ChangeLog: https://docs.goauthentik.io/releases/2025.12

⚠️ When using the Avatar upload, you'll have to make your users
re-upload their avatars due to changes in how media is served by
Authentik[1].

For now, we're using a branch from me that is 2025.12.1 with an update
of `@goauthentik/api` on top[2]. Without that change, `AdminFileListUsageEnum`
doesn't exist which breaks all usage of `AdminFileListUsageEnum.Media`:

  TypeError: can't access property "Media", R.AdminFileListUsageEnum is undefined
    renderForm ApplicationForm.ts:191
    [...]

This made e.g. the modal to edit applications unusable which infinitely
hang on a loading spinner.

The media path now points to `/var/lib/authentik`. This path is only
used for media storage and Authentik now always appends the "usage name"
as directory behind the storage path, i.e. it already appends
`/var/lib/authentik/media`, so this is needed to make Authentik discover
existing media.

Finally, I added a `patches` attribute to the authentik scope that
applies patches to both the workdir-deps (which is the PYTHONPATH in the
end, i.e. where we load the authentik module from) and the gopkgs. We're
still missing patchability for frontend (since we directly build the
subdir in napalm), but I think that's a step in the right direction.

[1] goauthentik/authentik#6824 (comment)
[2] Upstream PR: goauthentik/authentik#19542

Closes #83

ChangeLog: https://docs.goauthentik.io/releases/2025.12

⚠️ When using the Avatar upload, you'll have to make your users
re-upload their avatars due to changes in how media is served by
Authentik[1].

For now, we're using a branch from me that is 2025.12.1 with an update
of `@goauthentik/api` on top[2]. Without that change, `AdminFileListUsageEnum`
doesn't exist which breaks all usage of `AdminFileListUsageEnum.Media`:

  TypeError: can't access property "Media", R.AdminFileListUsageEnum is undefined
    renderForm ApplicationForm.ts:191
    [...]

This made e.g. the modal to edit applications unusable which infinitely
hang on a loading spinner.

The media path now points to `/var/lib/authentik`. This path is only
used for media storage and Authentik now always appends the "usage name"
as directory behind the storage path, i.e. it already appends
`/var/lib/authentik/media`, so this is needed to make Authentik discover
existing media.

Finally, I added a `patches` attribute to the authentik scope that
applies patches to both the workdir-deps (which is the PYTHONPATH in the
end, i.e. where we load the authentik module from) and the gopkgs. We're
still missing patchability for frontend (since we directly build the
subdir in napalm), but I think that's a step in the right direction.

[1] goauthentik/authentik#6824 (comment)
[2] Upstream PR: goauthentik/authentik#19542

Closes #83

ChangeLog: https://docs.goauthentik.io/releases/2025.12

⚠️ When using the Avatar upload, you'll have to make your users
re-upload their avatars due to changes in how media is served by
Authentik[1].

For now, we're using a branch from me that is 2025.12.1 with an update
of `@goauthentik/api` on top[2]. Without that change, `AdminFileListUsageEnum`
doesn't exist which breaks all usage of `AdminFileListUsageEnum.Media`:

    TypeError: can't access property "Media", R.AdminFileListUsageEnum is undefined
      renderForm ApplicationForm.ts:191
      [...]

This made e.g. the modal to edit applications unusable which infinitely
hang on a loading spinner.

The media path now points to `/var/lib/authentik`. This path is only
used for media storage and Authentik now always appends the "usage name"
as directory behind the storage path, i.e. it already appends
`/var/lib/authentik/media`, so this is needed to make Authentik discover
existing media.

Finally, I added a `patches` attribute to the authentik scope that
applies patches to both the workdir-deps (which is the PYTHONPATH in the
end, i.e. where we load the authentik module from) and the gopkgs. We're
still missing patchability for frontend (since we directly build the
subdir in napalm), but I think that's a step in the right direction.

[1] goauthentik/authentik#6824 (comment)
[2] Upstream PR: goauthentik/authentik#19542

Closes #83
Closes #85

ChangeLog: https://docs.goauthentik.io/releases/2025.12

⚠️ When using the Avatar upload, you'll have to make your users
re-upload their avatars due to changes in how media is served by
Authentik[1].

For now, we're using a branch from me that is 2025.12.1 with an update
of `@goauthentik/api` on top[2]. Without that change, `AdminFileListUsageEnum`
doesn't exist which breaks all usage of `AdminFileListUsageEnum.Media`:

    TypeError: can't access property "Media", R.AdminFileListUsageEnum is undefined
      renderForm ApplicationForm.ts:191
      [...]

This made e.g. the modal to edit applications unusable which infinitely
hang on a loading spinner.

The media path now points to `/var/lib/authentik`. This path is only
used for media storage and Authentik now always appends the "usage name"
as directory behind the storage path, i.e. it already appends
`/var/lib/authentik/media`, so this is needed to make Authentik discover
existing media.

Finally, I added a `patches` attribute to the authentik scope that
applies patches to both the workdir-deps (which is the PYTHONPATH in the
end, i.e. where we load the authentik module from) and the gopkgs. We're
still missing patchability for frontend (since we directly build the
subdir in napalm), but I think that's a step in the right direction.

[1] goauthentik/authentik#6824 (comment)
[2] Upstream PR: goauthentik/authentik#19542

Closes #83
Closes #85

ChangeLog: https://docs.goauthentik.io/releases/2025.12

⚠️ When using the Avatar upload, you'll have to make your users
re-upload their avatars due to changes in how media is served by
Authentik[1].

For now, we're using a branch from me that is 2025.12.1 with an update
of `@goauthentik/api` on top[2]. Without that change, `AdminFileListUsageEnum`
doesn't exist which breaks all usage of `AdminFileListUsageEnum.Media`:

    TypeError: can't access property "Media", R.AdminFileListUsageEnum is undefined
      renderForm ApplicationForm.ts:191
      [...]

This made e.g. the modal to edit applications unusable which infinitely
hang on a loading spinner.

The media path now points to `/var/lib/authentik`. This path is only
used for media storage and Authentik now always appends the "usage name"
as directory behind the storage path, i.e. it already appends
`/var/lib/authentik/media`, so this is needed to make Authentik discover
existing media.

Finally, I added a `patches` attribute to the authentik scope that
applies patches to both the workdir-deps (which is the PYTHONPATH in the
end, i.e. where we load the authentik module from) and the gopkgs. We're
still missing patchability for frontend (since we directly build the
subdir in napalm), but I think that's a step in the right direction.

[1] goauthentik/authentik#6824 (comment)
[2] Upstream PR: goauthentik/authentik#19542

Otherwise, e.g. the edit modal of Applications hangs infinitely on a
loading spinner because `AdminFileListUsageEnum` is undefined and not an
object.

…19589)

web: update @goauthentik/api (#19542)

Otherwise, e.g. the edit modal of Applications hangs infinitely on a
loading spinner because `AdminFileListUsageEnum` is undefined and not an
object.

Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>

* main: (191 commits)
  sources/saml: Fix signature verification order to accommodate encrypted assertions (#19593)
  providers/saml: fix structure of encrypted saml assertion (#19592)
  providers/saml: allow encryption certificates without private keys (#19526)
  integrations: add saml steps to mattermost (#19590)
  policies: fix Provider's authentication_flow not used when set (#19609)
  web: bump type-fest from 5.4.0 to 5.4.1 in /web (#19473)
  endpoints: fix endpoints stage marked as enterprise (#19607)
  core: bump selenium from 4.39.0 to 4.40.0 (#19564)
  core: bump goauthentik.io/api/v3 from 3.2026020.11 to 3.2026020.12 (#19594)
  core: bump openapitools/openapi-generator-cli from v7.18.0 to v7.19.0 in /scripts/api (#19595)
  core: bump fido2 from 2.1.0 to 2.1.1 (#19596)
  web: bump @sentry/browser from 10.34.0 to 10.35.0 in /web in the sentry group across 1 directory (#19597)
  core: bump aws-cdk-lib from 2.235.0 to 2.235.1 (#19598)
  web: bump the eslint group across 1 directory with 3 updates (#19599)
  web: bump the rollup group across 1 directory with 4 updates (#19600)
  web: bump the swc group across 1 directory with 12 updates (#19601)
  web: bump pino from 10.2.0 to 10.2.1 in /web (#19602)
  web: bump knip from 5.81.0 to 5.82.1 in /web (#19603)
  tests: improve e2e/integration test reliability (#19540)
  web: update @goauthentik/api (#19542)
  ...

Otherwise, e.g. the edit modal of Applications hangs infinitely on a
loading spinner because `AdminFileListUsageEnum` is undefined and not an
object.