* main: (43 commits)
  core, web: update translations (#11858)
  web/admin: fix code-based MFA toggle not working in wizard (#11854)
  sources/kerberos: add kiprop to ignored system principals (#11852)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#11846)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in it (#11845)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#11847)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#11848)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#11849)
  translate: Updates for file web/xliff/en.xlf in it (#11850)
  website: 2024.10 Release Notes (#11839)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#11814)
  core, web: update translations (#11821)
  core: bump goauthentik.io/api/v3 from 3.2024083.13 to 3.2024083.14 (#11830)
  core: bump service-identity from 24.1.0 to 24.2.0 (#11831)
  core: bump twilio from 9.3.5 to 9.3.6 (#11832)
  core: bump pytest-randomly from 3.15.0 to 3.16.0 (#11833)
  website/docs: Update social-logins github (#11822)
  website/docs: remove � (#11823)
  lifecycle: fix kdc5-config missing (#11826)
  website/docs: update preview status of different features (#11817)
  ...

* main:
  website: bump elliptic from 6.5.7 to 6.6.0 in /website (#11869)
  core: bump selenium from 4.25.0 to 4.26.0 (#11875)
  core: bump goauthentik.io/api/v3 from 3.2024083.14 to 3.2024100.1 (#11876)
  website/docs: add info about invalidation flow, default flows in general (#11800)
  website: fix docs redirect (#11873)
  website: remove RC disclaimer for version 2024.10 (#11871)
  website: update supported versions (#11841)
  web: bump API Client version (#11870)
  root: backport version bump 2024.10.0 (#11868)
  website/docs: 2024.8.4 release notes (#11862)
  web/admin: provide default invalidation flows for LDAP and Radius (#11861)

* main:
  core: add `None` check to a device's `extra_description` (#11904)
  providers/oauth2: fix size limited index for tokens (#11879)
  web: fix missing status code on failed build (#11903)
  website: bump docusaurus-theme-openapi-docs from 4.1.0 to 4.2.0 in /website (#11897)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in de (#11891)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#11884)
  translate: Updates for file web/xliff/en.xlf in tr (#11878)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in tr (#11866)
  core: bump google-api-python-client from 2.149.0 to 2.151.0 (#11885)
  core: bump selenium from 4.26.0 to 4.26.1 (#11886)
  core, web: update translations (#11896)
  website: bump docusaurus-plugin-openapi-docs from 4.1.0 to 4.2.0 in /website (#11898)
  core: bump watchdog from 5.0.3 to 6.0.0 (#11899)
  core: bump ruff from 0.7.1 to 0.7.2 (#11900)
  core: bump django-pglock from 1.6.2 to 1.7.0 (#11901)
  website/docs: fix release notes to say Federation (#11889)

* main:
  web: bump API Client version (#11909)
  enterprise/rac: fix API Schema for invalidation_flow (#11907)

* main:
  website/docs: fix slug matching redirect URI causing broken refresh (#11950)
  website/integrations: jellyfin: update plugin catalog location (#11948)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in de (#11942)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#11946)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#11947)
  website/docs: clarify traefik ingress setup (#11938)
  core: bump importlib-metadata from 8.4.0 to 8.5.0 (#11934)
  web: bump API Client version (#11930)
  root: backport version bump `2024.10.1` (#11929)
  website/docs: `2024.10.1` Release Notes (#11926)
  website: bump path-to-regexp from 1.8.0 to 1.9.0 in /website (#11924)
  core: bump sentry-sdk from 2.17.0 to 2.18.0 (#11918)
  website: bump the docusaurus group in /website with 9 updates (#11917)
  core: bump goauthentik.io/api/v3 from 3.2024100.1 to 3.2024100.2 (#11915)
  core, web: update translations (#11914)

* main:
  ci: fix dockerfile warning (#11956)

* main: (21 commits)
  web: bump API Client version (#11997)
  sources/kerberos: use new python-kadmin implementation (#11932)
  core: add ability to provide reason for impersonation (#11951)
  website/integrations:  update vcenter integration docs (#11768)
  core, web: update translations (#11995)
  website: bump postcss from 8.4.48 to 8.4.49 in /website (#11996)
  web: bump API Client version (#11992)
  blueprints: add default Password policy (#11793)
  stages/captcha: Run interactive captcha in Frame (#11857)
  core, web: update translations (#11979)
  core: bump packaging from 24.1 to 24.2 (#11985)
  core: bump ruff from 0.7.2 to 0.7.3 (#11986)
  core: bump msgraph-sdk from 1.11.0 to 1.12.0 (#11987)
  website: bump the docusaurus group in /website with 9 updates (#11988)
  website: bump postcss from 8.4.47 to 8.4.48 in /website (#11989)
  stages/password: use recovery flow from brand (#11953)
  core: bump golang.org/x/sync from 0.8.0 to 0.9.0 (#11962)
  web: bump cookie, swagger-client and express in /web (#11966)
  core, web: update translations (#11959)
  core: bump debugpy from 1.8.7 to 1.8.8 (#11961)
  ...

* main:
  providers/ldap: fix global search_full_directory permission not being sufficient (#12028)
  website/docs: 2024.10.2 release notes (#12025)
  lifecycle: fix ak exit status not being passed (#12024)
  core: use versioned_script for path only (#12003)
  core, web: update translations (#12020)
  core: bump google-api-python-client from 2.152.0 to 2.153.0 (#12021)
  providers/oauth2: fix manual device code entry (#12017)
  crypto: validate that generated certificate's name is unique (#12015)
  core, web: update translations (#12006)
  core: bump google-api-python-client from 2.151.0 to 2.152.0 (#12007)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#12011)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#12010)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#12012)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#12013)
  providers/proxy: fix Issuer when AUTHENTIK_HOST_BROWSER is set (#11968)
  website/docs: move S3 ad GeoIP to System Management/Operations (#11998)
  website/integrations: nextcloud: add SSE warning (#11976)

* main:
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#12045)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#12047)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#12044)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#12046)
  web/flows: fix invisible captcha call (#12048)
  rbac: fix incorrect object_description for object-level permissions (#12029)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#12036)
  core: bump coverage from 7.6.4 to 7.6.5 (#12037)
  ci: bump codecov/codecov-action from 4 to 5 (#12038)
  release: 2024.10.2 (#12031)

* main: (28 commits)
  providers/scim: accept string and int for SCIM IDs (#12093)
  website: bump the docusaurus group in /website with 9 updates (#12086)
  core: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (#12080)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in de (#12079)
  scripts: remove read_replicas from generated dev config (#12078)
  core: bump geoip2 from 4.8.0 to 4.8.1 (#12071)
  core: bump goauthentik.io/api/v3 from 3.2024100.2 to 3.2024102.2 (#12072)
  core: bump maxmind/geoipupdate from v7.0.1 to v7.1.0 (#12073)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#12074)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#12075)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#12076)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#12077)
  web/admin: auto-prefill user path for new users based on selected path (#12070)
  core: bump aiohttp from 3.10.2 to 3.10.11 (#12069)
  web/admin: fix brand title not respected in application list (#12068)
  core: bump pyjwt from 2.9.0 to 2.10.0 (#12063)
  web: add italian locale (#11958)
  web/admin: better footer links (#12004)
  core, web: update translations (#12052)
  core: bump twilio from 9.3.6 to 9.3.7 (#12061)
  ...

* main: (33 commits)
  ci: mirror repo to internal repo (#12160)
  core: bump goauthentik.io/api/v3 from 3.2024102.2 to 3.2024104.1 (#12149)
  core: bump debugpy from 1.8.8 to 1.8.9 (#12150)
  core: bump webauthn from 2.2.0 to 2.3.0 (#12151)
  core: bump pydantic from 2.10.0 to 2.10.1 (#12152)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#12156)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#12157)
  core: bump sentry-sdk from 2.18.0 to 2.19.0 (#12153)
  web: bump API Client version (#12147)
  root: Backport version change (#12146)
  website/docs: update info about footer links to match new UI (#12120)
  website/docs: prepare release notes (#12142)
  providers/oauth2: fix migration (#12138)
  providers/oauth2: fix migration dependencies (#12123)
  web: bump API Client version (#12129)
  providers/oauth2: fix redirect uri input (#12122)
  providers/proxy: fix redirect_uri (#12121)
  website/docs: prepare release notes (#12119)
  web: bump API Client version (#12118)
  security: fix CVE 2024 52289 (#12113)
  ...

* main:
  ci: only mirror if secret is available (#12181)
  root: fix database ssl options not set correctly (#12180)
  core, web: update translations (#12145)
  core: bump tornado from 6.4.1 to 6.4.2 (#12165)
  website: bump the docusaurus group in /website with 9 updates (#12172)
  website: bump typescript from 5.6.3 to 5.7.2 in /website (#12173)
  ci: bump actions/checkout from 3 to 4 (#12174)
  core: bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12175)
  core: bump coverage from 7.6.7 to 7.6.8 (#12176)
  core: bump ruff from 0.7.4 to 0.8.0 (#12177)

* main:
  website/docs: Fix CSP syntax (#12124)

* main:
  website/docs: Add note about single group per role (#12169)
  website/docs: Fix documentation about attribute merging for indirect membership (#12168)
  root: support running authentik in subpath (#8675)
  docs: fix contribution link (#12189)
  core, web: update translations (#12190)
  core: Bump msgraph-sdk from 1.12.0 to 1.13.0 (#12191)
  core: Bump selenium from 4.26.1 to 4.27.0 (#12192)

* main: (31 commits)
  web/admin: bugfix: dual select initialization revision (#12051)
  web: update tests for Chromedriver 131 (#12199)
  website/integrations: add Aruba Orchestrator (#12220)
  core: bump aws-cdk-lib from 2.167.1 to 2.171.1 (#12237)
  website: bump aws-cdk from 2.167.1 to 2.171.1 in /website (#12241)
  core, web: update translations (#12236)
  core: bump python-kadmin-rs from 0.2.0 to 0.3.0 (#12238)
  core: bump pytest from 8.3.3 to 8.3.4 (#12239)
  core: bump drf-spectacular from 0.27.2 to 0.28.0 (#12240)
  core, web: update translations (#12222)
  core: Bump ruff from 0.8.0 to 0.8.1 (#12224)
  core: Bump ua-parser from 0.18.0 to 1.0.0 (#12225)
  core: Bump msgraph-sdk from 1.13.0 to 1.14.0 (#12226)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#12234)
  website/docs: install: add aws (#12082)
  core: Bump pyjwt from 2.10.0 to 2.10.1 (#12217)
  core: Bump fido2 from 1.1.3 to 1.2.0 (#12218)
  core: Bump cryptography from 43.0.3 to 44.0.0 (#12219)
  providers/oauth2: allow m2m for JWKS without alg in keys (#12196)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in fr (#12210)
  ...

* main:
  web: simplify `?inline` handler for Storybook (#12246)
  website/docs: Update Traefik middleware example to reflect latest version of Traefik (#12267)
  website/docs: add . in https://netbird.company* (#12166)
  core: bump goauthentik.io/api/v3 from 3.2024104.1 to 3.2024104.2 (#12263)
  core: bump pydantic from 2.10.2 to 2.10.3 (#12262)
  core: bump github.com/getsentry/sentry-go from 0.29.1 to 0.30.0 (#12264)
  core, web: update translations (#12268)
  website: bump @types/react from 18.3.12 to 18.3.13 in /website (#12269)
  website: bump prettier from 3.4.1 to 3.4.2 in /website (#12270)
  ci: bump actions/attest-build-provenance from 1 to 2 (#12271)
  core: bump golang.org/x/sync from 0.9.0 to 0.10.0 (#12272)
  core: bump django from 5.0.9 to 5.0.10 (#12273)
  core: bump webauthn from 2.3.0 to 2.4.0 (#12274)
  website/integrations: add The Lounge (#11971)
  core: bump python-kadmin-rs from 0.3.0 to 0.4.0 (#12257)
  root: fix health status code (#12255)
  ci: fix should_push always being false (#12252)
  web: bump API Client version (#12251)
  providers/oauth2: Add provider federation between OAuth2 Providers (#12083)
  website/integrations: mastodon: set correct uid field (#11945)

* main:
  website/docs: add page about the Cobalt pentest (#12249)
  core: bump aws-cdk-lib from 2.171.1 to 2.172.0 (#12296)
  website: bump aws-cdk from 2.171.1 to 2.172.0 in /website (#12295)
  core: bump sentry-sdk from 2.19.1 to 2.19.2 (#12297)
  core: bump coverage from 7.6.8 to 7.6.9 (#12299)
  core, web: update translations (#12290)
  root: fix override locale only if it is not empty (#12283)
  translate: Updates for file web/xliff/en.xlf in fr (#12276)
  core: bump twilio from 9.3.7 to 9.3.8 (#12282)
  website: bump path-to-regexp and express in /website (#12279)
  core: bump sentry-sdk from 2.19.0 to 2.19.1 (#12280)
  core: bump ruff from 0.8.1 to 0.8.2 (#12281)
  website/docs: fix lint (#12287)
  website/integrations: netbird: fix redirect URI regex (#12284)

* main:
  flows: better test stage's challenge responses (#12316)
  enterprise/stages/authenticator_endpoint_gdtc: don't set frame options globally (#12311)
  stages/identification: fix invalid challenge warning when no captcha stage is set (#12312)
  website/docs: prepare 2024.10.5 release notes (#12309)
  website: bump nanoid from 3.3.7 to 3.3.8 in /website (#12307)
  flows: silent authz flow (#12213)
  root:  use healthcheck in depends_on for postgres and redis (#12301)
  ci: ensure mark jobs always run and reflect correct status (#12288)
  enterprise: allow deletion/modification of users when in read-only mode (#12289)
  web/flows: resize captcha iframes (#12260)

* main: (118 commits)
  outposts: fix version label (#12486)
  web: only load version context when authenticated (#12482)
  core: bump goauthentik.io/api/v3 from 3.2024120.2 to 3.2024121.2 (#12478)
  ci: bump helm/kind-action from 1.11.0 to 1.12.0 (#12479)
  web: fix build dev build (#12473)
  root: fix dev build version being invalid semver (#12472)
  internal: fix missing trailing slash in outpost websocket (#12470)
  web: bump API Client version (#12469)
  admin: monitor worker version (#12463)
  core: bump jinja2 from 3.1.4 to 3.1.5 (#12467)
  web: bump API Client version (#12468)
  release: 2024.12.1 (#12466)
  web: misc fixes for admin and flow inspector (#12461)
  website/docs: 2024.12.1 release notes (#12462)
  core: bump goauthentik.io/api/v3 from 3.2024120.1 to 3.2024120.2 (#12456)
  core: bump urllib3 from 2.2.3 to 2.3.0 (#12457)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#12454)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#12453)
  translate: Updates for file web/xliff/en.xlf in zh-Hans (#12455)
  translate: Updates for file web/xliff/en.xlf in zh_CN (#12458)
  ...

…ing.

\# What

\# Why

\# How

\# Designs

\# Test Steps

\# Other Notes

…rom failing."

This reverts commit dddde09.

* main:
  website/integrations: meshcentral: document (#12509)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#12524)
  core: bump goauthentik.io/api/v3 from 3.2024121.2 to 3.2024121.3 (#12522)
  web: bump API Client version (#12520)
  website/integrations: chronograf: document (#12474)
  website/integrations: update preparation placeholder (#12507)
  providers/saml: fix handle Accept: application/xml for SAML Metadata endpoint (#12483) (#12518)
  core: bump aws-cdk-lib from 2.173.3 to 2.173.4 (#12513)
  website: bump aws-cdk from 2.173.3 to 2.173.4 in /website (#12514)
  core: bump coverage from 7.6.9 to 7.6.10 (#12499)
  core: bump aws-cdk-lib from 2.173.2 to 2.173.3 (#12500)
  website: bump aws-cdk from 2.173.2 to 2.173.3 in /website (#12501)
  core: bump github.com/go-ldap/ldap/v3 from 3.4.9 to 3.4.10 (#12502)
  website/docs: New "Whats Up Docker" URL (#12488)

* main:
  core: bump github.com/getsentry/sentry-go from 0.30.0 to 0.31.1 (#12543)
  core: bump google-api-python-client from 2.156.0 to 2.157.0 (#12544)
  core: bump ruff from 0.8.4 to 0.8.5 (#12545)
  core: bump msgraph-sdk from 1.15.0 to 1.16.0 (#12546)
  Update index.mdx (#12542)
  web: fix source selection and outpost integration health (#12530)
  Ading a step to paperless guide (#12539)
  website/integrations: Semaphore (#12515)
  website/integrations: komga: document (#12476)
  website/integrations: fix missing quote in paperless-ngx (#12537)
  website/integrations: cloudflare access: upd placeholder for saas (#12536)
  website/integrations: veeam-enterprise-manager: don't hardcode helpcenter doc version (#12538)

* main:
  core: bump golang.org/x/oauth2 from 0.24.0 to 0.25.0 (#12571)
  website: bump the docusaurus group in /website with 9 updates (#12569)
  core: bump github.com/coreos/go-oidc/v3 from 3.11.0 to 3.12.0 (#12572)
  core: bump ruff from 0.8.5 to 0.8.6 (#12573)
  ci: release: fix AWS cfn template permissions (#12576)
  translate: Updates for file web/xliff/en.xlf in fr (#12578)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in fr (#12577)
  sources/kerberos: authenticate with the user's username instead of the first username in authentik (#12497)
  website/integrations: Fix deprecated terraform ressource authentik_scope_mapping in docs (#12554)
  website/user-sources Fix Free IPA docs page (#12549)
  core: bump aws-cdk-lib from 2.173.4 to 2.174.0 (#12574)
  website/integrations: semaphore: fix formatting (#12567)
  website: bump aws-cdk from 2.173.4 to 2.174.0 in /website (#12570)
  website/integrations: Update Frappe Application index.md (#12527)
  website: add api reference docs to redirect file (#12551)

* main:
  lib: add expression helper ak_create_jwt to create JWTs (#12599)
  api: cleanup owner permissions (#12598)
  website: bump aws-cdk from 2.174.0 to 2.174.1 in /website (#12593)
  core: bump aws-cdk-lib from 2.174.0 to 2.174.1 (#12594)
  website/integrations: portainer: group config steps (#12548)
  translate: Updates for file web/xliff/en.xlf in fi (#12586)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in fi (#12584)
  website/docs: fix Nginx redirection example (#12561)

* main:
  website: revise full development environment instructions (#12638)
  website: bump typescript from 5.7.2 to 5.7.3 in /website (#12620)
  website: bump aws-cdk from 2.174.1 to 2.175.0 in /website (#12621)
  ci: bump docker/setup-qemu-action from 3.2.0 to 3.3.0 (#12622)
  core: bump twilio from 9.4.1 to 9.4.2 (#12623)
  core: bump python-kadmin-rs from 0.5.2 to 0.5.3 (#12624)
  core: bump ruff from 0.8.6 to 0.9.0 (#12625)
  core: bump pydantic from 2.10.4 to 2.10.5 (#12626)
  core: bump google-api-python-client from 2.157.0 to 2.158.0 (#12628)
  core: bump goauthentik.io/api/v3 from 3.2024121.3 to 3.2024122.1 (#12629)
  web: bump API Client version (#12617)
  release: 2024.12.2 (#12615)
  website/docs: prepare 2024.12.2 release notes (#12614)
  providers/saml: fix invalid SAML Response when assertion and response are signed (#12611)
  core: fix error when creating new user with default path (#12609)
  rbac: permissions endpoint: allow authenticated users (#12608)
  website/docs: update customer portal (#12603)
  website/docs: policy for email whitelist: modernize (#12558)

* main: (65 commits)
  stages/redirect: fix query parameter when redirecting to flow (#12750)
  website/integrations: cloudflare-access: refactor (#12663)
  sources/kerberos: handle principal expire time (#12748)
  lifecycle: build binary dependencies which link against SSL directly (#12724)
  website/docs: style guide: document styling preferences for URLs (#12715)
  website/integrations: nextcloud: fix broken link (#12744)
  core: bump selenium from 4.27.1 to 4.28.0 (#12745)
  lifecycle: move AWS CFN generation to lifecycle and fix CI (#12743)
  core: search users' attributes (#12740)
  web/components: ak-number-input: add support for min (#12703)
  website/integrations: nextcloud: fix url for "disable username changes" (#12725)
  core: bump pytest-github-actions-annotate-failures from 0.2.0 to 0.3.0 (#12735)
  website: bump katex from 0.16.11 to 0.16.21 in /website (#12731)
  web: bump katex from 0.16.11 to 0.16.21 in /web (#12730)
  website/integrations: Fix URL for authentik installation instead of mobilizon installation (#12729)
  core: bump debugpy from 1.8.11 to 1.8.12 (#12718)
  core: bump ruff from 0.9.1 to 0.9.2 (#12717)
  core: bump webauthn from 2.4.0 to 2.5.0 (#12719)
  core: bump structlog from 24.4.0 to 25.1.0 (#12720)
  website/integrations: all: install -> installation (#12676)
  ...

* main:
  web: update gen-client-ts to OpenAPI 7.11.0 (#12756)
  website/integrations: rustdesk-server-pro (#12706)
  core: bump codespell from 2.3.0 to 2.4.0 (#12762)
  root: docker: ensure apt packages are up-to-date (#12683)
  ci: fix missing build args for dev and release (#12760)
  web: bump vite from 5.4.11 to 5.4.14 in /web (#12757)
  web: bump undici from 6.21.0 to 6.21.1 in /web (#12755)
  lifecycle: fix cryptography's OpenSSL path (#12753)

* main: (111 commits)
  root: correctly use correct schema for install_id (#13018)
  website: bump docusaurus-plugin-openapi-docs from 4.3.3 to 4.3.4 in /website (#13011)
  web: bump API Client version (#13017)
  core: bump aws-cdk-lib from 2.178.1 to 2.178.2 (#13013)
  core: bump oss/go/microsoft/golang from 1.23-fips-bookworm to 1.24-fips-bookworm (#13012)
  website: bump docusaurus-theme-openapi-docs from 4.3.3 to 4.3.4 in /website (#13010)
  lifecycle/aws: bump aws-cdk from 2.178.1 to 2.178.2 in /lifecycle/aws (#13009)
  core: bump github.com/sethvargo/go-envconfig from 1.1.0 to 1.1.1 (#13008)
  web/admin: fix source selection for identification stage (#13007)
  core: bump sentry-sdk from 2.20.0 to 2.21.0 (#13014)
  website/integrations: Open WebUI (#12939)
  root: use correct default schema for install_id (#13006)
  website/docs: fix a minor typo (#13004)
  enterprise/providers/ssf: fixes v2 (#13003)
  root: make default postgres schema configurable (#12949)
  providers/oauth2: cleanup tokens when user is deactivated (#12859)
  website/docs: fix Nginx redirection example (#12920)
  core: bump twilio from 9.4.4 to 9.4.5 (#12993)
  core: bump coverage from 7.6.11 to 7.6.12 (#12994)
  core: bump cryptography from 44.0.0 to 44.0.1 (#12992)
  ...

* main: (48 commits)
  website/integrations: karakeep: don't hardcode wellknown's slug (#19127)
  core, web: bump qs from 6.14.0 to 6.14.1 in /packages/docusaurus-config (#19130)
  core: bump library/node from `ccfd9da` to `03729a7` in /website (#19125)
  core: bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 (#19088)
  web: bump the swc group across 1 directory with 11 updates (#19124)
  core: bump library/nginx from `ad85427` to `ca871a8` in /website (#19126)
  web: Capitalize language display names, code owner fix (#19119)
  web: Fix Impersonation, Lit Reactive Controller Contexts (#19114)
  web: bump the eslint group across 1 directory with 3 updates (#19110)
  core: bump library/nginx from `fb01117` to `ad85427` in /website (#19112)
  web: bump the storybook group across 1 directory with 5 updates (#19111)
  website/docs: release notes: Add more integrations (#19109)
  website/integrations: Add Audiobookshelf (#19104)
  website/integrations: Add Pulse (#19105)
  web/maintenance/no unknown attributes (part 1) (#18970)
  Update Vaultwarden documentation by removing warning (#19102)
  web: Fix stale flow background (#19015)
  web: fix promoted source button hover losing blue color (#19048)
  web: bump knip from 5.77.1 to 5.78.0 in /web (#19090)
  website/docs: endpoint devices: add path to macos setup (#19093)
  ...

* main: (24 commits)
  web/maintenance: no missing element type definitions (#18950)
  core: add prettier failure on duplicate group names (#18941)
  website/integrations: make grafana terraform section expand (#19192)
  lib: update error logging (#18628)
  core, web: update translations (#19179)
  web: bump @formatjs/intl-listformat from 8.1.0 to 8.1.1 in /web (#19182)
  ci: bump getsentry/action-release from 3.4.0 to 3.5.0 (#19183)
  web: bump knip from 5.78.0 to 5.79.0 in /web (#19181)
  lifecycle: fix migration conn_options for psycopg connection (#19134)
  website/docs: remove duplicates in slo docs (#19170)
  web/admin: adjust sync threshold, add tooltip (#19131)
  web: Fix user library colors, modal z-indexes, table progress bars (#19152)
  web: fix slug auto-updating when editing existing applications (#19169)
  core: handle deserialization errors from FileField migration (#19067)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#19137)
  website/integrations: vaultwarden: add custom email scope (#19160)
  ci: bump int128/docker-manifest-create-action from 2.10.0 to 2.12.0 (#19138)
  core, web: update translations (#19135)
  web: bump globals from 16.5.0 to 17.0.0 in /web (#19154)
  web/user: fix consent delete form missing details (#19147)
  ...

* main: (44 commits)
  web: Fix flow inspector advancement event. (#19309)
  web: bump knip from 5.80.0 to 5.80.1 in /web (#19301)
  core: bump urllib3 from 2.5.0 to v2.6.3 (#19287)
  endpoints: show agent version (#19239)
  core: bump django from v5.2.9 to 5.2.10 (#19290)
  web/admin: add banner to flow import form (#19288)
  web: bump chromedriver from 143.0.3 to 143.0.4 in /web (#19244)
  stages/password: replace session-based retries with reputation (#18643)
  website/integations: fix aws spelling (#19253)
  website/docs: update entra id provider docs (#18366)
  stages/prompt: optimize API endpoints (#19251)
  web: bump the rollup group across 1 directory with 4 updates (#19206)
  web: bump vite from 7.3.0 to 7.3.1 in /web (#19245)
  website/docs: update github social login script example (#19246)
  website/integrations: update AWS (#17861)
  core: bump goauthentik.io/api/v3 from 3.2026020.8 to 3.2026020.10 (#19242)
  website: Fix typos. (#19243)
  core: fix read replica routing during transactions (#19086)
  website/glossary: improve (#18969)
  stages/authenticator_static: set max token length to 100 chars (#19162)
  ...

* main:
  website/docs: update unique email policy (#19305)
  core: bump library/nginx from `ca871a8` to `7272239` in /website (#19334)
  web: bump @types/node from 25.0.3 to 25.0.6 in /web (#19331)
  core: bump axllent/mailpit from v1.28.1 to v1.28.2 in /tests/e2e (#19329)
  web: bump knip from 5.80.1 to 5.80.2 in /web (#19332)
  web: bump pino from 10.1.0 to 10.1.1 in /web (#19333)
  website/docs: add flow import warnings (#19307)
  website/docs: Fix documentation example for `app_entitlements_attributes`. (#19316)
  website/docs: update m2m doc (#18963)
  website/docs: Fix typo in GitHub OAuth Source instructions (#18936)
  website/docs: deprecate GCDT auth stage (#19306)
  core, web: update translations (#19237)

* main: (87 commits)
  core: bump importlib-metadata from 8.6.1 to 8.7.1 (#19430)
  core: bump geoip2 from 5.1.0 to 5.2.0 (#19429)
  core: bump debugpy from 1.8.14 to 1.8.19 (#19414)
  core: remove session migration (#14568)
  website/docs: add 2026.2 release notes draft page (#19418)
  core: bump wsproto from 1.2.0 to 1.3.2 (#19417)
  core: bump bpython from 0.25 to 0.26 (#19408)
  core: bump pdoc from 15.0.3 to 16.0.0 (#19413)
  core: bump ruff from 0.11.9 to 0.14.11 (#19410)
  core: bump python-kadmin-rs from 0.6.1 to 0.6.3 (#19416)
  core: bump drf-orjson-renderer from 1.7.3 to 1.8.0 (#19415)
  core: bump black from 25.1.0 to 25.12.0 (#19412)
  core: bump lxml from 6.0.0 to 6.0.2 (#19409)
  core: bump xmlsec from 1.3.16 to 1.3.17 (#19411)
  core: bump library/nginx from `06eb0c8` to `e3a22a7` in /website (#19394)
  core: bump library/node from `03729a7` to `6222695` in /website (#19393)
  website/docs: remove "beta" tag from 2025.12 (#19404)
  website/docs: add import to discord policy (#19397)
  web: bump @types/node from 25.0.7 to 25.0.8 in /web (#19392)
  website/docs: mention dynamic overrides in redirect stage documentation (#19368)
  ...

* main: (47 commits)
  endpoints/connectors/agent: add tests for IA endpoint stage (#19487)
  website/docs: limiting permissions of AD service account (#19483)
  endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (#19482)
  root: adjust makefile for non-brew macos (#19479)
  providers/oauth2: allow property mappings to override scope claim in access tokens (#19226)
  revert: lib: use orjson for structlog json (#19478)
  stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#19464)
  core: bump library/nginx from `e3a22a7` to `c881927` in /website (#19469)
  core: bump library/node from 25.2.1-trixie to 25.3.0-trixie in /website (#19468)
  web: bump prettier from 3.7.4 to 3.8.0 in /web (#19471)
  website/integrations: add MinIO AIStor configuration via environment variables (#19337)
  root: upgrade ruff lint for 3.14 (#19461)
  lib: use orjson for structlog json (#19462)
  ci: fix checkout stable (for 2025.12) (#19448)
  root: Python 3.14 (#17313)
  core: bump channels from 4.3.1 to 4.3.2 (#19458)
  core: bump mypy from 1.18.2 to 1.19.1 (#19457)
  core: bump google-api-python-client from 2.177.0 to 2.188.0 (#19443)
  core: bump selenium from 4.32.0 to 4.39.0 (#19455)
  core: bump msgraph-sdk from 1.39.0 to 1.52.0 (#19454)
  ...

* main: (115 commits)
  internal: fix incorrect metric calculation (#19701)
  core, web: update translations (#19684)
  core: bump goauthentik.io/api/v3 from 3.2026020.12 to 3.2026020.14 (#19686)
  lifecycle/aws: bump aws-cdk from 2.1101.0 to 2.1102.0 in /lifecycle/aws (#19687)
  core: bump goauthentik/selenium from 143.0-ak-0.35.3 to 144.0-ak-0.35.7 in /tests/e2e (#19688)
  core: bump msgraph-sdk from 1.52.0 to 1.53.0 (#19689)
  core: bump ruff from 0.14.13 to 0.14.14 (#19690)
  core: bump twilio from 9.9.1 to 9.10.0 (#19691)
  core: bump gunicorn from 23.0.0 to 24.0.0 (#19692)
  web: bump the bundler group across 1 directory with 3 updates (#19693)
  web: bump unist-util-visit from 5.0.0 to 5.1.0 in /web (#19694)
  web: bump globals from 17.0.0 to 17.1.0 in /web (#19695)
  ci: bump actions/checkout from 6.0.1 to 6.0.2 (#19696)
  web: Form Modal Independence: Part 1 (#19395)
  web/common: add dev middleware to show warnings for consecutive identical requests (#19671)
  web/admin: fix file upload not preserving extension for custom names with dots (#19548)
  web/admin: fix brand form sending "undefined" string for blank default application (#19658)
  providers/proxy: Fix incorrect comparison of redirect URL and CookieDomain (#15686)
  core: add bulk session revocation (#18564)
  website/docs: endpoint devices: add serial number note (#19677)
  ...

* main:
  endpoints: FleetDM connector (#18589)
  web/admin: fix impersonation form requesting data without being opened (#19673)
  core: return bad request when user is authenticated and not active (#19706)

* main: (45 commits)
  sources/saml: Add testcases for PR #19593 (#19647)
  revert: website/integrations: wazuh: Change exchange key generation to 64 bytes (#19759)
  web: bump API Client version (#19760)
  core: bump djangoql from 0.18.2 to 0.19.1 (#19780)
  web: Vendor SFE Bootstrap (#19766)
  core, web: update translations (#19717)
  web: bump the eslint group across 1 directory with 3 updates (#19782)
  web: bump the react group across 1 directory with 2 updates (#19784)
  web: bump country-flag-icons from 1.6.8 to 1.6.9 in /web (#19785)
  providers/oauth2: Support login_hint (#19498)
  admin/files: add centralized theme variable support for file URLs (#19657)
  core: bump github.com/pires/go-proxyproto from 0.9.1 to 0.9.2 (#19778)
  core: bump openapitools/openapi-diff from 2.1.6 to 2.1.7 in /scripts/api (#19779)
  core: bump gssapi from 1.10.1 to 1.11.1 (#19781)
  ci: bump actions/attest-build-provenance from 3.1.0 to 3.2.0 (#19783)
  website/docs: endpoint devices: fix local device login (#19698)
  web: Enforce `challenge` nullish types. (#19768)
  web/elements: stabilize dual-select status height (#19734)
  web/a11y: CAPTCHA Stage Form (#19670)
  web/table: align row action icons and tooltip color (#19736)
  ...

* main: (52 commits)
  website: QL Search keyboard interactions docs, examples. (#16259)
  website/integrations: immich: add signing algorithm (#19187)
  website/docs: endpoint devices: add version command (#19767)
  common: introduce common (#19852)
  web: bump @sentry/browser from 10.37.0 to 10.38.0 in /web in the sentry group across 1 directory (#19871)
  core: bump debugpy from 1.8.19 to 1.8.20 (#19872)
  ci: bump actions/cache from 5.0.2 to 5.0.3 (#19873)
  web: bump chromedriver from 144.0.1 to 145.0.0 in /web (#19874)
  web: Captcha Refinements, Part 2  (#19757)
  root: assign cherry-pick PRs to original author (#19858)
  web: Lit Development Mode, performance fixes. (#19825)
  web: Fix development theme overrides (#19826)
  website/docs: add tip for recovering from accidental main branch work (#19865)
  web: bump API Client version (#19857)
  rbac: clean up roles and permissions (#19588)
  web: bump API Client version (#19851)
  website/docs: add more info to entra id scim doc (#19849)
  sources/oauth: Fix an issue where wechat may crash duing login. (#18973)
  providers/scim: fix email validation mismatch (#19848)
  providers/scim: modify user- and group syncing behavior (#13947)
  ...

* main: (30 commits)
  web/admin: fix default binding order (#19943)
  ci: fix test_docker.sh (#19944)
  lib: Add ssh/sftp schemas in to DomainlessFormattedURLValidator (#19881)
  core: fix non-expiring service accounts and app passwords (#19913)
  lifecycle/ak: make sure /data has the correct permissions (#19935)
  lifecycle/aws: add /data volume (#19936)
  website/docs: Update location of media storage and outdated references (#19885)
  web: bump @types/node from 25.1.0 to 25.2.0 in /web (#19923)
  web: bump @playwright/test from 1.58.0 to 1.58.1 in /web (#19926)
  web: bump the rollup group across 1 directory with 4 updates (#19922)
  ci: always generate API clients (#19906)
  providers/scim: add configuration warning for migration (#19859)
  core, web: update translations (#19868)
  core: bump gunicorn from 24.1.1 to 25.0.0 (#19916)
  core: bump pyjwt from 2.10.1 to 2.11.0 (#19920)
  core: bump cachetools from 6.2.6 to 7.0.0 (#19919)
  web: bump @formatjs/intl-listformat from 8.2.0 to 8.2.1 in /web (#19924)
  web: bump the storybook group across 1 directory with 5 updates (#19921)
  core: bump axllent/mailpit from v1.28.4 to v1.29.0 in /tests/e2e (#19918)
  core: bump goauthentik/selenium from 144.0-ak-0.35.9 to 144.0-ak-0.40.0 in /tests/e2e (#19917)
  ...

* main: (26 commits)
  providers/saml: auto pull signature algorithm options (#17614)
  core, web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /packages/prettier-config (#19990)
  web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /web (#19989)
  stages/authenticator_webauthn: fix double JSON encoding of webauthn options (#19952)
  core: bump django from 5.2.10 to 5.2.11 (#19988)
  ci: allow setting assignee to fail (#19985)
  root: revert enterprise loading behaviour (#19485)
  web/flows: update flow background (#19974)
  providers/oauth2: use compare_digest for client_secret comparison (#19979)
  recovery: consume token in transaction (#19967)
  core: ask for token duration on recovery link/email by admin (#19875)
  core: bump aws-cdk-lib from 2.236.0 to 2.237.0 (#19958)
  web: bump the storybook group across 1 directory with 5 updates (#19960)
  core: bump library/nginx from `c881927` to `7fe5dda` in /website (#19961)
  core: bump gunicorn from 25.0.0 to 25.0.1 (#19959)
  core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770129730 (#19973)
  lifecycle: bump shm size (#19369)
  crypto: Add ED25519 and ED448 support to the certificate builder (#19465)
  web/admin: Register stage elements. Fix linter warnings (#19948)
  web: bump knip from 5.82.1 to 5.83.0 in /web (#19962)
  ...

* main: (83 commits)
  web/admin: source forms not rendering (#19887)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  ...