 7.3.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18854](https://redirect.github.com/goauthentik/authentik/pull/18854)
- stages/authenticator\_\*: fix code input field not string by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18875](https://redirect.github.com/goauthentik/authentik/pull/18875)
- web: fix file upload form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18808](https://redirect.github.com/goauthentik/authentik/pull/18808)
- web/admin: endpoint: change wording and add helper text by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18871](https://redirect.github.com/goauthentik/authentik/pull/18871)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18807](https://redirect.github.com/goauthentik/authentik/pull/18807)
- website/integrations: bookstack: fix redir url by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18891](https://redirect.github.com/goauthentik/authentik/pull/18891)
- core: bump astral-sh/uv from 0.9.17 to 0.9.18 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18898](https://redirect.github.com/goauthentik/authentik/pull/18898)
- core: bump goauthentik/fips-debian from `2f19fc1` to `189345a` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18897](https://redirect.github.com/goauthentik/authentik/pull/18897)
- web: bump knip from 5.73.3 to 5.74.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18896](https://redirect.github.com/goauthentik/authentik/pull/18896)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.0 to 25.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18895](https://redirect.github.com/goauthentik/authentik/pull/18895)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18852](https://redirect.github.com/goauthentik/authentik/pull/18852)
- web: bump the bundler group across 1 directory with 7 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18894](https://redirect.github.com/goauthentik/authentik/pull/18894)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.30.0 to 10.31.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18893](https://redirect.github.com/goauthentik/authentik/pull/18893)
- lifecycle/aws: bump aws-cdk from 2.1034.0 to 2.1100.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18850](https://redirect.github.com/goauthentik/authentik/pull/18850)
- web: bump the goauthentik group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18819](https://redirect.github.com/goauthentik/authentik/pull/18819)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18818](https://redirect.github.com/goauthentik/authentik/pull/18818)
- web: bump the eslint group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18851](https://redirect.github.com/goauthentik/authentik/pull/18851)
- core: bump goauthentik.io/api/v3 from 3.2026020.1 to 3.2026020.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18892](https://redirect.github.com/goauthentik/authentik/pull/18892)
- tasks/middleware: close connections on worker status update database
error by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18881](https://redirect.github.com/goauthentik/authentik/pull/18881)
- website/docs: added list of Int Guide contributors (also edited
frontmatter) by [@&#8203;tanberry](https://redirect.github.com/tanberry)
in
[goauthentik/authentik#18888](https://redirect.github.com/goauthentik/authentik/pull/18888)
- api: fix page\_size with invalid query param by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18879](https://redirect.github.com/goauthentik/authentik/pull/18879)
- ci/release-tag: checkout correct branch for make test-docker by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18880](https://redirect.github.com/goauthentik/authentik/pull/18880)
- api: fix latest version for public schema by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18902](https://redirect.github.com/goauthentik/authentik/pull/18902)
- website/docs: 2025.12: remove superfluous changes by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18910](https://redirect.github.com/goauthentik/authentik/pull/18910)
- web/admin: reword some things on the device view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18785](https://redirect.github.com/goauthentik/authentik/pull/18785)
- core/groups: optimize prefetch queries to fetch only required fields
by [@&#8203;joaocfernandes](https://redirect.github.com/joaocfernandes)
in
[goauthentik/authentik#18448](https://redirect.github.com/goauthentik/authentik/pull/18448)
- root: fix docker-compose data mount by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18903](https://redirect.github.com/goauthentik/authentik/pull/18903)
- web/admin: add UI copy to RBAC modal by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#18917](https://redirect.github.com/goauthentik/authentik/pull/18917)
- tests/e2e: handle StaleElementReferenceException in
parse\_json\_content by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18842](https://redirect.github.com/goauthentik/authentik/pull/18842)
- core: bump goauthentik/fips-debian from `189345a` to `10dadf1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18927](https://redirect.github.com/goauthentik/authentik/pull/18927)
- web: bump chromedriver from 143.0.1 to 143.0.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18926](https://redirect.github.com/goauthentik/authentik/pull/18926)
- web: bump knip from 5.74.0 to 5.75.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18924](https://redirect.github.com/goauthentik/authentik/pull/18924)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18920](https://redirect.github.com/goauthentik/authentik/pull/18920)
- lifecycle/aws: bump aws-cdk from 2.1100.0 to 2.1100.1 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18922](https://redirect.github.com/goauthentik/authentik/pull/18922)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18923](https://redirect.github.com/goauthentik/authentik/pull/18923)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18817](https://redirect.github.com/goauthentik/authentik/pull/18817)
- stages: remove more global state by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18641](https://redirect.github.com/goauthentik/authentik/pull/18641)
- packages/ak-guardian: cast safely by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18929](https://redirect.github.com/goauthentik/authentik/pull/18929)
- web/flow: Fix spurious double submit on ak-stage-autosubmit by
[@&#8203;dminuoso](https://redirect.github.com/dminuoso) in
[goauthentik/authentik#18727](https://redirect.github.com/goauthentik/authentik/pull/18727)
- website/integrations: Add launch URL for Immich by
[@&#8203;optix2000](https://redirect.github.com/optix2000) in
[goauthentik/authentik#18921](https://redirect.github.com/goauthentik/authentik/pull/18921)
- crypto: fix extra cert data in db migration by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18937](https://redirect.github.com/goauthentik/authentik/pull/18937)
- web/elements: progress-bar and table loading header by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18934](https://redirect.github.com/goauthentik/authentik/pull/18934)
- stages/identification: replace sleep with make\_password by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18883](https://redirect.github.com/goauthentik/authentik/pull/18883)
- website/docs: endpoint devices by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18634](https://redirect.github.com/goauthentik/authentik/pull/18634)
- website/docs: Fix labels, Pre-Release detection by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18945](https://redirect.github.com/goauthentik/authentik/pull/18945)
- website/docs: release notes: add endpoint device links to 2025.12
notes by [@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18940](https://redirect.github.com/goauthentik/authentik/pull/18940)
- website/docs: Fix version parsing. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18948](https://redirect.github.com/goauthentik/authentik/pull/18948)
- web/admin: fix endpoints user binding by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18935](https://redirect.github.com/goauthentik/authentik/pull/18935)
- flows/executor: fix KeyError when session has no existing plan by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18951](https://redirect.github.com/goauthentik/authentik/pull/18951)
- root: move docker files to lifecycle/containers and change
docker-compose to compose by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#16624](https://redirect.github.com/goauthentik/authentik/pull/16624)
- core: bump goauthentik.io/api/v3 from 3.2026020.3 to 3.2026020.4 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18956](https://redirect.github.com/goauthentik/authentik/pull/18956)
- web: bump chromedriver from 143.0.2 to 143.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18959](https://redirect.github.com/goauthentik/authentik/pull/18959)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18958](https://redirect.github.com/goauthentik/authentik/pull/18958)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.31.0 to 10.32.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18957](https://redirect.github.com/goauthentik/authentik/pull/18957)
- ci: bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18960](https://redirect.github.com/goauthentik/authentik/pull/18960)
- website/docs: add note to active directory source doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18787](https://redirect.github.com/goauthentik/authentik/pull/18787)
- web/maintenance: fix missing custom web component imports by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18942](https://redirect.github.com/goauthentik/authentik/pull/18942)
- web/maintenance: no unknown tag names by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18944](https://redirect.github.com/goauthentik/authentik/pull/18944)
- website/integrations: Fix path for Cloudflare Access by
[@&#8203;stijn220](https://redirect.github.com/stijn220) in
[goauthentik/authentik#18979](https://redirect.github.com/goauthentik/authentik/pull/18979)
- blueprints: add InternallyManagedMixin instead of large list by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18983](https://redirect.github.com/goauthentik/authentik/pull/18983)
- web/admin: fix dark theme on map by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18985](https://redirect.github.com/goauthentik/authentik/pull/18985)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm by
[@&#8203;hskrtich](https://redirect.github.com/hskrtich) in
[goauthentik/authentik#18984](https://redirect.github.com/goauthentik/authentik/pull/18984)
- events: notifications live update by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18980](https://redirect.github.com/goauthentik/authentik/pull/18980)
- web: fix Open button selecting row instead of navigating by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18992](https://redirect.github.com/goauthentik/authentik/pull/18992)
- blueprints: fix flaky tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19002](https://redirect.github.com/goauthentik/authentik/pull/19002)
- ci: bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18999](https://redirect.github.com/goauthentik/authentik/pull/18999)
- providers/oauth2: Automated OpenID Conformance tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#14785](https://redirect.github.com/goauthentik/authentik/pull/14785)
- enterprise/reports: improve export list, confirmation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18981](https://redirect.github.com/goauthentik/authentik/pull/18981)
- enterprise/search: add static autocomplete structure by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19008](https://redirect.github.com/goauthentik/authentik/pull/19008)
- website/docs: improve endpoint devices docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19007](https://redirect.github.com/goauthentik/authentik/pull/19007)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18994](https://redirect.github.com/goauthentik/authentik/pull/18994)
- core: bump openapitools/openapi-generator-cli from v7.16.0 to v7.18.0
in /scripts/api by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19018](https://redirect.github.com/goauthentik/authentik/pull/19018)
- web: bump globby from 16.0.0 to 16.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18995](https://redirect.github.com/goauthentik/authentik/pull/18995)
- api: rework schema generation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18977](https://redirect.github.com/goauthentik/authentik/pull/18977)
- web/admin: prevent file upload attempt when backend not managed by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18646](https://redirect.github.com/goauthentik/authentik/pull/18646)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19019](https://redirect.github.com/goauthentik/authentik/pull/19019)
- core: bump goauthentik.io/api/v3 from 3.2026020.4 to 3.2026020.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19017](https://redirect.github.com/goauthentik/authentik/pull/19017)
- website/docs: Prioritize "Release Candidate" over "Current Release" by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18975](https://redirect.github.com/goauthentik/authentik/pull/18975)
- web: Locale selector UI fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18972](https://redirect.github.com/goauthentik/authentik/pull/18972)
- web: Fix Storybook package resolution with `npm link` by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19016](https://redirect.github.com/goauthentik/authentik/pull/19016)
- core: use chunked\_queryset for expired message deletion by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19028](https://redirect.github.com/goauthentik/authentik/pull/19028)
- web/admin: use consistent icon for inactive user status by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19032](https://redirect.github.com/goauthentik/authentik/pull/19032)
- web: bump lit from 3.3.1 to 3.3.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19038](https://redirect.github.com/goauthentik/authentik/pull/19038)
- web: bump
[@&#8203;lit/reactive-element](https://redirect.github.com/lit/reactive-element)
from 2.1.1 to 2.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19037](https://redirect.github.com/goauthentik/authentik/pull/19037)
- web: bump knip from 5.75.1 to 5.77.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19041](https://redirect.github.com/goauthentik/authentik/pull/19041)
- core: bump goauthentik.io/api/v3 from 3.2026020.5 to 3.2026020.6 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19036](https://redirect.github.com/goauthentik/authentik/pull/19036)
- docs/release notes: update 2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19043](https://redirect.github.com/goauthentik/authentik/pull/19043)
- lib/sync: fix sync\_dispatch by
[@&#8203;krejcar25](https://redirect.github.com/krejcar25) in
[goauthentik/authentik#19053](https://redirect.github.com/goauthentik/authentik/pull/19053)
- endpoints/devices: cleanup by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19047](https://redirect.github.com/goauthentik/authentik/pull/19047)
- blueprints: set enrollment token key by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19061](https://redirect.github.com/goauthentik/authentik/pull/19061)
- website/integrations: Add Wallos by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19013](https://redirect.github.com/goauthentik/authentik/pull/19013)
- website/docs: FreeIPA documentation updates by
[@&#8203;borutmrak](https://redirect.github.com/borutmrak) in
[goauthentik/authentik#15183](https://redirect.github.com/goauthentik/authentik/pull/15183)
- \*: Auto compress images by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19065](https://redirect.github.com/goauthentik/authentik/pull/19065)
- blueprints: fix deadlock and task context error in MetaApplyBlueprint
by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19033](https://redirect.github.com/goauthentik/authentik/pull/19033)
- web: fix file search input not resetting results properly by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19034](https://redirect.github.com/goauthentik/authentik/pull/19034)
- website/integrations: owncloud: fix php by
[@&#8203;ocmateusz](https://redirect.github.com/ocmateusz) in
[goauthentik/authentik#19073](https://redirect.github.com/goauthentik/authentik/pull/19073)
- tests/e2e: add endpoint tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19072](https://redirect.github.com/goauthentik/authentik/pull/19072)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18991](https://redirect.github.com/goauthentik/authentik/pull/18991)
- web: bump knip from 5.77.0 to 5.77.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19049](https://redirect.github.com/goauthentik/authentik/pull/19049)
- web: bump
[@&#8203;lit/localize-tools](https://redirect.github.com/lit/localize-tools)
from 0.8.0 to 0.8.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19040](https://redirect.github.com/goauthentik/authentik/pull/19040)
- internal: update TLS Suite by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19076](https://redirect.github.com/goauthentik/authentik/pull/19076)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 7.7.13 to 8.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19054](https://redirect.github.com/goauthentik/authentik/pull/19054)
- web/admin: fix button alignment on user view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19079](https://redirect.github.com/goauthentik/authentik/pull/19079)
- website/docs: endpoints: mention connector key required for stage to
work by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19084](https://redirect.github.com/goauthentik/authentik/pull/19084)
- website/docs: rel notes .12: add wallos by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19063](https://redirect.github.com/goauthentik/authentik/pull/19063)
- website/docs: endpoint devices: update features table by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19094](https://redirect.github.com/goauthentik/authentik/pull/19094)
- website/docs: endpoint devices: add path to macos setup by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19093](https://redirect.github.com/goauthentik/authentik/pull/19093)
- web: bump knip from 5.77.1 to 5.78.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19090](https://redirect.github.com/goauthentik/authentik/pull/19090)
- web: fix promoted source button hover losing blue color by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19048](https://redirect.github.com/goauthentik/authentik/pull/19048)
- web: Fix stale flow background by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19015](https://redirect.github.com/goauthentik/authentik/pull/19015)
- Update Vaultwarden documentation by removing warning by
[@&#8203;austin-dudzik](https://redirect.github.com/austin-dudzik) in
[goauthentik/authentik#19102](https://redirect.github.com/goauthentik/authentik/pull/19102)
- web/maintenance/no unknown attributes (part 1) by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18970](https://redirect.github.com/goauthentik/authentik/pull/18970)
- website/integrations: Add Pulse by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19105](https://redirect.github.com/goauthentik/authentik/pull/19105)
- website/integrations: Add Audiobookshelf by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19104](https://redirect.github.com/goauthentik/authentik/pull/19104)
- website/docs: release notes: Add more integrations by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19109](https://redirect.github.com/goauthentik/authentik/pull/19109)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19111](https://redirect.github.com/goauthentik/authentik/pull/19111)
- core: bump library/nginx from `fb01117` to `ad85427` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19112](https://redirect.github.com/goauthentik/authentik/pull/19112)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19110](https://redirect.github.com/goauthentik/authentik/pull/19110)
- web: Fix Impersonation, Lit Reactive Controller Contexts by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19114](https://redirect.github.com/goauthentik/authentik/pull/19114)
- web: Capitalize language display names, code owner fix by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19119](https://redirect.github.com/goauthentik/authentik/pull/19119)
- core: bump library/nginx from `ad85427` to `ca871a8` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19126](https://redirect.github.com/goauthentik/authentik/pull/19126)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19124](https://redirect.github.com/goauthentik/authentik/pull/19124)
- core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19088](https://redirect.github.com/goauthentik/authentik/pull/19088)
- core: bump library/node from `ccfd9da` to `03729a7` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19125](https://redirect.github.com/goauthentik/authentik/pull/19125)
- core, web: bump qs from 6.14.0 to 6.14.1 in
/packages/docusaurus-config by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19130](https://redirect.github.com/goauthentik/authentik/pull/19130)
- website/integrations: karakeep: don't hardcode wellknown's slug by
[@&#8203;pippo73](https://redirect.github.com/pippo73) in
[goauthentik/authentik#19127](https://redirect.github.com/goauthentik/authentik/pull/19127)
- web: disable user settings fields when changes are not allowed by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19132](https://redirect.github.com/goauthentik/authentik/pull/19132)
- website/docs: endpoint agent release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19042](https://redirect.github.com/goauthentik/authentik/pull/19042)
- website/docs: fix build by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19148](https://redirect.github.com/goauthentik/authentik/pull/19148)
- web: Token Form Fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19121](https://redirect.github.com/goauthentik/authentik/pull/19121)
- web/user: fix consent delete form missing details by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19147](https://redirect.github.com/goauthentik/authentik/pull/19147)
- web: bump globals from 16.5.0 to 17.0.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19154](https://redirect.github.com/goauthentik/authentik/pull/19154)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19135](https://redirect.github.com/goauthentik/authentik/pull/19135)
- ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19138](https://redirect.github.com/goauthentik/authentik/pull/19138)
- website/integrations: vaultwarden: add custom email scope by
[@&#8203;williamkray](https://redirect.github.com/williamkray) in
[goauthentik/authentik#19160](https://redirect.github.com/goauthentik/authentik/pull/19160)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid
blobs by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19137](https://redirect.github.com/goauthentik/authentik/pull/19137)
- core: handle deserialization errors from FileField migration by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19067](https://redirect.github.com/goauthentik/authentik/pull/19067)
- web: fix slug auto-updating when editing existing applications by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19169](https://redirect.github.com/goauthentik/authentik/pull/19169)
- web: Fix user library colors, modal z-indexes, table progress bars by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19152](https://redirect.github.com/goauthentik/authentik/pull/19152)
- web/admin: adjust sync threshold, add tooltip by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19131](https://redirect.github.com/goauthentik/authentik/pull/19131)
- website/docs: remove duplicates in slo docs by
[@&#8203;nmasnadithya](https://redirect.github.com/nmasnadithya) in
[goauthentik/authentik#19170](https://redirect.github.com/goauthentik/authentik/pull/19170)
- lifecycle: fix migration conn\_options for psycopg connection by
[@&#8203;D-Tasker207](https://redirect.github.com/D-Tasker207) in
[goauthentik/authentik#19134](https://redirect.github.com/goauthentik/authentik/pull/19134)
- web: bump knip from 5.78.0 to 5.79.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19181](https://redirect.github.com/goauthentik/authentik/pull/19181)
- ci: bump getsentry/action-release from 3.4.0 to 3.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19183](https://redirect.github.com/goauthentik/authentik/pull/19183)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.0 to 8.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19182](https://redirect.github.com/goauthentik/authentik/pull/19182)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19179](https://redirect.github.com/goauthentik/authentik/pull/19179)
- lib: update error logging by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18628](https://redirect.github.com/goauthentik/authentik/pull/18628)
- website/integrations: make grafana terraform section expand by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19192](https://redirect.github.com/goauthentik/authentik/pull/19192)
- core: add prettier failure on duplicate group names by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18941](https://redirect.github.com/goauthentik/authentik/pull/18941)
- web/maintenance: no missing element type definitions by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18950](https://redirect.github.com/goauthentik/authentik/pull/18950)
- root: codespell: ignore Python virtual env, group patterns. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19180](https://redirect.github.com/goauthentik/authentik/pull/19180)
- web: Merge branch -- Stale notifications, synchronized context
objects, rendering fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19141](https://redirect.github.com/goauthentik/authentik/pull/19141)
- website/docs: Add docs for roles by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19196](https://redirect.github.com/goauthentik/authentik/pull/19196)
- web: Defer table refresh, visibility checks. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19194](https://redirect.github.com/goauthentik/authentik/pull/19194)
- rbac: Add show all to roles tab, add role tab to groups by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19097](https://redirect.github.com/goauthentik/authentik/pull/19097)
- website/docs: rewrite section about users and perms by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#19195](https://redirect.github.com/goauthentik/authentik/pull/19195)
- core: add last\_login filter to users API by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18993](https://redirect.github.com/goauthentik/authentik/pull/18993)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19205](https://redirect.github.com/goauthentik/authentik/pull/19205)
- admin/files: support %(theme)s variable in media file paths by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19108](https://redirect.github.com/goauthentik/authentik/pull/19108)
- website/integrations: glpi: add step by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19208](https://redirect.github.com/goauthentik/authentik/pull/19208)
- web: bump knip from 5.79.0 to 5.80.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19207](https://redirect.github.com/goauthentik/authentik/pull/19207)
- core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19204](https://redirect.github.com/goauthentik/authentik/pull/19204)
- lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19203](https://redirect.github.com/goauthentik/authentik/pull/19203)
- core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19202](https://redirect.github.com/goauthentik/authentik/pull/19202)
- translate: Updates for project authentik and language pt\_BR by
[@&#8203;transifex-integration](https://redirect.github.com/transifex-integration)\[bot]
in
[goauthentik/authentik#19082](https://redirect.github.com/goauthentik/authentik/pull/19082)
- web/maintenance: lint pass to add missing HTMLElementEventMap entries
by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18953](https://redirect.github.com/goauthentik/authentik/pull/18953)
- outpost/proxyv2: reduce max number of postgres connections by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19211](https://redirect.github.com/goauthentik/authentik/pull/19211)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19200](https://redirect.github.com/goauthentik/authentik/pull/19200)
- website/docs: revisit endpoint docs the nth by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19116](https://redirect.github.com/goauthentik/authentik/pull/19116)
- ci: bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19221](https://redirect.github.com/goauthentik/authentik/pull/19221)
- endpoints: include license status in agent config by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19227](https://redirect.github.com/goauthentik/authentik/pull/19227)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.1 to 8.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19220](https://redirect.github.com/goauthentik/authentik/pull/19220)
- lifecycle/aws: bump aws-cdk from 2.1100.2 to 2.1100.3 in
/lifecycle/aws by [@

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Only on Sunday and Saturday ( * * * *
0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/fgeck/homelab-k3s).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDguMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvbWFqb3IiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant