Skip to content

core: bump library/node from ccfd9da to 03729a7 in /website#19125

Merged
BeryJu merged 1 commit intomainfrom
dependabot/docker/website/library/node-03729a7
Dec 31, 2025
Merged

core: bump library/node from ccfd9da to 03729a7 in /website#19125
BeryJu merged 1 commit intomainfrom
dependabot/docker/website/library/node-03729a7

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 31, 2025

Bumps library/node from ccfd9da to 03729a7.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps library/node from `ccfd9da` to `03729a7`.

---
updated-dependencies:
- dependency-name: library/node
  dependency-version: 25.2.1-trixie
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 31, 2025
@dependabot dependabot bot requested a review from a team as a code owner December 31, 2025 04:20
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 31, 2025
@netlify
Copy link

netlify bot commented Dec 31, 2025

Deploy Preview for authentik-integrations ready!

Name Link
🔨 Latest commit 6c8bd24
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/6954a4a0f98d080008fc6526
😎 Deploy Preview https://deploy-preview-19125--authentik-integrations.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link

netlify bot commented Dec 31, 2025

Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 6c8bd24
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6954a4a0756fad00089db391
😎 Deploy Preview https://deploy-preview-19125--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@codecov
Copy link

codecov bot commented Dec 31, 2025

❌ 2 Tests Failed:

Tests completed Failed Passed Skipped
2869 2 2867 2
View the top 2 failed test(s) by shortest run time
tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC::test_authorization_consent_explicit
Stack Traces | 53.1s run time
self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="779febce295b40d7b0b0d25c8f06d494", element="f.3967A787C9C90F214E5F5C6C0879C565.d.5561D72A61AD1FF2AB144679521A0DE7.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabebc29240>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabeefc8860>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="779febce295b40d7b0b0d25c8f06d494", element="f.3967A787C9C90F214E5F5C6C0879C565.d.5561D72A61AD1FF2AB144679521A0DE7.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="779febce295b40d7b0b0d25c8f06d494", element="f.3967A787C9C90F214E5F5C6C0879C565.d.5561D72A61AD1FF2AB144679521A0DE7.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="779febce295b40d7b0b0d25c8f06d494", element="f.3967A787C9C90F214E5F5C6C0879C565.d.5561D72A61AD1FF2AB144679521A0DE7.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.3967A787C9C90F214E5F5C6C0879C565.d.5561D72A61AD1FF2AB144679521A0DE7.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="779febce295b40d7b0b0d25c8f06d494")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabec966cf0>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x55910d927cd5 \\u003Cunknown>\\n#28 0x55910d939709 \\u003Cunknown>\\n#29 0x7f6722c4e428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x55910d93a432 <unknown>
E       #1 0x55910d37f71b <unknown>
E       #2 0x55910d393207 <unknown>
E       #3 0x55910d391e10 <unknown>
E       #4 0x55910d393719 <unknown>
E       #5 0x55910d386c64 <unknown>
E       #6 0x55910d385873 <unknown>
E       #7 0x55910d388d6f <unknown>
E       #8 0x55910d388e55 <unknown>
E       #9 0x55910d3ceda4 <unknown>
E       #10 0x55910d3cf7d5 <unknown>
E       #11 0x55910d3c3caa <unknown>
E       #12 0x55910d3f3ee1 <unknown>
E       #13 0x55910d3c3b81 <unknown>
E       #14 0x55910d3f40a2 <unknown>
E       #15 0x55910d415b62 <unknown>
E       #16 0x55910d3f3c67 <unknown>
E       #17 0x55910d3c2047 <unknown>
E       #18 0x55910d3c2e15 <unknown>
E       #19 0x55910d905064 <unknown>
E       #20 0x55910d908354 <unknown>
E       #21 0x55910d907e0e <unknown>
E       #22 0x55910d9087e9 <unknown>
E       #23 0x55910d8eea7a <unknown>
E       #24 0x55910d908b5a <unknown>
E       #25 0x55910d8d7629 <unknown>
E       #26 0x55910d927ae9 <unknown>
E       #27 0x55910d927cd5 <unknown>
E       #28 0x55910d939709 <unknown>
E       #29 0x7f6722c4e428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="f7a9a3b968fe1b0eb22e214e1f1fa029", element="f.D84A36FBF85437AE32CDB3F641994EE3.d.1DE3345BA5B5D710CAB6C5BFB8D27E74.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabebb897f0>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabec1d27a0>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="f7a9a3b968fe1b0eb22e214e1f1fa029", element="f.D84A36FBF85437AE32CDB3F641994EE3.d.1DE3345BA5B5D710CAB6C5BFB8D27E74.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="f7a9a3b968fe1b0eb22e214e1f1fa029", element="f.D84A36FBF85437AE32CDB3F641994EE3.d.1DE3345BA5B5D710CAB6C5BFB8D27E74.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="f7a9a3b968fe1b0eb22e214e1f1fa029", element="f.D84A36FBF85437AE32CDB3F641994EE3.d.1DE3345BA5B5D710CAB6C5BFB8D27E74.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.D84A36FBF85437AE32CDB3F641994EE3.d.1DE3345BA5B5D710CAB6C5BFB8D27E74.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="f7a9a3b968fe1b0eb22e214e1f1fa029")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabec966ad0>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x5596387a0cd5 \\u003Cunknown>\\n#28 0x5596387b2709 \\u003Cunknown>\\n#29 0x7f9450a6d428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x5596387b3432 <unknown>
E       #1 0x5596381f871b <unknown>
E       #2 0x55963820c207 <unknown>
E       #3 0x55963820ae10 <unknown>
E       #4 0x55963820c719 <unknown>
E       #5 0x5596381ffc64 <unknown>
E       #6 0x5596381fe873 <unknown>
E       #7 0x559638201d6f <unknown>
E       #8 0x559638201e55 <unknown>
E       #9 0x559638247da4 <unknown>
E       #10 0x5596382487d5 <unknown>
E       #11 0x55963823ccaa <unknown>
E       #12 0x55963826cee1 <unknown>
E       #13 0x55963823cb81 <unknown>
E       #14 0x55963826d0a2 <unknown>
E       #15 0x55963828eb62 <unknown>
E       #16 0x55963826cc67 <unknown>
E       #17 0x55963823b047 <unknown>
E       #18 0x55963823be15 <unknown>
E       #19 0x55963877e064 <unknown>
E       #20 0x559638781354 <unknown>
E       #21 0x559638780e0e <unknown>
E       #22 0x5596387817e9 <unknown>
E       #23 0x559638767a7a <unknown>
E       #24 0x559638781b5a <unknown>
E       #25 0x559638750629 <unknown>
E       #26 0x5596387a0ae9 <unknown>
E       #27 0x5596387a0cd5 <unknown>
E       #28 0x5596387b2709 <unknown>
E       #29 0x7f9450a6d428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <unittest.case._Outcome object at 0x7fabec967460>
test_case = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
result = <TestCaseFunction test_authorization_consent_explicit>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
method = <bound method TestProviderOAuth2OIDC.test_authorization_consent_explicit of <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:536: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:536: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
>               raise exc

tests/e2e/utils.py:530: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-explicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (explicit consent)\nentries:\n- attrs:\n    desi...e: !KeyOf default-provider-authorization-consent\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_explicit(self):
        """test OpenID Provider flow (default authorization flow with explicit consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-explicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            authorization_flow=authorization_flow,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:264: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_explicit>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="947164e411a5a8284619b35b84a00239", element="f.EF8E49BFEED791C6470D89EFF2B7AA15.d.0A729B711DD2A27F71AD24D4AADBBE1D.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabebb8a270>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabec1d20c0>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="947164e411a5a8284619b35b84a00239", element="f.EF8E49BFEED791C6470D89EFF2B7AA15.d.0A729B711DD2A27F71AD24D4AADBBE1D.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="947164e411a5a8284619b35b84a00239", element="f.EF8E49BFEED791C6470D89EFF2B7AA15.d.0A729B711DD2A27F71AD24D4AADBBE1D.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="947164e411a5a8284619b35b84a00239", element="f.EF8E49BFEED791C6470D89EFF2B7AA15.d.0A729B711DD2A27F71AD24D4AADBBE1D.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.EF8E49BFEED791C6470D89EFF2B7AA15.d.0A729B711DD2A27F71AD24D4AADBBE1D.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="947164e411a5a8284619b35b84a00239")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabebb68550>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x560f695d9cd5 \\u003Cunknown>\\n#28 0x560f695eb709 \\u003Cunknown>\\n#29 0x7f95aec60428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x560f695ec432 <unknown>
E       #1 0x560f6903171b <unknown>
E       #2 0x560f69045207 <unknown>
E       #3 0x560f69043e10 <unknown>
E       #4 0x560f69045719 <unknown>
E       #5 0x560f69038c64 <unknown>
E       #6 0x560f69037873 <unknown>
E       #7 0x560f6903ad6f <unknown>
E       #8 0x560f6903ae55 <unknown>
E       #9 0x560f69080da4 <unknown>
E       #10 0x560f690817d5 <unknown>
E       #11 0x560f69075caa <unknown>
E       #12 0x560f690a5ee1 <unknown>
E       #13 0x560f69075b81 <unknown>
E       #14 0x560f690a60a2 <unknown>
E       #15 0x560f690c7b62 <unknown>
E       #16 0x560f690a5c67 <unknown>
E       #17 0x560f69074047 <unknown>
E       #18 0x560f69074e15 <unknown>
E       #19 0x560f695b7064 <unknown>
E       #20 0x560f695ba354 <unknown>
E       #21 0x560f695b9e0e <unknown>
E       #22 0x560f695ba7e9 <unknown>
E       #23 0x560f695a0a7a <unknown>
E       #24 0x560f695bab5a <unknown>
E       #25 0x560f69589629 <unknown>
E       #26 0x560f695d9ae9 <unknown>
E       #27 0x560f695d9cd5 <unknown>
E       #28 0x560f695eb709 <unknown>
E       #29 0x7f95aec60428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException
tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC::test_authorization_consent_implied
Stack Traces | 54.4s run time
self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)
        (due to offline_access a consent will still be triggered)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="c82b0e6ef2ec00d3351b9b3cd565afd3", element="f.1984A925362696A49A59CE794DF3F4DB.d.19D5CC60AE30B033E8323B9F670A4411.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabecbf4b40>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabec4b14e0>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="c82b0e6ef2ec00d3351b9b3cd565afd3", element="f.1984A925362696A49A59CE794DF3F4DB.d.19D5CC60AE30B033E8323B9F670A4411.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="c82b0e6ef2ec00d3351b9b3cd565afd3", element="f.1984A925362696A49A59CE794DF3F4DB.d.19D5CC60AE30B033E8323B9F670A4411.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="c82b0e6ef2ec00d3351b9b3cd565afd3", element="f.1984A925362696A49A59CE794DF3F4DB.d.19D5CC60AE30B033E8323B9F670A4411.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.1984A925362696A49A59CE794DF3F4DB.d.19D5CC60AE30B033E8323B9F670A4411.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="c82b0e6ef2ec00d3351b9b3cd565afd3")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabebea2c50>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x55709b5bdcd5 \\u003Cunknown>\\n#28 0x55709b5cf709 \\u003Cunknown>\\n#29 0x7fe51ab06428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x55709b5d0432 <unknown>
E       #1 0x55709b01571b <unknown>
E       #2 0x55709b029207 <unknown>
E       #3 0x55709b027e10 <unknown>
E       #4 0x55709b029719 <unknown>
E       #5 0x55709b01cc64 <unknown>
E       #6 0x55709b01b873 <unknown>
E       #7 0x55709b01ed6f <unknown>
E       #8 0x55709b01ee55 <unknown>
E       #9 0x55709b064da4 <unknown>
E       #10 0x55709b0657d5 <unknown>
E       #11 0x55709b059caa <unknown>
E       #12 0x55709b089ee1 <unknown>
E       #13 0x55709b059b81 <unknown>
E       #14 0x55709b08a0a2 <unknown>
E       #15 0x55709b0abb62 <unknown>
E       #16 0x55709b089c67 <unknown>
E       #17 0x55709b058047 <unknown>
E       #18 0x55709b058e15 <unknown>
E       #19 0x55709b59b064 <unknown>
E       #20 0x55709b59e354 <unknown>
E       #21 0x55709b59de0e <unknown>
E       #22 0x55709b59e7e9 <unknown>
E       #23 0x55709b584a7a <unknown>
E       #24 0x55709b59eb5a <unknown>
E       #25 0x55709b56d629 <unknown>
E       #26 0x55709b5bdae9 <unknown>
E       #27 0x55709b5bdcd5 <unknown>
E       #28 0x55709b5cf709 <unknown>
E       #29 0x7fe51ab06428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)
        (due to offline_access a consent will still be triggered)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="fbea62926091b175d5a253e10f956b36", element="f.DF087115676FEE2009B931707CFC75AA.d.3C3E556F77DE8CDE116A8C1B9340EE3D.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabebe69cc0>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabeb556480>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="fbea62926091b175d5a253e10f956b36", element="f.DF087115676FEE2009B931707CFC75AA.d.3C3E556F77DE8CDE116A8C1B9340EE3D.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="fbea62926091b175d5a253e10f956b36", element="f.DF087115676FEE2009B931707CFC75AA.d.3C3E556F77DE8CDE116A8C1B9340EE3D.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="fbea62926091b175d5a253e10f956b36", element="f.DF087115676FEE2009B931707CFC75AA.d.3C3E556F77DE8CDE116A8C1B9340EE3D.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.DF087115676FEE2009B931707CFC75AA.d.3C3E556F77DE8CDE116A8C1B9340EE3D.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="fbea62926091b175d5a253e10f956b36")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabeb5074d0>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x55c6599d0cd5 \\u003Cunknown>\\n#28 0x55c6599e2709 \\u003Cunknown>\\n#29 0x7f785af2f428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x55c6599e3432 <unknown>
E       #1 0x55c65942871b <unknown>
E       #2 0x55c65943c207 <unknown>
E       #3 0x55c65943ae10 <unknown>
E       #4 0x55c65943c719 <unknown>
E       #5 0x55c65942fc64 <unknown>
E       #6 0x55c65942e873 <unknown>
E       #7 0x55c659431d6f <unknown>
E       #8 0x55c659431e55 <unknown>
E       #9 0x55c659477da4 <unknown>
E       #10 0x55c6594787d5 <unknown>
E       #11 0x55c65946ccaa <unknown>
E       #12 0x55c65949cee1 <unknown>
E       #13 0x55c65946cb81 <unknown>
E       #14 0x55c65949d0a2 <unknown>
E       #15 0x55c6594beb62 <unknown>
E       #16 0x55c65949cc67 <unknown>
E       #17 0x55c65946b047 <unknown>
E       #18 0x55c65946be15 <unknown>
E       #19 0x55c6599ae064 <unknown>
E       #20 0x55c6599b1354 <unknown>
E       #21 0x55c6599b0e0e <unknown>
E       #22 0x55c6599b17e9 <unknown>
E       #23 0x55c659997a7a <unknown>
E       #24 0x55c6599b1b5a <unknown>
E       #25 0x55c659980629 <unknown>
E       #26 0x55c6599d0ae9 <unknown>
E       #27 0x55c6599d0cd5 <unknown>
E       #28 0x55c6599e2709 <unknown>
E       #29 0x7f785af2f428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

During handling of the above exception, another exception occurred:

self = <unittest.case._Outcome object at 0x7fabec11a140>
test_case = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
result = <TestCaseFunction test_authorization_consent_implied>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
method = <bound method TestProviderOAuth2OIDC.test_authorization_consent_implied of <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11........./x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:536: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
                raise exc
            logger.debug("Retrying on error", exc=exc, test=self)
            self.tearDown()
            self._post_teardown()
            self._pre_setup()
            self.setUp()
>           return wrapper(self, *args, **kwargs)

tests/e2e/utils.py:536: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
            return func(self, *args, **kwargs)
    
        except tuple(exceptions) as exc:
            count += 1
            if count > max_retires:
                logger.debug("Exceeded retry count", exc=exc, test=self)
    
>               raise exc

tests/e2e/utils.py:530: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:523: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)
        (due to offline_access a consent will still be triggered)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/auth/callback")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        app = Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009")
        self.login()
    
        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
    
        flow_executor = self.get_shadow_root("ak-flow-executor")
>       consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)

tests/e2e/test_provider_oidc.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc.TestProviderOAuth2OIDC testMethod=test_authorization_consent_implied>
selector = 'ak-stage-consent'
container = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="e0eae7f23c459e2de43a5a2448c129b3", element="f.78D3FFFDB42F740BAC142F5221349775.d.CA425B9655683743ABF55E0250295005.e.6")>
timeout = 10

    def get_shadow_root(
        self, selector: str, container: WebElement | WebDriver | None = None, timeout: float = 10
    ) -> WebElement:
        """Get the shadow root of a web component specified by `selector`."""
        if not container:
            container = self.driver
        wait = WebDriverWait(container, timeout)
        host: WebElement | None = None
    
        try:
>           host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <[AttributeError("'ShadowRoot' object has no attribute 'session_id'") raised in repr()] WebDriverWait object at 0x7fabebe69320>
method = <function SeleniumTestCase.get_shadow_root.<locals>.<lambda> at 0x7fabebad2ac0>
message = ''

    def until(self, method: Callable[[D], Union[Literal[False], T]], message: str = "") -> T:
        """Wait until the method returns a value that is not False.
    
        Calls the method provided with the driver as an argument until the
        return value does not evaluate to ``False``.
    
        Parameters:
        -----------
        method: callable(WebDriver)
            - A callable object that takes a WebDriver instance as an argument.
    
        message: str
            - Optional message for :exc:`TimeoutException`
    
        Return:
        -------
        object: T
            - The result of the last call to `method`
    
        Raises:
        -------
        TimeoutException
            - If 'method' does not return a truthy value within the WebDriverWait
            object's timeout
    
        Example:
        --------
        >>> from selenium.webdriver.common.by import By
        >>> from selenium.webdriver.support.ui import WebDriverWait
        >>> from selenium.webdriver.support import expected_conditions as EC
    
        # Wait until an element is visible on the page
        >>> wait = WebDriverWait(driver, 10)
        >>> element = wait.until(EC.visibility_of_element_located((By.ID, "exampleId")))
        >>> print(element.text)
        """
        screen = None
        stacktrace = None
    
        end_time = time.monotonic() + self._timeout
        while True:
            try:
>               value = method(self._driver)

.venv/lib/python3.13.../webdriver/support/wait.py:137: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

c = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="e0eae7f23c459e2de43a5a2448c129b3", element="f.78D3FFFDB42F740BAC142F5221349775.d.CA425B9655683743ABF55E0250295005.e.6")>

>   host = wait.until(lambda c: c.find_element(By.CSS_SELECTOR, selector))

tests/e2e/utils.py:378: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="e0eae7f23c459e2de43a5a2448c129b3", element="f.78D3FFFDB42F740BAC142F5221349775.d.CA425B9655683743ABF55E0250295005.e.6")>
by = 'css selector', value = 'ak-stage-consent'

    def find_element(self, by: str = By.ID, value: str = None):
        """Find an element inside a shadow root given a By strategy and
        locator.
    
        Parameters:
        -----------
        by : selenium.webdriver.common.by.By
            The locating strategy to use. Default is `By.ID`. Supported values include:
            - By.ID: Locate by element ID.
            - By.NAME: Locate by the `name` attribute.
            - By.XPATH: Locate by an XPath expression.
            - By.CSS_SELECTOR: Locate by a CSS selector.
            - By.CLASS_NAME: Locate by the `class` attribute.
            - By.TAG_NAME: Locate by the tag name (e.g., "input", "button").
            - By.LINK_TEXT: Locate a link element by its exact text.
            - By.PARTIAL_LINK_TEXT: Locate a link element by partial text match.
            - RelativeBy: Locate elements relative to a specified root element.
    
        Example:
        --------
        element = driver.find_element(By.ID, 'foo')
    
        Returns:
        -------
        WebElement
            The first matching `WebElement` found on the page.
        """
        if by == By.ID:
            by = By.CSS_SELECTOR
            value = f'[id="{value}"]'
        elif by == By.CLASS_NAME:
            by = By.CSS_SELECTOR
            value = f".{value}"
        elif by == By.NAME:
            by = By.CSS_SELECTOR
            value = f'[name="{value}"]'
    
>       return self._execute(Command.FIND_ELEMENT_FROM_SHADOW_ROOT, {"using": by, "value": value})["value"]

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:79: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.shadowroot.ShadowRoot (session="e0eae7f23c459e2de43a5a2448c129b3", element="f.78D3FFFDB42F740BAC142F5221349775.d.CA425B9655683743ABF55E0250295005.e.6")>
command = 'findElementFromShadowRoot'
params = {'shadowId': 'f.78D3FFFDB42F740BAC142F5221349775.d.CA425B9655683743ABF55E0250295005.e.6', 'using': 'css selector', 'value': 'ak-stage-consent'}

    def _execute(self, command, params=None):
        """Executes a command against the underlying HTML element.
    
        Args:
          command: The name of the command to _execute as a string.
          params: A dictionary of named parameters to send with the command.
    
        Returns:
          The command's JSON response loaded into a dictionary object.
        """
        if not params:
            params = {}
        params["shadowId"] = self._id
>       return self.session.execute(command, params)

.venv/lib/python3.13.../webdriver/remote/shadowroot.py:133: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.webdriver.WebDriver (session="e0eae7f23c459e2de43a5a2448c129b3")>
driver_command = 'findElementFromShadowRoot'
params = {'using': 'css selector', 'value': 'ak-stage-consent'}

    def execute(self, driver_command: str, params: dict = None) -> dict:
        """Sends a command to be executed by a command.CommandExecutor.
    
        Parameters:
        -----------
        driver_command : str
            - The name of the command to execute as a string.
    
        params : dict
            - A dictionary of named Parameters to send with the command.
    
        Returns:
        --------
          dict - The command's JSON response loaded into a dictionary object.
        """
        params = self._wrap_value(params)
    
        if self.session_id:
            if not params:
                params = {"sessionId": self.session_id}
            elif "sessionId" not in params:
                params["sessionId"] = self.session_id
    
        response = self.command_executor.execute(driver_command, params)
        if response:
>           self.error_handler.check_response(response)

.venv/lib/python3.13.../webdriver/remote/webdriver.py:448: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <selenium.webdriver.remote.errorhandler.ErrorHandler object at 0x7fabeba596d0>
response = {'status': 404, 'value': '{"value":{"error":"detached shadow root","message":"detached shadow root: detached shadow ro...\\n#27 0x5562fa091cd5 \\u003Cunknown>\\n#28 0x5562fa0a3709 \\u003Cunknown>\\n#29 0x7f945e22d428 \\u003Cunknown>\\n"}}'}

    def check_response(self, response: Dict[str, Any]) -> None:
        """Checks that a JSON response from the WebDriver does not have an
        error.
    
        :Args:
         - response - The JSON response from the WebDriver server as a dictionary
           object.
    
        :Raises: If the response contains an error message.
        """
        status = response.get("status", None)
        if not status or status == ErrorCode.SUCCESS:
            return
        value = None
        message = response.get("message", "")
        screen: str = response.get("screen", "")
        stacktrace = None
        if isinstance(status, int):
            value_json = response.get("value", None)
            if value_json and isinstance(value_json, str):
                import json
    
                try:
                    value = json.loads(value_json)
                    if len(value) == 1:
                        value = value["value"]
                    status = value.get("error", None)
                    if not status:
                        status = value.get("status", ErrorCode.UNKNOWN_ERROR)
                        message = value.get("value") or value.get("message")
                        if not isinstance(message, str):
                            value = message
                            message = message.get("message")
                    else:
                        message = value.get("message", None)
                except ValueError:
                    pass
    
        exception_class: Type[WebDriverException]
        e = ErrorCode()
        error_codes = [item for item in dir(e) if not item.startswith("__")]
        for error_code in error_codes:
            error_info = getattr(ErrorCode, error_code)
            if isinstance(error_info, list) and status in error_info:
                exception_class = getattr(ExceptionMapping, error_code, WebDriverException)
                break
        else:
            exception_class = WebDriverException
    
        if not value:
            value = response["value"]
        if isinstance(value, str):
            raise exception_class(value)
        if message == "" and "message" in value:
            message = value["message"]
    
        screen = None  # type: ignore[assignment]
        if "screen" in value:
            screen = value["screen"]
    
        stacktrace = None
        st_value = value.get("stackTrace") or value.get("stacktrace")
        if st_value:
            if isinstance(st_value, str):
                stacktrace = st_value.split("\n")
            else:
                stacktrace = []
                try:
                    for frame in st_value:
                        line = frame.get("lineNumber", "")
                        file = frame.get("fileName", "<anonymous>")
                        if line:
                            file = f"{file}:{line}"
                        meth = frame.get("methodName", "<anonymous>")
                        if "className" in frame:
                            meth = f"{frame['className']}.{meth}"
                        msg = "    at %s (%s)"
                        msg = msg % (meth, file)
                        stacktrace.append(msg)
                except TypeError:
                    pass
        if exception_class == UnexpectedAlertPresentException:
            alert_text = None
            if "data" in value:
                alert_text = value["data"].get("text")
            elif "alert" in value:
                alert_text = value["alert"].get("text")
            raise exception_class(message, screen, stacktrace, alert_text)  # type: ignore[call-arg]  # mypy is not smart enough here
>       raise exception_class(message, screen, stacktrace)
E       selenium.common.exceptions.DetachedShadowRootException: Message: detached shadow root: detached shadow root not found
E         (Session info: chrome=143.0.7499.169)
E       Stacktrace:
E       #0 0x5562fa0a4432 <unknown>
E       #1 0x5562f9ae971b <unknown>
E       #2 0x5562f9afd207 <unknown>
E       #3 0x5562f9afbe10 <unknown>
E       #4 0x5562f9afd719 <unknown>
E       #5 0x5562f9af0c64 <unknown>
E       #6 0x5562f9aef873 <unknown>
E       #7 0x5562f9af2d6f <unknown>
E       #8 0x5562f9af2e55 <unknown>
E       #9 0x5562f9b38da4 <unknown>
E       #10 0x5562f9b397d5 <unknown>
E       #11 0x5562f9b2dcaa <unknown>
E       #12 0x5562f9b5dee1 <unknown>
E       #13 0x5562f9b2db81 <unknown>
E       #14 0x5562f9b5e0a2 <unknown>
E       #15 0x5562f9b7fb62 <unknown>
E       #16 0x5562f9b5dc67 <unknown>
E       #17 0x5562f9b2c047 <unknown>
E       #18 0x5562f9b2ce15 <unknown>
E       #19 0x5562fa06f064 <unknown>
E       #20 0x5562fa072354 <unknown>
E       #21 0x5562fa071e0e <unknown>
E       #22 0x5562fa0727e9 <unknown>
E       #23 0x5562fa058a7a <unknown>
E       #24 0x5562fa072b5a <unknown>
E       #25 0x5562fa041629 <unknown>
E       #26 0x5562fa091ae9 <unknown>
E       #27 0x5562fa091cd5 <unknown>
E       #28 0x5562fa0a3709 <unknown>
E       #29 0x7f945e22d428 <unknown>

.venv/lib/python3.13.../webdriver/remote/errorhandler.py:232: DetachedShadowRootException

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@BeryJu BeryJu merged commit 79b01f8 into main Dec 31, 2025
95 of 98 checks passed
@BeryJu BeryJu deleted the dependabot/docker/website/library/node-03729a7 branch December 31, 2025 14:08
kensternberg-authentik added a commit that referenced this pull request Jan 12, 2026
* main: (48 commits)
  website/integrations: karakeep: don't hardcode wellknown's slug (#19127)
  core, web: bump qs from 6.14.0 to 6.14.1 in /packages/docusaurus-config (#19130)
  core: bump library/node from `ccfd9da` to `03729a7` in /website (#19125)
  core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 (#19088)
  web: bump the swc group across 1 directory with 11 updates (#19124)
  core: bump library/nginx from `ad85427` to `ca871a8` in /website (#19126)
  web: Capitalize language display names, code owner fix (#19119)
  web: Fix Impersonation, Lit Reactive Controller Contexts (#19114)
  web: bump the eslint group across 1 directory with 3 updates (#19110)
  core: bump library/nginx from `fb01117` to `ad85427` in /website (#19112)
  web: bump the storybook group across 1 directory with 5 updates (#19111)
  website/docs: release notes: Add more integrations (#19109)
  website/integrations: Add Audiobookshelf (#19104)
  website/integrations: Add Pulse (#19105)
  web/maintenance/no unknown attributes (part 1) (#18970)
  Update Vaultwarden documentation by removing warning (#19102)
  web: Fix stale flow background (#19015)
  web: fix promoted source button hover losing blue color (#19048)
  web: bump knip from 5.77.1 to 5.78.0 in /web (#19090)
  website/docs: endpoint devices: add path to macos setup (#19093)
  ...
enchantednatures pushed a commit to enchantednatures/HomeCluster that referenced this pull request Feb 26, 2026
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [authentik](https://goauthentik.io)
([source](https://redirect.github.com/goauthentik/helm)) | major |
`2025.12.4` → `2026.2.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>goauthentik/helm (authentik)</summary>

###
[`v2026.2.0`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.0)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: add fields auto-added by Kubernetes to httproute by
[@&#8203;cfi2017](https://redirect.github.com/cfi2017) in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)
- chore(deps): update helm/kind-action action to v1.14.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;454](https://redirect.github.com/goauthentik/helm/pull/454)
- charts/authentik: add note how to set version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[#&#8203;456](https://redirect.github.com/goauthentik/helm/pull/456)
- charts/authentik: bump to 2026.2.0 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;457](https://redirect.github.com/goauthentik/helm/pull/457)

#### New Contributors

- [@&#8203;cfi2017](https://redirect.github.com/cfi2017) made their
first contribution in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2>

#### What's Changed

- root: bump version to 2026.2.0-rc1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18794](https://redirect.github.com/goauthentik/authentik/pull/18794)
- tests/e2e: retry detached shadow roots by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18796](https://redirect.github.com/goauthentik/authentik/pull/18796)
- website/release notes: Update v2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18797](https://redirect.github.com/goauthentik/authentik/pull/18797)
- web/admin: fix read-only provider selection for application form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18768](https://redirect.github.com/goauthentik/authentik/pull/18768)
- web: bump the react group across 1 directory with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18775](https://redirect.github.com/goauthentik/authentik/pull/18775)
- web: bump chromedriver from 143.0.0 to 143.0.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18776](https://redirect.github.com/goauthentik/authentik/pull/18776)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18774](https://redirect.github.com/goauthentik/authentik/pull/18774)
- internal: don't warn on empty outpost for embedded by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18786](https://redirect.github.com/goauthentik/authentik/pull/18786)
- lifecycle/aws: bump aws-cdk from 2.1033.0 to 2.1034.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18771](https://redirect.github.com/goauthentik/authentik/pull/18771)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18804](https://redirect.github.com/goauthentik/authentik/pull/18804)
- root: Add macOS support for sed in Makefile by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18795](https://redirect.github.com/goauthentik/authentik/pull/18795)
- ci: bump astral-sh/setup-uv from 7.1.5 to 7.1.6 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18826](https://redirect.github.com/goauthentik/authentik/pull/18826)
- ci: bump actions/upload-artifact from 5.0.0 to 6.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18824](https://redirect.github.com/goauthentik/authentik/pull/18824)
- core: bump goauthentik/fips-debian from `07f41ce` to `c10cd2c` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18822](https://redirect.github.com/goauthentik/authentik/pull/18822)
- ci: bump actions/download-artifact from 6.0.0 to 7.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18825](https://redirect.github.com/goauthentik/authentik/pull/18825)
- ci: bump actions/cache from 5.0.0 to 5.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18823](https://redirect.github.com/goauthentik/authentik/pull/18823)
- core: list applications fix by
[@&#8203;ryanpesek](https://redirect.github.com/ryanpesek) in
[goauthentik/authentik#18798](https://redirect.github.com/goauthentik/authentik/pull/18798)
- website/docs: add icon info to style guide by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18832](https://redirect.github.com/goauthentik/authentik/pull/18832)
- core: remove superuser check from `Token` list by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18684](https://redirect.github.com/goauthentik/authentik/pull/18684)
- packages/django-dramatiq-postgres: broker: close django connections on
consumer close by [@&#8203;rissson](https://redirect.github.com/rissson)
in
[goauthentik/authentik#18833](https://redirect.github.com/goauthentik/authentik/pull/18833)
- core: bump goauthentik.io/api/v3 from 3.2025120.26 to 3.2026020.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18815](https://redirect.github.com/goauthentik/authentik/pull/18815)
- admin/files: revert add check for /media existence
([#&#8203;18636](https://redirect.github.com/goauthentik/helm/issues/18636))
by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18829](https://redirect.github.com/goauthentik/authentik/pull/18829)
- website/docs: add jellyseer integration doc by
[@&#8203;gabay](https://redirect.github.com/gabay) in
[goauthentik/authentik#18812](https://redirect.github.com/goauthentik/authentik/pull/18812)
- crypto: Store details parsed from includeDetails in database instead
by [@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18013](https://redirect.github.com/goauthentik/authentik/pull/18013)
- core: skip s3 tests if endpoint isn't available by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18841](https://redirect.github.com/goauthentik/authentik/pull/18841)
- admin/files: fix get\_objects\_for\_user queryset argument in
FileUsedByView by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18845](https://redirect.github.com/goauthentik/authentik/pull/18845)
- core: bump goauthentik/fips-debian from `c10cd2c` to `2f19fc1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18856](https://redirect.github.com/goauthentik/authentik/pull/18856)
- ci: replace codecov test-results action by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18862](https://redirect.github.com/goauthentik/authentik/pull/18862)
- core: add skip s3\_test\_server\_available to
TestResolveFileUrlS3Backend by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18858](https://redirect.github.com/goauthentik/authentik/pull/18858)
- rbac: alter migrated direct permission roles by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18860](https://redirect.github.com/goauthentik/authentik/pull/18860)
- core: bump library/golang from `5d35fb8` to `8e8f9c8` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18855](https://redirect.github.com/goauthentik/authentik/pull/18855)
- web/admin/rbac: misc object permission fixes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18859](https://redirect.github.com/goauthentik/authentik/pull/18859)
- outposts: fix permission errors for related certificates by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18861](https://redirect.github.com/goauthentik/authentik/pull/18861)
- website/docs: adjust RBAC-related details in 2025.12 release notes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18863](https://redirect.github.com/goauthentik/authentik/pull/18863)
- website/docs: Add docs for passkey autofill (WebauthN Conditional UI)
by [@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18805](https://redirect.github.com/goauthentik/authentik/pull/18805)
- website/docs: 2025.10.3 release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18868](https://redirect.github.com/goauthentik/authentik/pull/18868)
- web: add custom message with links for empty data export list by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18830](https://redirect.github.com/goauthentik/authentik/pull/18830)
- web: fix notification counter by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18781](https://redirect.github.com/goauthentik/authentik/pull/18781)
- web: bump vite from 7.2.7 to 7.3.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18854](https://redirect.github.com/goauthentik/authentik/pull/18854)
- stages/authenticator\_\*: fix code input field not string by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18875](https://redirect.github.com/goauthentik/authentik/pull/18875)
- web: fix file upload form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18808](https://redirect.github.com/goauthentik/authentik/pull/18808)
- web/admin: endpoint: change wording and add helper text by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18871](https://redirect.github.com/goauthentik/authentik/pull/18871)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18807](https://redirect.github.com/goauthentik/authentik/pull/18807)
- website/integrations: bookstack: fix redir url by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18891](https://redirect.github.com/goauthentik/authentik/pull/18891)
- core: bump astral-sh/uv from 0.9.17 to 0.9.18 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18898](https://redirect.github.com/goauthentik/authentik/pull/18898)
- core: bump goauthentik/fips-debian from `2f19fc1` to `189345a` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18897](https://redirect.github.com/goauthentik/authentik/pull/18897)
- web: bump knip from 5.73.3 to 5.74.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18896](https://redirect.github.com/goauthentik/authentik/pull/18896)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.0 to 25.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18895](https://redirect.github.com/goauthentik/authentik/pull/18895)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18852](https://redirect.github.com/goauthentik/authentik/pull/18852)
- web: bump the bundler group across 1 directory with 7 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18894](https://redirect.github.com/goauthentik/authentik/pull/18894)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.30.0 to 10.31.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18893](https://redirect.github.com/goauthentik/authentik/pull/18893)
- lifecycle/aws: bump aws-cdk from 2.1034.0 to 2.1100.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18850](https://redirect.github.com/goauthentik/authentik/pull/18850)
- web: bump the goauthentik group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18819](https://redirect.github.com/goauthentik/authentik/pull/18819)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18818](https://redirect.github.com/goauthentik/authentik/pull/18818)
- web: bump the eslint group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18851](https://redirect.github.com/goauthentik/authentik/pull/18851)
- core: bump goauthentik.io/api/v3 from 3.2026020.1 to 3.2026020.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18892](https://redirect.github.com/goauthentik/authentik/pull/18892)
- tasks/middleware: close connections on worker status update database
error by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18881](https://redirect.github.com/goauthentik/authentik/pull/18881)
- website/docs: added list of Int Guide contributors (also edited
frontmatter) by [@&#8203;tanberry](https://redirect.github.com/tanberry)
in
[goauthentik/authentik#18888](https://redirect.github.com/goauthentik/authentik/pull/18888)
- api: fix page\_size with invalid query param by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18879](https://redirect.github.com/goauthentik/authentik/pull/18879)
- ci/release-tag: checkout correct branch for make test-docker by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18880](https://redirect.github.com/goauthentik/authentik/pull/18880)
- api: fix latest version for public schema by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18902](https://redirect.github.com/goauthentik/authentik/pull/18902)
- website/docs: 2025.12: remove superfluous changes by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18910](https://redirect.github.com/goauthentik/authentik/pull/18910)
- web/admin: reword some things on the device view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18785](https://redirect.github.com/goauthentik/authentik/pull/18785)
- core/groups: optimize prefetch queries to fetch only required fields
by [@&#8203;joaocfernandes](https://redirect.github.com/joaocfernandes)
in
[goauthentik/authentik#18448](https://redirect.github.com/goauthentik/authentik/pull/18448)
- root: fix docker-compose data mount by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18903](https://redirect.github.com/goauthentik/authentik/pull/18903)
- web/admin: add UI copy to RBAC modal by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#18917](https://redirect.github.com/goauthentik/authentik/pull/18917)
- tests/e2e: handle StaleElementReferenceException in
parse\_json\_content by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18842](https://redirect.github.com/goauthentik/authentik/pull/18842)
- core: bump goauthentik/fips-debian from `189345a` to `10dadf1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18927](https://redirect.github.com/goauthentik/authentik/pull/18927)
- web: bump chromedriver from 143.0.1 to 143.0.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18926](https://redirect.github.com/goauthentik/authentik/pull/18926)
- web: bump knip from 5.74.0 to 5.75.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18924](https://redirect.github.com/goauthentik/authentik/pull/18924)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18920](https://redirect.github.com/goauthentik/authentik/pull/18920)
- lifecycle/aws: bump aws-cdk from 2.1100.0 to 2.1100.1 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18922](https://redirect.github.com/goauthentik/authentik/pull/18922)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18923](https://redirect.github.com/goauthentik/authentik/pull/18923)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18817](https://redirect.github.com/goauthentik/authentik/pull/18817)
- stages: remove more global state by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18641](https://redirect.github.com/goauthentik/authentik/pull/18641)
- packages/ak-guardian: cast safely by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18929](https://redirect.github.com/goauthentik/authentik/pull/18929)
- web/flow: Fix spurious double submit on ak-stage-autosubmit by
[@&#8203;dminuoso](https://redirect.github.com/dminuoso) in
[goauthentik/authentik#18727](https://redirect.github.com/goauthentik/authentik/pull/18727)
- website/integrations: Add launch URL for Immich by
[@&#8203;optix2000](https://redirect.github.com/optix2000) in
[goauthentik/authentik#18921](https://redirect.github.com/goauthentik/authentik/pull/18921)
- crypto: fix extra cert data in db migration by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18937](https://redirect.github.com/goauthentik/authentik/pull/18937)
- web/elements: progress-bar and table loading header by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18934](https://redirect.github.com/goauthentik/authentik/pull/18934)
- stages/identification: replace sleep with make\_password by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18883](https://redirect.github.com/goauthentik/authentik/pull/18883)
- website/docs: endpoint devices by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18634](https://redirect.github.com/goauthentik/authentik/pull/18634)
- website/docs: Fix labels, Pre-Release detection by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18945](https://redirect.github.com/goauthentik/authentik/pull/18945)
- website/docs: release notes: add endpoint device links to 2025.12
notes by [@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18940](https://redirect.github.com/goauthentik/authentik/pull/18940)
- website/docs: Fix version parsing. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18948](https://redirect.github.com/goauthentik/authentik/pull/18948)
- web/admin: fix endpoints user binding by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18935](https://redirect.github.com/goauthentik/authentik/pull/18935)
- flows/executor: fix KeyError when session has no existing plan by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18951](https://redirect.github.com/goauthentik/authentik/pull/18951)
- root: move docker files to lifecycle/containers and change
docker-compose to compose by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#16624](https://redirect.github.com/goauthentik/authentik/pull/16624)
- core: bump goauthentik.io/api/v3 from 3.2026020.3 to 3.2026020.4 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18956](https://redirect.github.com/goauthentik/authentik/pull/18956)
- web: bump chromedriver from 143.0.2 to 143.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18959](https://redirect.github.com/goauthentik/authentik/pull/18959)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18958](https://redirect.github.com/goauthentik/authentik/pull/18958)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.31.0 to 10.32.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18957](https://redirect.github.com/goauthentik/authentik/pull/18957)
- ci: bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18960](https://redirect.github.com/goauthentik/authentik/pull/18960)
- website/docs: add note to active directory source doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18787](https://redirect.github.com/goauthentik/authentik/pull/18787)
- web/maintenance: fix missing custom web component imports by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18942](https://redirect.github.com/goauthentik/authentik/pull/18942)
- web/maintenance: no unknown tag names by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18944](https://redirect.github.com/goauthentik/authentik/pull/18944)
- website/integrations: Fix path for Cloudflare Access by
[@&#8203;stijn220](https://redirect.github.com/stijn220) in
[goauthentik/authentik#18979](https://redirect.github.com/goauthentik/authentik/pull/18979)
- blueprints: add InternallyManagedMixin instead of large list by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18983](https://redirect.github.com/goauthentik/authentik/pull/18983)
- web/admin: fix dark theme on map by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18985](https://redirect.github.com/goauthentik/authentik/pull/18985)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm by
[@&#8203;hskrtich](https://redirect.github.com/hskrtich) in
[goauthentik/authentik#18984](https://redirect.github.com/goauthentik/authentik/pull/18984)
- events: notifications live update by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18980](https://redirect.github.com/goauthentik/authentik/pull/18980)
- web: fix Open button selecting row instead of navigating by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18992](https://redirect.github.com/goauthentik/authentik/pull/18992)
- blueprints: fix flaky tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19002](https://redirect.github.com/goauthentik/authentik/pull/19002)
- ci: bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18999](https://redirect.github.com/goauthentik/authentik/pull/18999)
- providers/oauth2: Automated OpenID Conformance tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#14785](https://redirect.github.com/goauthentik/authentik/pull/14785)
- enterprise/reports: improve export list, confirmation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18981](https://redirect.github.com/goauthentik/authentik/pull/18981)
- enterprise/search: add static autocomplete structure by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19008](https://redirect.github.com/goauthentik/authentik/pull/19008)
- website/docs: improve endpoint devices docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19007](https://redirect.github.com/goauthentik/authentik/pull/19007)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18994](https://redirect.github.com/goauthentik/authentik/pull/18994)
- core: bump openapitools/openapi-generator-cli from v7.16.0 to v7.18.0
in /scripts/api by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19018](https://redirect.github.com/goauthentik/authentik/pull/19018)
- web: bump globby from 16.0.0 to 16.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18995](https://redirect.github.com/goauthentik/authentik/pull/18995)
- api: rework schema generation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18977](https://redirect.github.com/goauthentik/authentik/pull/18977)
- web/admin: prevent file upload attempt when backend not managed by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18646](https://redirect.github.com/goauthentik/authentik/pull/18646)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19019](https://redirect.github.com/goauthentik/authentik/pull/19019)
- core: bump goauthentik.io/api/v3 from 3.2026020.4 to 3.2026020.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19017](https://redirect.github.com/goauthentik/authentik/pull/19017)
- website/docs: Prioritize "Release Candidate" over "Current Release" by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18975](https://redirect.github.com/goauthentik/authentik/pull/18975)
- web: Locale selector UI fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18972](https://redirect.github.com/goauthentik/authentik/pull/18972)
- web: Fix Storybook package resolution with `npm link` by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19016](https://redirect.github.com/goauthentik/authentik/pull/19016)
- core: use chunked\_queryset for expired message deletion by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19028](https://redirect.github.com/goauthentik/authentik/pull/19028)
- web/admin: use consistent icon for inactive user status by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19032](https://redirect.github.com/goauthentik/authentik/pull/19032)
- web: bump lit from 3.3.1 to 3.3.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19038](https://redirect.github.com/goauthentik/authentik/pull/19038)
- web: bump
[@&#8203;lit/reactive-element](https://redirect.github.com/lit/reactive-element)
from 2.1.1 to 2.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19037](https://redirect.github.com/goauthentik/authentik/pull/19037)
- web: bump knip from 5.75.1 to 5.77.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19041](https://redirect.github.com/goauthentik/authentik/pull/19041)
- core: bump goauthentik.io/api/v3 from 3.2026020.5 to 3.2026020.6 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19036](https://redirect.github.com/goauthentik/authentik/pull/19036)
- docs/release notes: update 2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19043](https://redirect.github.com/goauthentik/authentik/pull/19043)
- lib/sync: fix sync\_dispatch by
[@&#8203;krejcar25](https://redirect.github.com/krejcar25) in
[goauthentik/authentik#19053](https://redirect.github.com/goauthentik/authentik/pull/19053)
- endpoints/devices: cleanup by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19047](https://redirect.github.com/goauthentik/authentik/pull/19047)
- blueprints: set enrollment token key by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19061](https://redirect.github.com/goauthentik/authentik/pull/19061)
- website/integrations: Add Wallos by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19013](https://redirect.github.com/goauthentik/authentik/pull/19013)
- website/docs: FreeIPA documentation updates by
[@&#8203;borutmrak](https://redirect.github.com/borutmrak) in
[goauthentik/authentik#15183](https://redirect.github.com/goauthentik/authentik/pull/15183)
- \*: Auto compress images by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19065](https://redirect.github.com/goauthentik/authentik/pull/19065)
- blueprints: fix deadlock and task context error in MetaApplyBlueprint
by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19033](https://redirect.github.com/goauthentik/authentik/pull/19033)
- web: fix file search input not resetting results properly by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19034](https://redirect.github.com/goauthentik/authentik/pull/19034)
- website/integrations: owncloud: fix php by
[@&#8203;ocmateusz](https://redirect.github.com/ocmateusz) in
[goauthentik/authentik#19073](https://redirect.github.com/goauthentik/authentik/pull/19073)
- tests/e2e: add endpoint tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19072](https://redirect.github.com/goauthentik/authentik/pull/19072)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18991](https://redirect.github.com/goauthentik/authentik/pull/18991)
- web: bump knip from 5.77.0 to 5.77.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19049](https://redirect.github.com/goauthentik/authentik/pull/19049)
- web: bump
[@&#8203;lit/localize-tools](https://redirect.github.com/lit/localize-tools)
from 0.8.0 to 0.8.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19040](https://redirect.github.com/goauthentik/authentik/pull/19040)
- internal: update TLS Suite by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19076](https://redirect.github.com/goauthentik/authentik/pull/19076)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 7.7.13 to 8.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19054](https://redirect.github.com/goauthentik/authentik/pull/19054)
- web/admin: fix button alignment on user view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19079](https://redirect.github.com/goauthentik/authentik/pull/19079)
- website/docs: endpoints: mention connector key required for stage to
work by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19084](https://redirect.github.com/goauthentik/authentik/pull/19084)
- website/docs: rel notes .12: add wallos by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19063](https://redirect.github.com/goauthentik/authentik/pull/19063)
- website/docs: endpoint devices: update features table by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19094](https://redirect.github.com/goauthentik/authentik/pull/19094)
- website/docs: endpoint devices: add path to macos setup by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19093](https://redirect.github.com/goauthentik/authentik/pull/19093)
- web: bump knip from 5.77.1 to 5.78.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19090](https://redirect.github.com/goauthentik/authentik/pull/19090)
- web: fix promoted source button hover losing blue color by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19048](https://redirect.github.com/goauthentik/authentik/pull/19048)
- web: Fix stale flow background by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19015](https://redirect.github.com/goauthentik/authentik/pull/19015)
- Update Vaultwarden documentation by removing warning by
[@&#8203;austin-dudzik](https://redirect.github.com/austin-dudzik) in
[goauthentik/authentik#19102](https://redirect.github.com/goauthentik/authentik/pull/19102)
- web/maintenance/no unknown attributes (part 1) by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18970](https://redirect.github.com/goauthentik/authentik/pull/18970)
- website/integrations: Add Pulse by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19105](https://redirect.github.com/goauthentik/authentik/pull/19105)
- website/integrations: Add Audiobookshelf by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19104](https://redirect.github.com/goauthentik/authentik/pull/19104)
- website/docs: release notes: Add more integrations by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19109](https://redirect.github.com/goauthentik/authentik/pull/19109)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19111](https://redirect.github.com/goauthentik/authentik/pull/19111)
- core: bump library/nginx from `fb01117` to `ad85427` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19112](https://redirect.github.com/goauthentik/authentik/pull/19112)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19110](https://redirect.github.com/goauthentik/authentik/pull/19110)
- web: Fix Impersonation, Lit Reactive Controller Contexts by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19114](https://redirect.github.com/goauthentik/authentik/pull/19114)
- web: Capitalize language display names, code owner fix by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19119](https://redirect.github.com/goauthentik/authentik/pull/19119)
- core: bump library/nginx from `ad85427` to `ca871a8` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19126](https://redirect.github.com/goauthentik/authentik/pull/19126)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19124](https://redirect.github.com/goauthentik/authentik/pull/19124)
- core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19088](https://redirect.github.com/goauthentik/authentik/pull/19088)
- core: bump library/node from `ccfd9da` to `03729a7` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19125](https://redirect.github.com/goauthentik/authentik/pull/19125)
- core, web: bump qs from 6.14.0 to 6.14.1 in
/packages/docusaurus-config by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19130](https://redirect.github.com/goauthentik/authentik/pull/19130)
- website/integrations: karakeep: don't hardcode wellknown's slug by
[@&#8203;pippo73](https://redirect.github.com/pippo73) in
[goauthentik/authentik#19127](https://redirect.github.com/goauthentik/authentik/pull/19127)
- web: disable user settings fields when changes are not allowed by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19132](https://redirect.github.com/goauthentik/authentik/pull/19132)
- website/docs: endpoint agent release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19042](https://redirect.github.com/goauthentik/authentik/pull/19042)
- website/docs: fix build by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19148](https://redirect.github.com/goauthentik/authentik/pull/19148)
- web: Token Form Fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19121](https://redirect.github.com/goauthentik/authentik/pull/19121)
- web/user: fix consent delete form missing details by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19147](https://redirect.github.com/goauthentik/authentik/pull/19147)
- web: bump globals from 16.5.0 to 17.0.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19154](https://redirect.github.com/goauthentik/authentik/pull/19154)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19135](https://redirect.github.com/goauthentik/authentik/pull/19135)
- ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19138](https://redirect.github.com/goauthentik/authentik/pull/19138)
- website/integrations: vaultwarden: add custom email scope by
[@&#8203;williamkray](https://redirect.github.com/williamkray) in
[goauthentik/authentik#19160](https://redirect.github.com/goauthentik/authentik/pull/19160)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid
blobs by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19137](https://redirect.github.com/goauthentik/authentik/pull/19137)
- core: handle deserialization errors from FileField migration by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19067](https://redirect.github.com/goauthentik/authentik/pull/19067)
- web: fix slug auto-updating when editing existing applications by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19169](https://redirect.github.com/goauthentik/authentik/pull/19169)
- web: Fix user library colors, modal z-indexes, table progress bars by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19152](https://redirect.github.com/goauthentik/authentik/pull/19152)
- web/admin: adjust sync threshold, add tooltip by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19131](https://redirect.github.com/goauthentik/authentik/pull/19131)
- website/docs: remove duplicates in slo docs by
[@&#8203;nmasnadithya](https://redirect.github.com/nmasnadithya) in
[goauthentik/authentik#19170](https://redirect.github.com/goauthentik/authentik/pull/19170)
- lifecycle: fix migration conn\_options for psycopg connection by
[@&#8203;D-Tasker207](https://redirect.github.com/D-Tasker207) in
[goauthentik/authentik#19134](https://redirect.github.com/goauthentik/authentik/pull/19134)
- web: bump knip from 5.78.0 to 5.79.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19181](https://redirect.github.com/goauthentik/authentik/pull/19181)
- ci: bump getsentry/action-release from 3.4.0 to 3.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19183](https://redirect.github.com/goauthentik/authentik/pull/19183)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.0 to 8.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19182](https://redirect.github.com/goauthentik/authentik/pull/19182)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19179](https://redirect.github.com/goauthentik/authentik/pull/19179)
- lib: update error logging by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18628](https://redirect.github.com/goauthentik/authentik/pull/18628)
- website/integrations: make grafana terraform section expand by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19192](https://redirect.github.com/goauthentik/authentik/pull/19192)
- core: add prettier failure on duplicate group names by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18941](https://redirect.github.com/goauthentik/authentik/pull/18941)
- web/maintenance: no missing element type definitions by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18950](https://redirect.github.com/goauthentik/authentik/pull/18950)
- root: codespell: ignore Python virtual env, group patterns. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19180](https://redirect.github.com/goauthentik/authentik/pull/19180)
- web: Merge branch -- Stale notifications, synchronized context
objects, rendering fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19141](https://redirect.github.com/goauthentik/authentik/pull/19141)
- website/docs: Add docs for roles by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19196](https://redirect.github.com/goauthentik/authentik/pull/19196)
- web: Defer table refresh, visibility checks. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19194](https://redirect.github.com/goauthentik/authentik/pull/19194)
- rbac: Add show all to roles tab, add role tab to groups by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19097](https://redirect.github.com/goauthentik/authentik/pull/19097)
- website/docs: rewrite section about users and perms by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#19195](https://redirect.github.com/goauthentik/authentik/pull/19195)
- core: add last\_login filter to users API by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18993](https://redirect.github.com/goauthentik/authentik/pull/18993)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19205](https://redirect.github.com/goauthentik/authentik/pull/19205)
- admin/files: support %(theme)s variable in media file paths by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19108](https://redirect.github.com/goauthentik/authentik/pull/19108)
- website/integrations: glpi: add step by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19208](https://redirect.github.com/goauthentik/authentik/pull/19208)
- web: bump knip from 5.79.0 to 5.80.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19207](https://redirect.github.com/goauthentik/authentik/pull/19207)
- core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19204](https://redirect.github.com/goauthentik/authentik/pull/19204)
- lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19203](https://redirect.github.com/goauthentik/authentik/pull/19203)
- core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19202](https://redirect.github.com/goauthentik/authentik/pull/19202)
- translate: Updates for project authentik and language pt\_BR by
[@&#8203;transifex-integration](https://redirect.github.com/transifex-integration)\[bot]
in
[goauthentik/authentik#19082](https://redirect.github.com/goauthentik/authentik/pull/19082)
- web/maintenance: lint pass to add missing HTMLElementEventMap entries
by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18953](https://redirect.github.com/goauthentik/authentik/pull/18953)
- outpost/proxyv2: reduce max number of postgres connections by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19211](https://redirect.github.com/goauthentik/authentik/pull/19211)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19200](https://redirect.github.com/goauthentik/authentik/pull/19200)
- website/docs: revisit endpoint docs the nth by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19116](https://redirect.github.com/goauthentik/authentik/pull/19116)
- ci: bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19221](https://redirect.github.com/goauthentik/authentik/pull/19221)
- endpoints: include license status in agent config by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19227](https://redirect.github.com/goauthentik/authentik/pull/19227)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.1 to 8.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19220](https://redirect.github.com/goauthentik/authentik/pull/19220)
- lifecycle/aws: bump aws-cdk from 2.1100.2 to 2.1100.3 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19219](https://redirect.github.com/goauthentik/authentik/pull/19219)
- core: bump goauthentik.io/api/v3 from 3.2026020.7 to 3.2026020.8 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19218](https://redirect.github.com/goauthentik/authentik/pull/19218)
- stages/authenticator\_static: set max token length to 100 chars by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19162](https://redirect.github.com/goauthentik/authentik/pull/19162)
- website/glossary: improve by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18969](https://redirect.github.com/goauthentik/authentik/pull/18969)
- core: fix read replica routing during transactions by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19086](https://redirect.github.com/goauthentik/authentik/pull/19086)
- website: Fix typos. by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19243](https://redirect.github.com/goauthentik/authentik/pull/19243)
- core: bump goauthentik.io/api/v3 from 3.2026020.8 to 3.2026020.10 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19242](https://redirect.github.com/goauthentik/authentik/pull/19242)
- website/integrations: update AWS by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#17861](https://redirect.github.com/goauthentik/authentik/pull/17861)
- website/docs: update github social login script example by
[@&#8203;busybox11](https://redirect.github.com/busybox11) in
[goauthentik/authentik#19246](https://redirect.github.com/goauthentik/authentik/pull/19246)
- web: bump vite from 7.3.0 to 7.3.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19245](https://redirect.github.com/goauthentik/authentik/pull/19245)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19206](https://redirect.github.com/goauthentik/authentik/pull/19206)
- stages/prompt: optimize API endpoints by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19251](https://redirect.github.com/goauthentik/authentik/pull/19251)
- website/docs: update entra id provider docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18366](https://redirect.github.com/goauthentik/authentik/pull/18366)
- website/integations: fix aws spelling by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19253](https://redirect.github.com/goauthentik/authentik/pull/19253)
- stages/password: replace session-based retries with reputation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18643](https://redirect.github.com/goauthentik/authentik/pull/18643)
- web: bump chromedriver from 143.0.3 to 143.0.4 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19244](https://redirect.github.com/goauthentik/authentik/pull/19244)
- web/admin: add banner to flow import form by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19288](https://redirect.github.com/goauthentik/authentik/pull/19288)
- core: bump django from v5.2.9 to 5.2.10 by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19290](https://redirect.github.com/goauthentik/authentik/pull/19290)
- endpoints: show agent version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19239](https://redirect.github.com/goauthentik/authentik/pull/19239)
- core: bump urllib3 from 2.5.0 to v2.6.3 by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19287](https://redirect.github.com/goauthentik/authentik/pull/19287)
- web: bump knip from 5.80.0 to 5.80.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19301](https://redirect.github.com/goauthentik/authentik/pull/19301)
- web: Fix flow inspector advancement event. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19309](https://redirect.github.com/goauthentik/authentik/pull/19309)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19237](https://redirect.github.com/goauthentik/authentik/pull/19237)
- website/docs: deprecate GCDT auth stage by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19306](https://redirect.github.com/goauthentik/authentik/pull/19306)
- website/docs: Fix typo in GitHub OAuth Source instructions by
[@&#8203;tcrasset](https://redirect.github.com/tcrasset) in
[goauthentik/authentik#18936](https://redirect.github.com/goauthentik/authentik/pull/18936)
- website/docs: update m2m doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18963](https://redirect.github.com/goauthentik/authentik/pull/18963)
- website/docs: Fix documentation example for
`app_entitlements_attributes`. by
[@&#8203;sebastianw](https://redirect.github.com/sebastianw) in
[goauthentik/authentik#19316](https://redirect.github.com/goauthentik/authentik/pull/19316)
- website/docs: add flow import warnings by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19307](https://redirect.github.com/goauthentik/authentik/pull/19307)
- web: bump pino from 10.1.0 to 10.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19333](https://redirect.github.com/goauthentik/authentik/pull/19333)
- web: bump knip from 5.80.1 to 5.80.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19332](https://redirect.github.com/goauthentik/authentik/pull/19332)
- core: bump axllent/mailpit from v1.28.1 to v1.28.2 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19329](https://redirect.github.com/goauthentik/authentik/pull/19329)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.3 to 25.0.6 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19331](https://redirect.github.com/goauthentik/authentik/pull/19331)
- core: bump library/nginx from `ca871a8` to `7272239` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19334](https://redirect.github.com/goauthentik/authentik/pull/19334)
- website/docs: update unique email policy by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19305](https://redirect.github.com/goauthentik/authentik/pull/19305)
- web: bump
[@&#8203;types/react](https://redirect.github.com/types/react) from
19.2.7 to 19.2.8 in /web in the react group across 1 directory by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19330](https://redirect.github.com/goauthentik/authentik/pull/19330)
- web: Images styles, theming by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19233](https://redirect.github.com/goauthentik/authentik/pull/19233)
- website/docs: update LDAP provider docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18272](https://redirect.github.com/goauthentik/authentik/pull/18272)
- web: Flow info, localization, back button. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19234](https://redirect.github.com/goauthentik/authentik/pull/19234)
- web: bump type-fest from 5.3.1 to 5.4.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19354](https://redirect.github.com/goauthentik/authentik/pull/19354)
- core: bump goauthentik.io/api/v3 from 3.2026020.10 to 3.2026020.11 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19300](https://redirect.github.com/goauthentik/authentik/pull/19300)
- ci: bump actions/setup-go from 6.1.0 to 6.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19352](https://redirect.github.com/goauthentik/authentik/pull/19352)
- web: bump the bundler group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19349](https://redirect.github.com/goauthentik/authentik/pull/19349)
- ci: bump actions/setup-go from 6.1.0 to 6.2.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19351](https://redirect.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" in timezone
America/New_York, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/enchantednatures/HomeCluster).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zNi4yIiwidXBkYXRlZEluVmVyIjoiNDMuMzYuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvbWFqb3IiXX0=-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fgeck pushed a commit to fgeck/homelab-k3s that referenced this pull request Mar 10, 2026
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [authentik](https://goauthentik.io)
([source](https://redirect.github.com/goauthentik/helm)) | major |
`^2025.0.0` → `^2026.0.0` |

---

### Release Notes

<details>
<summary>goauthentik/helm (authentik)</summary>

###
[`v2026.2.1`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.1)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2026.2.0...authentik-2026.2.1)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: Add weight to http route service by
[@&#8203;flipper](https://redirect.github.com/flipper) in
[#&#8203;458](https://redirect.github.com/goauthentik/helm/pull/458)
- chore(deps): update docker.io/library/postgres docker tag to v17.9 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;452](https://redirect.github.com/goauthentik/helm/pull/452)
- chore(deps): update prometheuscommunity/postgres-exporter docker tag
to v0.19.1 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;445](https://redirect.github.com/goauthentik/helm/pull/445)
- charts/authentik: bump to 2026.2.1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;459](https://redirect.github.com/goauthentik/helm/pull/459)

#### New Contributors

- [@&#8203;flipper](https://redirect.github.com/flipper) made their
first contribution in
[#&#8203;458](https://redirect.github.com/goauthentik/helm/pull/458)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2026.2.0...authentik-2026.2.1>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202621>

#### What's Changed

- website/docs: update supported versions (cherry-pick
[#&#8203;20534](https://redirect.github.com/goauthentik/helm/issues/20534)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20535](https://redirect.github.com/goauthentik/authentik/pull/20535)
- website/docs: fix upgrade link in `2026.2` release notes (cherry-pick
[#&#8203;20539](https://redirect.github.com/goauthentik/helm/issues/20539)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20542](https://redirect.github.com/goauthentik/authentik/pull/20542)
- website/docs: remove bad logs redirect (cherry-pick
[#&#8203;20522](https://redirect.github.com/goauthentik/helm/issues/20522)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20548](https://redirect.github.com/goauthentik/authentik/pull/20548)
- website/docs: revamp enterprise section (cherry-pick
[#&#8203;20379](https://redirect.github.com/goauthentik/helm/issues/20379)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20546](https://redirect.github.com/goauthentik/authentik/pull/20546)
- docs: fix typos and wording in docs and integrations (cherry-pick
[#&#8203;20550](https://redirect.github.com/goauthentik/helm/issues/20550)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20563](https://redirect.github.com/goauthentik/authentik/pull/20563)
- ci: add `reason` change to versions repo bump (cherry-pick
[#&#8203;20562](https://redirect.github.com/goauthentik/helm/issues/20562)
to version-2026.2) by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#20569](https://redirect.github.com/goauthentik/authentik/pull/20569)
- internal: make http timeouts configurable (cherry-pick
[#&#8203;20472](https://redirect.github.com/goauthentik/helm/issues/20472)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20567](https://redirect.github.com/goauthentik/authentik/pull/20567)
- packages/django-dramatiq-postgres: use fork (cherry-pick
[#&#8203;20606](https://redirect.github.com/goauthentik/helm/issues/20606)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20608](https://redirect.github.com/goauthentik/authentik/pull/20608)
- web/flows: fix source icons being always inverted (cherry-pick
[#&#8203;20419](https://redirect.github.com/goauthentik/helm/issues/20419)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20607](https://redirect.github.com/goauthentik/authentik/pull/20607)
- crypto: fix kid legacy signal (cherry-pick
[#&#8203;20627](https://redirect.github.com/goauthentik/helm/issues/20627)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20628](https://redirect.github.com/goauthentik/authentik/pull/20628)
- sources/ldap: add connection logging & downgrade message (cherry-pick
[#&#8203;20519](https://redirect.github.com/goauthentik/helm/issues/20519)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20636](https://redirect.github.com/goauthentik/authentik/pull/20636)
- packages/django-dramatiq-postgres: fix worker startup on macos
(cherry-pick
[#&#8203;20637](https://redirect.github.com/goauthentik/helm/issues/20637)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20641](https://redirect.github.com/goauthentik/authentik/pull/20641)
- enterprise/wsfed: Fix metadata export and signing logic (cherry-pick
[#&#8203;20643](https://redirect.github.com/goauthentik/helm/issues/20643)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20649](https://redirect.github.com/goauthentik/authentik/pull/20649)
- website/docs: entra id provider: add custom email domain info
(cherry-pick
[#&#8203;20444](https://redirect.github.com/goauthentik/helm/issues/20444)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20660](https://redirect.github.com/goauthentik/authentik/pull/20660)
- website/docs: kerberos: add note about caching (cherry-pick
[#&#8203;20663](https://redirect.github.com/goauthentik/helm/issues/20663)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20664](https://redirect.github.com/goauthentik/authentik/pull/20664)
- core: fix get\_provider returning base Provider instead of subclass
(cherry-pick
[#&#8203;19064](https://redirect.github.com/goauthentik/helm/issues/19064)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20670](https://redirect.github.com/goauthentik/authentik/pull/20670)
- packages/django-channels-postgres: eagerly delete messages
(cherry-pick
[#&#8203;20687](https://redirect.github.com/goauthentik/helm/issues/20687)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20688](https://redirect.github.com/goauthentik/authentik/pull/20688)
- outpost/proxyv2: prevent panic in handleSignOut (cherry-pick
[#&#8203;20097](https://redirect.github.com/goauthentik/helm/issues/20097)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20689](https://redirect.github.com/goauthentik/authentik/pull/20689)
- website/docs: add 2025 pentest (cherry-pick
[#&#8203;20626](https://redirect.github.com/goauthentik/helm/issues/20626)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20691](https://redirect.github.com/goauthentik/authentik/pull/20691)
- web: fix identification stage styling in compatibility mode
(cherry-pick
[#&#8203;20684](https://redirect.github.com/goauthentik/helm/issues/20684)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20694](https://redirect.github.com/goauthentik/authentik/pull/20694)
- providers/proxy: move search path to query instead of runtime
parameter (cherry-pick
[#&#8203;20662](https://redirect.github.com/goauthentik/helm/issues/20662)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20693](https://redirect.github.com/goauthentik/authentik/pull/20693)
- website/docs: add release notes for `2026.2.1` (cherry-pick
[#&#8203;20659](https://redirect.github.com/goauthentik/helm/issues/20659)
to version-2026.2) by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#20695](https://redirect.github.com/goauthentik/authentik/pull/20695)

**Full Changelog**:
<https://github.com/goauthentik/authentik/compare/version/2026.2.0...version/2026.2.1>

###
[`v2026.2.0`](https://redirect.github.com/goauthentik/helm/releases/tag/authentik-2026.2.0)

[Compare
Source](https://redirect.github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0)

authentik is an open-source Identity Provider focused on flexibility and
versatility

#### What's Changed

- charts/authentik: add fields auto-added by Kubernetes to httproute by
[@&#8203;cfi2017](https://redirect.github.com/cfi2017) in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)
- chore(deps): update helm/kind-action action to v1.14.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;454](https://redirect.github.com/goauthentik/helm/pull/454)
- charts/authentik: add note how to set version by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[#&#8203;456](https://redirect.github.com/goauthentik/helm/pull/456)
- charts/authentik: bump to 2026.2.0 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in [#&#8203;457](https://redirect.github.com/goauthentik/helm/pull/457)

#### New Contributors

- [@&#8203;cfi2017](https://redirect.github.com/cfi2017) made their
first contribution in
[#&#8203;453](https://redirect.github.com/goauthentik/helm/pull/453)

**Full Changelog**:
<https://github.com/goauthentik/helm/compare/authentik-2025.12.4...authentik-2026.2.0>

***

### Full release notes for authentik

See <https://docs.goauthentik.io/docs/releases/2026.2>

#### What's Changed

- root: bump version to 2026.2.0-rc1 by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18794](https://redirect.github.com/goauthentik/authentik/pull/18794)
- tests/e2e: retry detached shadow roots by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18796](https://redirect.github.com/goauthentik/authentik/pull/18796)
- website/release notes: Update v2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18797](https://redirect.github.com/goauthentik/authentik/pull/18797)
- web/admin: fix read-only provider selection for application form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18768](https://redirect.github.com/goauthentik/authentik/pull/18768)
- web: bump the react group across 1 directory with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18775](https://redirect.github.com/goauthentik/authentik/pull/18775)
- web: bump chromedriver from 143.0.0 to 143.0.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18776](https://redirect.github.com/goauthentik/authentik/pull/18776)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18774](https://redirect.github.com/goauthentik/authentik/pull/18774)
- internal: don't warn on empty outpost for embedded by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18786](https://redirect.github.com/goauthentik/authentik/pull/18786)
- lifecycle/aws: bump aws-cdk from 2.1033.0 to 2.1034.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18771](https://redirect.github.com/goauthentik/authentik/pull/18771)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18804](https://redirect.github.com/goauthentik/authentik/pull/18804)
- root: Add macOS support for sed in Makefile by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18795](https://redirect.github.com/goauthentik/authentik/pull/18795)
- ci: bump astral-sh/setup-uv from 7.1.5 to 7.1.6 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18826](https://redirect.github.com/goauthentik/authentik/pull/18826)
- ci: bump actions/upload-artifact from 5.0.0 to 6.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18824](https://redirect.github.com/goauthentik/authentik/pull/18824)
- core: bump goauthentik/fips-debian from `07f41ce` to `c10cd2c` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18822](https://redirect.github.com/goauthentik/authentik/pull/18822)
- ci: bump actions/download-artifact from 6.0.0 to 7.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18825](https://redirect.github.com/goauthentik/authentik/pull/18825)
- ci: bump actions/cache from 5.0.0 to 5.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18823](https://redirect.github.com/goauthentik/authentik/pull/18823)
- core: list applications fix by
[@&#8203;ryanpesek](https://redirect.github.com/ryanpesek) in
[goauthentik/authentik#18798](https://redirect.github.com/goauthentik/authentik/pull/18798)
- website/docs: add icon info to style guide by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18832](https://redirect.github.com/goauthentik/authentik/pull/18832)
- core: remove superuser check from `Token` list by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18684](https://redirect.github.com/goauthentik/authentik/pull/18684)
- packages/django-dramatiq-postgres: broker: close django connections on
consumer close by [@&#8203;rissson](https://redirect.github.com/rissson)
in
[goauthentik/authentik#18833](https://redirect.github.com/goauthentik/authentik/pull/18833)
- core: bump goauthentik.io/api/v3 from 3.2025120.26 to 3.2026020.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18815](https://redirect.github.com/goauthentik/authentik/pull/18815)
- admin/files: revert add check for /media existence
([#&#8203;18636](https://redirect.github.com/goauthentik/helm/issues/18636))
by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18829](https://redirect.github.com/goauthentik/authentik/pull/18829)
- website/docs: add jellyseer integration doc by
[@&#8203;gabay](https://redirect.github.com/gabay) in
[goauthentik/authentik#18812](https://redirect.github.com/goauthentik/authentik/pull/18812)
- crypto: Store details parsed from includeDetails in database instead
by [@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18013](https://redirect.github.com/goauthentik/authentik/pull/18013)
- core: skip s3 tests if endpoint isn't available by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18841](https://redirect.github.com/goauthentik/authentik/pull/18841)
- admin/files: fix get\_objects\_for\_user queryset argument in
FileUsedByView by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18845](https://redirect.github.com/goauthentik/authentik/pull/18845)
- core: bump goauthentik/fips-debian from `c10cd2c` to `2f19fc1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18856](https://redirect.github.com/goauthentik/authentik/pull/18856)
- ci: replace codecov test-results action by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18862](https://redirect.github.com/goauthentik/authentik/pull/18862)
- core: add skip s3\_test\_server\_available to
TestResolveFileUrlS3Backend by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18858](https://redirect.github.com/goauthentik/authentik/pull/18858)
- rbac: alter migrated direct permission roles by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18860](https://redirect.github.com/goauthentik/authentik/pull/18860)
- core: bump library/golang from `5d35fb8` to `8e8f9c8` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18855](https://redirect.github.com/goauthentik/authentik/pull/18855)
- web/admin/rbac: misc object permission fixes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18859](https://redirect.github.com/goauthentik/authentik/pull/18859)
- outposts: fix permission errors for related certificates by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18861](https://redirect.github.com/goauthentik/authentik/pull/18861)
- website/docs: adjust RBAC-related details in 2025.12 release notes by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18863](https://redirect.github.com/goauthentik/authentik/pull/18863)
- website/docs: Add docs for passkey autofill (WebauthN Conditional UI)
by [@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18805](https://redirect.github.com/goauthentik/authentik/pull/18805)
- website/docs: 2025.10.3 release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18868](https://redirect.github.com/goauthentik/authentik/pull/18868)
- web: add custom message with links for empty data export list by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18830](https://redirect.github.com/goauthentik/authentik/pull/18830)
- web: fix notification counter by
[@&#8203;atereshkin](https://redirect.github.com/atereshkin) in
[goauthentik/authentik#18781](https://redirect.github.com/goauthentik/authentik/pull/18781)
- web: bump vite from 7.2.7 to 7.3.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18854](https://redirect.github.com/goauthentik/authentik/pull/18854)
- stages/authenticator\_\*: fix code input field not string by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18875](https://redirect.github.com/goauthentik/authentik/pull/18875)
- web: fix file upload form by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18808](https://redirect.github.com/goauthentik/authentik/pull/18808)
- web/admin: endpoint: change wording and add helper text by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18871](https://redirect.github.com/goauthentik/authentik/pull/18871)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18807](https://redirect.github.com/goauthentik/authentik/pull/18807)
- website/integrations: bookstack: fix redir url by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18891](https://redirect.github.com/goauthentik/authentik/pull/18891)
- core: bump astral-sh/uv from 0.9.17 to 0.9.18 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18898](https://redirect.github.com/goauthentik/authentik/pull/18898)
- core: bump goauthentik/fips-debian from `2f19fc1` to `189345a` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18897](https://redirect.github.com/goauthentik/authentik/pull/18897)
- web: bump knip from 5.73.3 to 5.74.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18896](https://redirect.github.com/goauthentik/authentik/pull/18896)
- web: bump [@&#8203;types/node](https://redirect.github.com/types/node)
from 25.0.0 to 25.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18895](https://redirect.github.com/goauthentik/authentik/pull/18895)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18852](https://redirect.github.com/goauthentik/authentik/pull/18852)
- web: bump the bundler group across 1 directory with 7 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18894](https://redirect.github.com/goauthentik/authentik/pull/18894)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.30.0 to 10.31.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18893](https://redirect.github.com/goauthentik/authentik/pull/18893)
- lifecycle/aws: bump aws-cdk from 2.1034.0 to 2.1100.0 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18850](https://redirect.github.com/goauthentik/authentik/pull/18850)
- web: bump the goauthentik group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18819](https://redirect.github.com/goauthentik/authentik/pull/18819)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18818](https://redirect.github.com/goauthentik/authentik/pull/18818)
- web: bump the eslint group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18851](https://redirect.github.com/goauthentik/authentik/pull/18851)
- core: bump goauthentik.io/api/v3 from 3.2026020.1 to 3.2026020.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18892](https://redirect.github.com/goauthentik/authentik/pull/18892)
- tasks/middleware: close connections on worker status update database
error by [@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18881](https://redirect.github.com/goauthentik/authentik/pull/18881)
- website/docs: added list of Int Guide contributors (also edited
frontmatter) by [@&#8203;tanberry](https://redirect.github.com/tanberry)
in
[goauthentik/authentik#18888](https://redirect.github.com/goauthentik/authentik/pull/18888)
- api: fix page\_size with invalid query param by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18879](https://redirect.github.com/goauthentik/authentik/pull/18879)
- ci/release-tag: checkout correct branch for make test-docker by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18880](https://redirect.github.com/goauthentik/authentik/pull/18880)
- api: fix latest version for public schema by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18902](https://redirect.github.com/goauthentik/authentik/pull/18902)
- website/docs: 2025.12: remove superfluous changes by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18910](https://redirect.github.com/goauthentik/authentik/pull/18910)
- web/admin: reword some things on the device view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18785](https://redirect.github.com/goauthentik/authentik/pull/18785)
- core/groups: optimize prefetch queries to fetch only required fields
by [@&#8203;joaocfernandes](https://redirect.github.com/joaocfernandes)
in
[goauthentik/authentik#18448](https://redirect.github.com/goauthentik/authentik/pull/18448)
- root: fix docker-compose data mount by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18903](https://redirect.github.com/goauthentik/authentik/pull/18903)
- web/admin: add UI copy to RBAC modal by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#18917](https://redirect.github.com/goauthentik/authentik/pull/18917)
- tests/e2e: handle StaleElementReferenceException in
parse\_json\_content by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#18842](https://redirect.github.com/goauthentik/authentik/pull/18842)
- core: bump goauthentik/fips-debian from `189345a` to `10dadf1` by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18927](https://redirect.github.com/goauthentik/authentik/pull/18927)
- web: bump chromedriver from 143.0.1 to 143.0.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18926](https://redirect.github.com/goauthentik/authentik/pull/18926)
- web: bump knip from 5.74.0 to 5.75.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18924](https://redirect.github.com/goauthentik/authentik/pull/18924)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18920](https://redirect.github.com/goauthentik/authentik/pull/18920)
- lifecycle/aws: bump aws-cdk from 2.1100.0 to 2.1100.1 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18922](https://redirect.github.com/goauthentik/authentik/pull/18922)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18923](https://redirect.github.com/goauthentik/authentik/pull/18923)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18817](https://redirect.github.com/goauthentik/authentik/pull/18817)
- stages: remove more global state by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18641](https://redirect.github.com/goauthentik/authentik/pull/18641)
- packages/ak-guardian: cast safely by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18929](https://redirect.github.com/goauthentik/authentik/pull/18929)
- web/flow: Fix spurious double submit on ak-stage-autosubmit by
[@&#8203;dminuoso](https://redirect.github.com/dminuoso) in
[goauthentik/authentik#18727](https://redirect.github.com/goauthentik/authentik/pull/18727)
- website/integrations: Add launch URL for Immich by
[@&#8203;optix2000](https://redirect.github.com/optix2000) in
[goauthentik/authentik#18921](https://redirect.github.com/goauthentik/authentik/pull/18921)
- crypto: fix extra cert data in db migration by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#18937](https://redirect.github.com/goauthentik/authentik/pull/18937)
- web/elements: progress-bar and table loading header by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18934](https://redirect.github.com/goauthentik/authentik/pull/18934)
- stages/identification: replace sleep with make\_password by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18883](https://redirect.github.com/goauthentik/authentik/pull/18883)
- website/docs: endpoint devices by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18634](https://redirect.github.com/goauthentik/authentik/pull/18634)
- website/docs: Fix labels, Pre-Release detection by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18945](https://redirect.github.com/goauthentik/authentik/pull/18945)
- website/docs: release notes: add endpoint device links to 2025.12
notes by [@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18940](https://redirect.github.com/goauthentik/authentik/pull/18940)
- website/docs: Fix version parsing. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18948](https://redirect.github.com/goauthentik/authentik/pull/18948)
- web/admin: fix endpoints user binding by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18935](https://redirect.github.com/goauthentik/authentik/pull/18935)
- flows/executor: fix KeyError when session has no existing plan by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18951](https://redirect.github.com/goauthentik/authentik/pull/18951)
- root: move docker files to lifecycle/containers and change
docker-compose to compose by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#16624](https://redirect.github.com/goauthentik/authentik/pull/16624)
- core: bump goauthentik.io/api/v3 from 3.2026020.3 to 3.2026020.4 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18956](https://redirect.github.com/goauthentik/authentik/pull/18956)
- web: bump chromedriver from 143.0.2 to 143.0.3 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18959](https://redirect.github.com/goauthentik/authentik/pull/18959)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18958](https://redirect.github.com/goauthentik/authentik/pull/18958)
- web: bump
[@&#8203;sentry/browser](https://redirect.github.com/sentry/browser)
from 10.31.0 to 10.32.0 in /web in the sentry group across 1 directory
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18957](https://redirect.github.com/goauthentik/authentik/pull/18957)
- ci: bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18960](https://redirect.github.com/goauthentik/authentik/pull/18960)
- website/docs: add note to active directory source doc by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#18787](https://redirect.github.com/goauthentik/authentik/pull/18787)
- web/maintenance: fix missing custom web component imports by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18942](https://redirect.github.com/goauthentik/authentik/pull/18942)
- web/maintenance: no unknown tag names by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18944](https://redirect.github.com/goauthentik/authentik/pull/18944)
- website/integrations: Fix path for Cloudflare Access by
[@&#8203;stijn220](https://redirect.github.com/stijn220) in
[goauthentik/authentik#18979](https://redirect.github.com/goauthentik/authentik/pull/18979)
- blueprints: add InternallyManagedMixin instead of large list by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18983](https://redirect.github.com/goauthentik/authentik/pull/18983)
- web/admin: fix dark theme on map by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18985](https://redirect.github.com/goauthentik/authentik/pull/18985)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm by
[@&#8203;hskrtich](https://redirect.github.com/hskrtich) in
[goauthentik/authentik#18984](https://redirect.github.com/goauthentik/authentik/pull/18984)
- events: notifications live update by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18980](https://redirect.github.com/goauthentik/authentik/pull/18980)
- web: fix Open button selecting row instead of navigating by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18992](https://redirect.github.com/goauthentik/authentik/pull/18992)
- blueprints: fix flaky tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19002](https://redirect.github.com/goauthentik/authentik/pull/19002)
- ci: bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18999](https://redirect.github.com/goauthentik/authentik/pull/18999)
- providers/oauth2: Automated OpenID Conformance tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#14785](https://redirect.github.com/goauthentik/authentik/pull/14785)
- enterprise/reports: improve export list, confirmation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18981](https://redirect.github.com/goauthentik/authentik/pull/18981)
- enterprise/search: add static autocomplete structure by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19008](https://redirect.github.com/goauthentik/authentik/pull/19008)
- website/docs: improve endpoint devices docs by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19007](https://redirect.github.com/goauthentik/authentik/pull/19007)
- web: bump the rollup group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18994](https://redirect.github.com/goauthentik/authentik/pull/18994)
- core: bump openapitools/openapi-generator-cli from v7.16.0 to v7.18.0
in /scripts/api by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19018](https://redirect.github.com/goauthentik/authentik/pull/19018)
- web: bump globby from 16.0.0 to 16.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#18995](https://redirect.github.com/goauthentik/authentik/pull/18995)
- api: rework schema generation by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18977](https://redirect.github.com/goauthentik/authentik/pull/18977)
- web/admin: prevent file upload attempt when backend not managed by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#18646](https://redirect.github.com/goauthentik/authentik/pull/18646)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19019](https://redirect.github.com/goauthentik/authentik/pull/19019)
- core: bump goauthentik.io/api/v3 from 3.2026020.4 to 3.2026020.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19017](https://redirect.github.com/goauthentik/authentik/pull/19017)
- website/docs: Prioritize "Release Candidate" over "Current Release" by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18975](https://redirect.github.com/goauthentik/authentik/pull/18975)
- web: Locale selector UI fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#18972](https://redirect.github.com/goauthentik/authentik/pull/18972)
- web: Fix Storybook package resolution with `npm link` by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19016](https://redirect.github.com/goauthentik/authentik/pull/19016)
- core: use chunked\_queryset for expired message deletion by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19028](https://redirect.github.com/goauthentik/authentik/pull/19028)
- web/admin: use consistent icon for inactive user status by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19032](https://redirect.github.com/goauthentik/authentik/pull/19032)
- web: bump lit from 3.3.1 to 3.3.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19038](https://redirect.github.com/goauthentik/authentik/pull/19038)
- web: bump
[@&#8203;lit/reactive-element](https://redirect.github.com/lit/reactive-element)
from 2.1.1 to 2.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19037](https://redirect.github.com/goauthentik/authentik/pull/19037)
- web: bump knip from 5.75.1 to 5.77.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19041](https://redirect.github.com/goauthentik/authentik/pull/19041)
- core: bump goauthentik.io/api/v3 from 3.2026020.5 to 3.2026020.6 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19036](https://redirect.github.com/goauthentik/authentik/pull/19036)
- docs/release notes: update 2025.12 release notes by
[@&#8203;melizeche](https://redirect.github.com/melizeche) in
[goauthentik/authentik#19043](https://redirect.github.com/goauthentik/authentik/pull/19043)
- lib/sync: fix sync\_dispatch by
[@&#8203;krejcar25](https://redirect.github.com/krejcar25) in
[goauthentik/authentik#19053](https://redirect.github.com/goauthentik/authentik/pull/19053)
- endpoints/devices: cleanup by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19047](https://redirect.github.com/goauthentik/authentik/pull/19047)
- blueprints: set enrollment token key by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19061](https://redirect.github.com/goauthentik/authentik/pull/19061)
- website/integrations: Add Wallos by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19013](https://redirect.github.com/goauthentik/authentik/pull/19013)
- website/docs: FreeIPA documentation updates by
[@&#8203;borutmrak](https://redirect.github.com/borutmrak) in
[goauthentik/authentik#15183](https://redirect.github.com/goauthentik/authentik/pull/15183)
- \*: Auto compress images by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19065](https://redirect.github.com/goauthentik/authentik/pull/19065)
- blueprints: fix deadlock and task context error in MetaApplyBlueprint
by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19033](https://redirect.github.com/goauthentik/authentik/pull/19033)
- web: fix file search input not resetting results properly by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19034](https://redirect.github.com/goauthentik/authentik/pull/19034)
- website/integrations: owncloud: fix php by
[@&#8203;ocmateusz](https://redirect.github.com/ocmateusz) in
[goauthentik/authentik#19073](https://redirect.github.com/goauthentik/authentik/pull/19073)
- tests/e2e: add endpoint tests by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19072](https://redirect.github.com/goauthentik/authentik/pull/19072)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#18991](https://redirect.github.com/goauthentik/authentik/pull/18991)
- web: bump knip from 5.77.0 to 5.77.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19049](https://redirect.github.com/goauthentik/authentik/pull/19049)
- web: bump
[@&#8203;lit/localize-tools](https://redirect.github.com/lit/localize-tools)
from 0.8.0 to 0.8.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19040](https://redirect.github.com/goauthentik/authentik/pull/19040)
- internal: update TLS Suite by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19076](https://redirect.github.com/goauthentik/authentik/pull/19076)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 7.7.13 to 8.1.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19054](https://redirect.github.com/goauthentik/authentik/pull/19054)
- web/admin: fix button alignment on user view page by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19079](https://redirect.github.com/goauthentik/authentik/pull/19079)
- website/docs: endpoints: mention connector key required for stage to
work by [@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19084](https://redirect.github.com/goauthentik/authentik/pull/19084)
- website/docs: rel notes .12: add wallos by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19063](https://redirect.github.com/goauthentik/authentik/pull/19063)
- website/docs: endpoint devices: update features table by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19094](https://redirect.github.com/goauthentik/authentik/pull/19094)
- website/docs: endpoint devices: add path to macos setup by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19093](https://redirect.github.com/goauthentik/authentik/pull/19093)
- web: bump knip from 5.77.1 to 5.78.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19090](https://redirect.github.com/goauthentik/authentik/pull/19090)
- web: fix promoted source button hover losing blue color by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19048](https://redirect.github.com/goauthentik/authentik/pull/19048)
- web: Fix stale flow background by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19015](https://redirect.github.com/goauthentik/authentik/pull/19015)
- Update Vaultwarden documentation by removing warning by
[@&#8203;austin-dudzik](https://redirect.github.com/austin-dudzik) in
[goauthentik/authentik#19102](https://redirect.github.com/goauthentik/authentik/pull/19102)
- web/maintenance/no unknown attributes (part 1) by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18970](https://redirect.github.com/goauthentik/authentik/pull/18970)
- website/integrations: Add Pulse by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19105](https://redirect.github.com/goauthentik/authentik/pull/19105)
- website/integrations: Add Audiobookshelf by
[@&#8203;0skater0](https://redirect.github.com/0skater0) in
[goauthentik/authentik#19104](https://redirect.github.com/goauthentik/authentik/pull/19104)
- website/docs: release notes: Add more integrations by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19109](https://redirect.github.com/goauthentik/authentik/pull/19109)
- web: bump the storybook group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19111](https://redirect.github.com/goauthentik/authentik/pull/19111)
- core: bump library/nginx from `fb01117` to `ad85427` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19112](https://redirect.github.com/goauthentik/authentik/pull/19112)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19110](https://redirect.github.com/goauthentik/authentik/pull/19110)
- web: Fix Impersonation, Lit Reactive Controller Contexts by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19114](https://redirect.github.com/goauthentik/authentik/pull/19114)
- web: Capitalize language display names, code owner fix by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19119](https://redirect.github.com/goauthentik/authentik/pull/19119)
- core: bump library/nginx from `ad85427` to `ca871a8` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19126](https://redirect.github.com/goauthentik/authentik/pull/19126)
- web: bump the swc group across 1 directory with 11 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19124](https://redirect.github.com/goauthentik/authentik/pull/19124)
- core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19088](https://redirect.github.com/goauthentik/authentik/pull/19088)
- core: bump library/node from `ccfd9da` to `03729a7` in /website by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19125](https://redirect.github.com/goauthentik/authentik/pull/19125)
- core, web: bump qs from 6.14.0 to 6.14.1 in
/packages/docusaurus-config by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19130](https://redirect.github.com/goauthentik/authentik/pull/19130)
- website/integrations: karakeep: don't hardcode wellknown's slug by
[@&#8203;pippo73](https://redirect.github.com/pippo73) in
[goauthentik/authentik#19127](https://redirect.github.com/goauthentik/authentik/pull/19127)
- web: disable user settings fields when changes are not allowed by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19132](https://redirect.github.com/goauthentik/authentik/pull/19132)
- website/docs: endpoint agent release notes by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19042](https://redirect.github.com/goauthentik/authentik/pull/19042)
- website/docs: fix build by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19148](https://redirect.github.com/goauthentik/authentik/pull/19148)
- web: Token Form Fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19121](https://redirect.github.com/goauthentik/authentik/pull/19121)
- web/user: fix consent delete form missing details by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19147](https://redirect.github.com/goauthentik/authentik/pull/19147)
- web: bump globals from 16.5.0 to 17.0.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19154](https://redirect.github.com/goauthentik/authentik/pull/19154)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19135](https://redirect.github.com/goauthentik/authentik/pull/19135)
- ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19138](https://redirect.github.com/goauthentik/authentik/pull/19138)
- website/integrations: vaultwarden: add custom email scope by
[@&#8203;williamkray](https://redirect.github.com/williamkray) in
[goauthentik/authentik#19160](https://redirect.github.com/goauthentik/authentik/pull/19160)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid
blobs by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19137](https://redirect.github.com/goauthentik/authentik/pull/19137)
- core: handle deserialization errors from FileField migration by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19067](https://redirect.github.com/goauthentik/authentik/pull/19067)
- web: fix slug auto-updating when editing existing applications by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19169](https://redirect.github.com/goauthentik/authentik/pull/19169)
- web: Fix user library colors, modal z-indexes, table progress bars by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19152](https://redirect.github.com/goauthentik/authentik/pull/19152)
- web/admin: adjust sync threshold, add tooltip by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19131](https://redirect.github.com/goauthentik/authentik/pull/19131)
- website/docs: remove duplicates in slo docs by
[@&#8203;nmasnadithya](https://redirect.github.com/nmasnadithya) in
[goauthentik/authentik#19170](https://redirect.github.com/goauthentik/authentik/pull/19170)
- lifecycle: fix migration conn\_options for psycopg connection by
[@&#8203;D-Tasker207](https://redirect.github.com/D-Tasker207) in
[goauthentik/authentik#19134](https://redirect.github.com/goauthentik/authentik/pull/19134)
- web: bump knip from 5.78.0 to 5.79.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19181](https://redirect.github.com/goauthentik/authentik/pull/19181)
- ci: bump getsentry/action-release from 3.4.0 to 3.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19183](https://redirect.github.com/goauthentik/authentik/pull/19183)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.0 to 8.1.1 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19182](https://redirect.github.com/goauthentik/authentik/pull/19182)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19179](https://redirect.github.com/goauthentik/authentik/pull/19179)
- lib: update error logging by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#18628](https://redirect.github.com/goauthentik/authentik/pull/18628)
- website/integrations: make grafana terraform section expand by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19192](https://redirect.github.com/goauthentik/authentik/pull/19192)
- core: add prettier failure on duplicate group names by
[@&#8203;gergosimonyi](https://redirect.github.com/gergosimonyi) in
[goauthentik/authentik#18941](https://redirect.github.com/goauthentik/authentik/pull/18941)
- web/maintenance: no missing element type definitions by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18950](https://redirect.github.com/goauthentik/authentik/pull/18950)
- root: codespell: ignore Python virtual env, group patterns. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19180](https://redirect.github.com/goauthentik/authentik/pull/19180)
- web: Merge branch -- Stale notifications, synchronized context
objects, rendering fixes by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19141](https://redirect.github.com/goauthentik/authentik/pull/19141)
- website/docs: Add docs for roles by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19196](https://redirect.github.com/goauthentik/authentik/pull/19196)
- web: Defer table refresh, visibility checks. by
[@&#8203;GirlBossRush](https://redirect.github.com/GirlBossRush) in
[goauthentik/authentik#19194](https://redirect.github.com/goauthentik/authentik/pull/19194)
- rbac: Add show all to roles tab, add role tab to groups by
[@&#8203;PeshekDotDev](https://redirect.github.com/PeshekDotDev) in
[goauthentik/authentik#19097](https://redirect.github.com/goauthentik/authentik/pull/19097)
- website/docs: rewrite section about users and perms by
[@&#8203;tanberry](https://redirect.github.com/tanberry) in
[goauthentik/authentik#19195](https://redirect.github.com/goauthentik/authentik/pull/19195)
- core: add last\_login filter to users API by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#18993](https://redirect.github.com/goauthentik/authentik/pull/18993)
- web: bump the eslint group across 1 directory with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19205](https://redirect.github.com/goauthentik/authentik/pull/19205)
- admin/files: support %(theme)s variable in media file paths by
[@&#8203;dominic-r](https://redirect.github.com/dominic-r) in
[goauthentik/authentik#19108](https://redirect.github.com/goauthentik/authentik/pull/19108)
- website/integrations: glpi: add step by
[@&#8203;dewi-tik](https://redirect.github.com/dewi-tik) in
[goauthentik/authentik#19208](https://redirect.github.com/goauthentik/authentik/pull/19208)
- web: bump knip from 5.79.0 to 5.80.0 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19207](https://redirect.github.com/goauthentik/authentik/pull/19207)
- core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19204](https://redirect.github.com/goauthentik/authentik/pull/19204)
- lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in
/lifecycle/aws by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19203](https://redirect.github.com/goauthentik/authentik/pull/19203)
- core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19202](https://redirect.github.com/goauthentik/authentik/pull/19202)
- translate: Updates for project authentik and language pt\_BR by
[@&#8203;transifex-integration](https://redirect.github.com/transifex-integration)\[bot]
in
[goauthentik/authentik#19082](https://redirect.github.com/goauthentik/authentik/pull/19082)
- web/maintenance: lint pass to add missing HTMLElementEventMap entries
by
[@&#8203;kensternberg-authentik](https://redirect.github.com/kensternberg-authentik)
in
[goauthentik/authentik#18953](https://redirect.github.com/goauthentik/authentik/pull/18953)
- outpost/proxyv2: reduce max number of postgres connections by
[@&#8203;rissson](https://redirect.github.com/rissson) in
[goauthentik/authentik#19211](https://redirect.github.com/goauthentik/authentik/pull/19211)
- core, web: update translations by
[@&#8203;authentik-automation](https://redirect.github.com/authentik-automation)\[bot]
in
[goauthentik/authentik#19200](https://redirect.github.com/goauthentik/authentik/pull/19200)
- website/docs: revisit endpoint docs the nth by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19116](https://redirect.github.com/goauthentik/authentik/pull/19116)
- ci: bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in
/.github/actions/setup by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19221](https://redirect.github.com/goauthentik/authentik/pull/19221)
- endpoints: include license status in agent config by
[@&#8203;BeryJu](https://redirect.github.com/BeryJu) in
[goauthentik/authentik#19227](https://redirect.github.com/goauthentik/authentik/pull/19227)
- web: bump
[@&#8203;formatjs/intl-listformat](https://redirect.github.com/formatjs/intl-listformat)
from 8.1.1 to 8.1.2 in /web by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[goauthentik/authentik#19220](https://redirect.github.com/goauthentik/authentik/pull/19220)
- lifecycle/aws: bump aws-cdk from 2.1100.2 to 2.1100.3 in
/lifecycle/aws by [@

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Only on Sunday and Saturday ( * * * *
0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/fgeck/homelab-k3s).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDguMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvbWFqb3IiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant