rebased, tweaked to bump build

Fix format
Signed-off-by: Germán Martín <github@gmartin.net>
2026-05-06 23:22:35 +02:00 · 2025-07-21 13:06:44 -05:00 · 2025-07-21 12:58:01 -05:00 · 2025-07-21 12:58:01 -05:00 · 2025-07-21 16:32:41 +01:00 · 2025-07-21 16:31:52 +01:00
70 changed files with 3584 additions and 1676 deletions
--- a/.github/workflows/ci-api-docs.yml
+++ b/.github/workflows/ci-api-docs.yml
@@ -1,93 +0,0 @@
-name: authentik-ci-api-docs
-
-on:
-  push:
-    branches:
-      - main
-      - next
-      - version-*
-  pull_request:
-    branches:
-      - main
-      - version-*
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        command:
-          - prettier-check
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install Dependencies
-        working-directory: website/
-        run: npm ci
-      - name: Lint
-        working-directory: website/
-        run: npm run ${{ matrix.command }}
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: website/package.json
-          cache: "npm"
-          cache-dependency-path: website/package-lock.json
-      - working-directory: website/
-        name: Install Dependencies
-        run: npm ci
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ${{ github.workspace }}/website/docs/.docusaurus
-            ${{ github.workspace }}/website/docs/**/.cache
-          key: |
-            ${{ runner.os }}-docusaurus-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
-          restore-keys: |
-            ${{ runner.os }}-docusaurus-${{ hashFiles('**/package-lock.json') }}
-      - name: Build API Docs via Docusaurus
-        working-directory: website
-        run: npm run build -w api
-      - uses: actions/upload-artifact@v4
-        with:
-          name: api-docs
-          path: website/api/build
-          retention-days: 7
-  deploy:
-    runs-on: ubuntu-latest
-    needs:
-      - lint
-      - build
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
-        with:
-          name: api-docs
-          path: website/api/build
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: website/package.json
-          cache: "npm"
-          cache-dependency-path: website/package-lock.json
-      - working-directory: website/
-        name: Install Dependencies
-        run: npm ci
-      - name: Deploy Netlify (Production)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        env:
-          NETLIFY_SITE_ID: authentik-api-docs.netlify.app
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-        working-directory: website/api
-        run: npx netlify deploy --no-build --prod
-
-      - name: Deploy Netlify (Preview)
-        if: github.event_name == 'pull_request' || github.ref != 'refs/heads/main'
-        env:
-          NETLIFY_SITE_ID: authentik-api-docs.netlify.app
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-        working-directory: website/api
-        run: npx netlify deploy --no-build --alias=deploy-preview-${{ github.event.number }}
--- a/.github/workflows/ci-website.yml
+++ b/.github/workflows/ci-website.yml
@@ -1,4 +1,4 @@
-name: authentik-ci-docs
+name: authentik-ci-website

 on:
  push:
@@ -18,18 +18,17 @@ jobs:
      fail-fast: false
      matrix:
        command:
+          - lint:lockfile
          - prettier-check
    steps:
      - uses: actions/checkout@v4
-      - name: Install dependencies
-        working-directory: website/
+      - working-directory: website/
        run: npm ci
      - name: Lint
        working-directory: website/
        run: npm run ${{ matrix.command }}
-  build-docs:
+  test:
    runs-on: ubuntu-latest
-
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
@@ -38,14 +37,19 @@ jobs:
          cache: "npm"
          cache-dependency-path: website/package-lock.json
      - working-directory: website/
-        name: Install Dependencies
        run: npm ci
-      - name: Build Documentation via Docusaurus
+      - name: test
        working-directory: website/
-        run: npm run build
-  build-integrations:
+        run: npm test
+  build:
    runs-on: ubuntu-latest
-
+    name: ${{ matrix.job }}
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - build
+          - build:integrations
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
@@ -54,11 +58,10 @@ jobs:
          cache: "npm"
          cache-dependency-path: website/package-lock.json
      - working-directory: website/
-        name: Install Dependencies
        run: npm ci
-      - name: Build Integrations via Docusaurus
+      - name: build
        working-directory: website/
-        run: npm run build -w integrations
+        run: npm run ${{ matrix.job }}
  build-container:
    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
    runs-on: ubuntu-latest
@@ -112,8 +115,8 @@ jobs:
    if: always()
    needs:
      - lint
-      - build-docs
-      - build-integrations
+      - test
+      - build
      - build-container
    runs-on: ubuntu-latest
    steps:
--- a/.prettierignore
+++ b/.prettierignore
@@ -10,8 +10,7 @@ coverage
 dist
 out
 .docusaurus
-# TODO Replace after moving website to docs
-website/api/reference
+website/docs/developer-docs/api/**/*

 ## Environment
 *.env
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -4,7 +4,12 @@
        {
            "label": "authentik/core: make",
            "command": "uv",
-            "args": ["run", "make", "lint-fix", "lint"],
+            "args": [
+                "run",
+                "make",
+                "lint-fix",
+                "lint"
+            ],
            "presentation": {
                "panel": "new"
            },
@@ -13,7 +18,11 @@
        {
            "label": "authentik/core: run",
            "command": "uv",
-            "args": ["run", "ak", "server"],
+            "args": [
+                "run",
+                "ak",
+                "server"
+            ],
            "group": "build",
            "presentation": {
                "panel": "dedicated",
@@ -23,13 +32,17 @@
        {
            "label": "authentik/web: make",
            "command": "make",
-            "args": ["web"],
+            "args": [
+                "web"
+            ],
            "group": "build"
        },
        {
            "label": "authentik/web: watch",
            "command": "make",
-            "args": ["web-watch"],
+            "args": [
+                "web-watch"
+            ],
            "group": "build",
            "presentation": {
                "panel": "dedicated",
@@ -39,19 +52,26 @@
        {
            "label": "authentik: install",
            "command": "make",
-            "args": ["install", "-j4"],
+            "args": [
+                "install",
+                "-j4"
+            ],
            "group": "build"
        },
        {
-            "label": "authentik/docs: make",
+            "label": "authentik/website: make",
            "command": "make",
-            "args": ["docs"],
+            "args": [
+                "website"
+            ],
            "group": "build"
        },
        {
-            "label": "authentik/docs: watch",
+            "label": "authentik/website: watch",
            "command": "make",
-            "args": ["docs-watch"],
+            "args": [
+                "website-watch"
+            ],
            "group": "build",
            "presentation": {
                "panel": "dedicated",
@@ -61,7 +81,11 @@
        {
            "label": "authentik/api: generate",
            "command": "uv",
-            "args": ["run", "make", "gen"],
+            "args": [
+                "run",
+                "make",
+                "gen"
+            ],
            "group": "build"
        }
    ]
--- a/6
+++ b/6
@@ -32,12 +32,8 @@ tests/wdio/                     @goauthentik/frontend
 locale/                         @goauthentik/backend @goauthentik/frontend
 web/xliff/                      @goauthentik/backend @goauthentik/frontend
 # Docs & Website
-docs/                           @goauthentik/docs
-# TODO Remove after moving website to docs
 website/                        @goauthentik/docs
 CODE_OF_CONDUCT.md              @goauthentik/docs
 # Security
 SECURITY.md                     @goauthentik/security @goauthentik/docs
-# TODO Remove after moving website to docs
-website/security/               @goauthentik/security @goauthentik/docs
-docs/security/                  @goauthentik/security @goauthentik/docs
+website/docs/security/          @goauthentik/security @goauthentik/docs
--- a/3
+++ b/3
@@ -18,7 +18,6 @@ RUN --mount=type=bind,target=/work/web/package.json,src=./web/package.json \

 COPY ./package.json /work
 COPY ./web /work/web/
-# TODO: Update this after moving website to docs
 COPY ./website /work/website/
 COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api

@@ -76,7 +75,7 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
    /bin/sh -c "GEOIPUPDATE_LICENSE_KEY_FILE=/run/secrets/GEOIPUPDATE_LICENSE_KEY /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"

 # Stage 4: Download uv
-FROM ghcr.io/astral-sh/uv:0.7.21 AS uv
+FROM ghcr.io/astral-sh/uv:0.8.0 AS uv
 # Stage 5: Base python image
 FROM ghcr.io/goauthentik/fips-python:3.13.5-slim-bookworm-fips AS python-base

--- a/16
+++ b/16
@@ -121,7 +121,7 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	sed -i 's/}/&#125;/g' diff.md
 	npx prettier --write diff.md

-gen-clean-ts:  ## Remove generated API client for TypeScript
+gen-clean-ts:  ## Remove generated API client for Typescript
 	rm -rf ${PWD}/${GEN_API_TS}/
 	rm -rf ${PWD}/web/node_modules/@goauthentik/api/

@@ -243,22 +243,12 @@ docs-build:
 docs-watch:  ## Build and watch the topics documentation
 	npm run start --prefix website

-integrations: docs-lint-fix
+docs-integrations-build:
 	npm run build --prefix website -w integrations

-integrations-watch:  ## Build and watch the Integrations documentation
+docs-integrations-watch:  ## Build and watch the Integrations documentation
 	npm run start --prefix website -w integrations

-docs-api-build:
-	npm run build --prefix website -w api
-
-docs-api-watch:  ## Build and watch the API documentation
-	npm run build:api --prefix website -w api
-	npm run start --prefix website -w api
-
-docs-api-clean: ## Clean generated API documentation
-	npm run build:api:clean --prefix website -w api
-
 #########################
 ## Docker
 #########################
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@@ -8,9 +8,9 @@
 # make gen-dev-config
 # ```
 #
-# You may edit the generated file to override the configuration below.
+# You may edit the generated file to override the configuration below.  
 #
-# When making modifying the default configuration file,
+# When making modifying the default configuration file, 
 # ensure that the corresponding documentation is updated to match.
 #
 # @see {@link ../../website/docs/install-config/configuration/configuration.mdx Configuration documentation} for more information.
--- a/authentik/stages/authenticator_sms/models.py
+++ b/authentik/stages/authenticator_sms/models.py
@@ -4,7 +4,7 @@ from hashlib import sha256

 from django.contrib.auth import get_user_model
 from django.db import models
-from django.http import HttpResponseBadRequest
+from django.http import HttpRequest, HttpResponseBadRequest
 from django.utils.translation import gettext_lazy as _
 from django.views import View
 from requests.exceptions import RequestException
@@ -68,32 +68,44 @@ class AuthenticatorSMSStage(ConfigurableStage, FriendlyNamedStage, Stage):
        help_text=_("Optionally modify the payload being sent to custom providers."),
    )

-    def send(self, token: str, device: "SMSDevice"):
+    def send(self, request: HttpRequest, token: str, device: "SMSDevice"):
        """Send message via selected provider"""
        if self.provider == SMSProviders.TWILIO:
-            return self.send_twilio(token, device)
+            return self.send_twilio(request, token, device)
        if self.provider == SMSProviders.GENERIC:
-            return self.send_generic(token, device)
+            return self.send_generic(request, token, device)
        raise ValueError(f"invalid provider {self.provider}")

    def get_message(self, token: str) -> str:
        """Get SMS message"""
        return _("Use this code to authenticate in authentik: {token}".format_map({"token": token}))

-    def send_twilio(self, token: str, device: "SMSDevice"):
+    def send_twilio(self, request: HttpRequest, token: str, device: "SMSDevice"):
        """send sms via twilio provider"""
        client = Client(self.account_sid, self.auth)
+        message_body = str(self.get_message(token))
+        if self.mapping:
+            payload = sanitize_item(
+                self.mapping.evaluate(
+                    user=device.user,
+                    request=request,
+                    device=device,
+                    token=token,
+                    stage=self,
+                )
+            )
+            message_body = payload.get("message", message_body)

        try:
            message = client.messages.create(
-                to=device.phone_number, from_=self.from_number, body=str(self.get_message(token))
+                to=device.phone_number, from_=self.from_number, body=message_body
            )
            LOGGER.debug("Sent SMS", to=device, message=message.sid)
        except TwilioRestException as exc:
            LOGGER.warning("Error sending token by Twilio SMS", exc=exc, msg=exc.msg)
            raise ValidationError(exc.msg) from None

-    def send_generic(self, token: str, device: "SMSDevice"):
+    def send_generic(self, request: HttpRequest, token: str, device: "SMSDevice"):
        """Send SMS via outside API"""
        payload = {
            "From": self.from_number,
@@ -106,7 +118,7 @@ class AuthenticatorSMSStage(ConfigurableStage, FriendlyNamedStage, Stage):
            payload = sanitize_item(
                self.mapping.evaluate(
                    user=device.user,
-                    request=None,
+                    request=request,
                    device=device,
                    token=token,
                    stage=self,
--- a/authentik/stages/authenticator_sms/stage.py
+++ b/authentik/stages/authenticator_sms/stage.py
@@ -71,7 +71,7 @@ class AuthenticatorSMSStageView(ChallengeStageView):
            raise ValidationError(_("Invalid phone number"))
        # No code yet, but we have a phone number, so send a verification message
        device: SMSDevice = self.request.session[SESSION_KEY_SMS_DEVICE]
-        stage.send(device.token, device)
+        stage.send(self.request, device.token, device)

    def _has_phone_number(self) -> str | None:
        context = self.executor.plan.context
--- a/authentik/stages/authenticator_validate/challenge.py
+++ b/authentik/stages/authenticator_validate/challenge.py
@@ -124,7 +124,7 @@ def select_challenge(request: HttpRequest, device: Device):
 def select_challenge_sms(request: HttpRequest, device: SMSDevice):
    """Send SMS"""
    device.generate_token()
-    device.stage.send(device.token, device)
+    device.stage.send(request, device.token, device)


 def select_challenge_email(request: HttpRequest, device: EmailDevice):
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/gorilla/securecookie v1.1.2
 	github.com/gorilla/sessions v1.4.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/grafana/pyroscope-go v1.2.3
+	github.com/grafana/pyroscope-go v1.2.4
 	github.com/jellydator/ttlcache/v3 v3.4.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484
@@ -29,7 +29,7 @@ require (
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/wwt/guac v1.3.2
-	goauthentik.io/api/v3 v3.2025063.5
+	goauthentik.io/api/v3 v3.2025063.6
 	golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab
 	golang.org/x/oauth2 v0.30.0
 	golang.org/x/sync v0.16.0
--- a/go.sum
+++ b/go.sum
@@ -180,8 +180,8 @@ github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2e
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grafana/pyroscope-go v1.2.3 h1:Rp8mjqqGqmRDvV6XYmuedUAv7wVnQJK/M1pBt6uNwxU=
-github.com/grafana/pyroscope-go v1.2.3/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
+github.com/grafana/pyroscope-go v1.2.4 h1:B22GMXz+O0nWLatxLuaP7o7L9dvP0clLvIpmeEQQM0Q=
+github.com/grafana/pyroscope-go v1.2.4/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8 h1:iwOtYXeeVSAeYefJNaxDytgjKtUuKQbJqgAIjlnicKg=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
@@ -298,8 +298,8 @@ go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y
 go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-goauthentik.io/api/v3 v3.2025063.5 h1:j5el9/qI/72Q5x5QAiMzgQTswMj2TK3h74OaBcFEtkI=
-goauthentik.io/api/v3 v3.2025063.5/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
+goauthentik.io/api/v3 v3.2025063.6 h1:TFMnE0bXiWZ5oVYrnxDLpS+pnGNv+KIjLmZHT5qzpcM=
+goauthentik.io/api/v3 v3.2025063.6/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
--- a/internal/outpost/radius/handle_access_request.go
+++ b/internal/outpost/radius/handle_access_request.go
@@ -2,6 +2,7 @@ package radius

 import (
 	"encoding/base64"
+	"errors"

 	"github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
@@ -11,9 +12,7 @@ import (
 	"layeh.com/radius/rfc2865"
 )

-func (rs *RadiusServer) Handle_AccessRequest(w radius.ResponseWriter, r *RadiusRequest) {
-	username := rfc2865.UserName_GetString(r.Packet)
-
+func (rs *RadiusServer) Handle_AccessRequest_PAP_Auth(r *RadiusRequest, username, password string) (*radius.Packet, error) {
 	fe := flow.NewFlowExecutor(r.Context(), r.pi.flowSlug, r.pi.s.ac.Client.GetConfig(), log.Fields{
 		"username":  username,
 		"client":    r.RemoteAddr(),
@@ -23,67 +22,64 @@ func (rs *RadiusServer) Handle_AccessRequest(w radius.ResponseWriter, r *RadiusR
 	fe.Params.Add("goauthentik.io/outpost/radius", "true")

 	fe.Answers[flow.StageIdentification] = username
-	fe.SetSecrets(rfc2865.UserPassword_GetString(r.Packet), r.pi.MFASupport)
+	fe.SetSecrets(password, r.pi.MFASupport)

 	passed, err := fe.Execute()
 	if err != nil {
 		r.Log().WithField("username", username).WithError(err).Warning("failed to execute flow")
-		metrics.RequestsRejected.With(prometheus.Labels{
-			"outpost_name": rs.ac.Outpost.Name,
-			"reason":       "flow_error",
-			"app":          r.pi.appSlug,
-		}).Inc()
-		_ = w.Write(r.Response(radius.CodeAccessReject))
-		return
+		return nil, errors.New("flow_error")
 	}
 	if !passed {
-		metrics.RequestsRejected.With(prometheus.Labels{
-			"outpost_name": rs.ac.Outpost.Name,
-			"reason":       "invalid_credentials",
-			"app":          r.pi.appSlug,
-		}).Inc()
-		_ = w.Write(r.Response(radius.CodeAccessReject))
-		return
+		return nil, errors.New("invalid_credentials")
 	}
 	access, _, err := fe.ApiClient().OutpostsApi.OutpostsRadiusAccessCheck(
 		r.Context(), r.pi.providerId,
 	).AppSlug(r.pi.appSlug).Execute()
 	if err != nil {
 		r.Log().WithField("username", username).WithError(err).Warning("failed to check access")
-		_ = w.Write(r.Response(radius.CodeAccessReject))
-		metrics.RequestsRejected.With(prometheus.Labels{
-			"outpost_name": rs.ac.Outpost.Name,
-			"reason":       "access_check_fail",
-			"app":          r.pi.appSlug,
-		}).Inc()
-		return
+		return nil, errors.New("access_check_fail")
 	}
 	if !access.Access.Passing {
 		r.Log().WithField("username", username).Info("Access denied for user")
-		_ = w.Write(r.Response(radius.CodeAccessReject))
-		metrics.RequestsRejected.With(prometheus.Labels{
-			"outpost_name": rs.ac.Outpost.Name,
-			"reason":       "access_denied",
-			"app":          r.pi.appSlug,
-		}).Inc()
-		return
+		return nil, errors.New("access_denied")
 	}
 	res := r.Response(radius.CodeAccessAccept)
-	defer func() { _ = w.Write(res) }()
 	if !access.HasAttributes() {
 		r.Log().Debug("No attributes")
-		return
+		return res, nil
 	}
 	rawData, err := base64.StdEncoding.DecodeString(access.GetAttributes())
 	if err != nil {
 		r.Log().WithError(err).Warning("failed to decode attributes from core")
-		return
+		return nil, errors.New("attribute_decode_failed")
 	}
 	p, err := radius.Parse(rawData, r.pi.SharedSecret)
 	if err != nil {
 		r.Log().WithError(err).Warning("failed to parse attributes from core")
+		return nil, errors.New("attribute_parse_failed")
 	}
 	for _, attr := range p.Attributes {
 		res.Add(attr.Type, attr.Attribute)
 	}
+	return res, nil
+}
+
+func (rs *RadiusServer) Handle_AccessRequest(w radius.ResponseWriter, r *RadiusRequest) {
+	username := rfc2865.UserName_GetString(r.Packet)
+	password := rfc2865.UserPassword_GetString(r.Packet)
+	res, err := rs.Handle_AccessRequest_PAP_Auth(r, username, password)
+	if err != nil {
+		metrics.RequestsRejected.With(prometheus.Labels{
+			"outpost_name": rs.ac.Outpost.Name,
+			"reason":       err.Error(),
+			"app":          r.pi.appSlug,
+		}).Inc()
+		_ = w.Write(r.Reject())
+		return
+	}
+	err = r.setMessageAuthenticator(res)
+	if err != nil {
+		rs.log.WithError(err).Warning("failed to set message authenticator")
+	}
+	_ = w.Write(res)
 }
--- a/internal/outpost/radius/handler.go
+++ b/internal/outpost/radius/handler.go
@@ -1,8 +1,12 @@
 package radius

 import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/md5"
 	"crypto/sha512"
 	"encoding/hex"
+	"errors"
 	"time"

 	"github.com/getsentry/sentry-go"
@@ -13,6 +17,11 @@ import (
 	"goauthentik.io/internal/outpost/radius/metrics"
 	"goauthentik.io/internal/utils"
 	"layeh.com/radius"
+	"layeh.com/radius/rfc2869"
+)
+
+var (
+	ErrInvalidMessageAuthenticator = errors.New("invalid message authenticator")
 )

 type RadiusRequest struct {
@@ -35,6 +44,41 @@ func (r *RadiusRequest) ID() string {
 	return r.id
 }

+func (r *RadiusRequest) validateMessageAuthenticator() error {
+	mauth := rfc2869.MessageAuthenticator_Get(r.Packet)
+	hash := hmac.New(md5.New, r.Secret)
+	encode, err := r.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	hash.Write(encode)
+	if bytes.Equal(mauth, hash.Sum(nil)) {
+		return ErrInvalidMessageAuthenticator
+	}
+	return nil
+}
+
+func (r *RadiusRequest) setMessageAuthenticator(rp *radius.Packet) error {
+	_ = rfc2869.MessageAuthenticator_Set(rp, make([]byte, 16))
+	hash := hmac.New(md5.New, rp.Secret)
+	encode, err := rp.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	hash.Write(encode)
+	_ = rfc2869.MessageAuthenticator_Set(rp, hash.Sum(nil))
+	return nil
+}
+
+func (r *RadiusRequest) Reject() *radius.Packet {
+	res := r.Response(radius.CodeAccessReject)
+	err := r.setMessageAuthenticator(res)
+	if err != nil {
+		r.log.WithError(err).Warning("failed to set message authenticator")
+	}
+	return res
+}
+
 func (rs *RadiusServer) ServeRADIUS(w radius.ResponseWriter, r *radius.Request) {
 	span := sentry.StartSpan(r.Context(), "authentik.providers.radius.connect",
 		sentry.WithTransactionName("authentik.providers.radius.connect"))
@@ -59,6 +103,11 @@ func (rs *RadiusServer) ServeRADIUS(w radius.ResponseWriter, r *radius.Request)

 	rl.Info("Radius Request")

+	if err := nr.validateMessageAuthenticator(); err != nil {
+		rl.WithError(err).Warning("Invalid message authenticator")
+		return
+	}
+
 	// Lookup provider by shared secret
 	var pi *ProviderInstance
 	for _, p := range rs.providers {
@@ -72,7 +121,7 @@ func (rs *RadiusServer) ServeRADIUS(w radius.ResponseWriter, r *radius.Request)
 		hs := sha512.Sum512([]byte(r.Secret))
 		bs := hex.EncodeToString(hs[:])
 		nr.Log().WithField("hashed_secret", bs).Warning("No provider found")
-		_ = w.Write(r.Response(radius.CodeAccessReject))
+		_ = w.Write(nr.Reject())
 		return
 	}
 	nr.pi = pi
--- a/lifecycle/aws/package-lock.json
+++ b/lifecycle/aws/package-lock.json
@@ -9,7 +9,7 @@
            "version": "0.0.0",
            "license": "MIT",
            "devDependencies": {
-                "aws-cdk": "^2.1020.2",
+                "aws-cdk": "^2.1021.0",
                "cross-env": "^7.0.3"
            },
            "engines": {
@@ -17,10 +17,11 @@
            }
        },
        "node_modules/aws-cdk": {
-            "version": "2.1020.2",
-            "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1020.2.tgz",
-            "integrity": "sha512-yWdt3dJh4aPm1VNyEgfG3lozGrvddw0i7avt+Cl9KOYixmisQtAg39/aZqzVVqjzVZVEanXmz+tlhzzh75Z69A==",
+            "version": "2.1021.0",
+            "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1021.0.tgz",
+            "integrity": "sha512-kE557b4N9UFWax+7km3R6D56o4tGhpzOks/lRDugaoC8su3mocLCXJhb954b/IRl0ipnbZnY/Sftq+RQ/sxivg==",
            "dev": true,
+            "license": "Apache-2.0",
            "bin": {
                "cdk": "bin/cdk"
            },
--- a/lifecycle/aws/package.json
+++ b/lifecycle/aws/package.json
@@ -10,7 +10,7 @@
        "node": ">=20"
    },
    "devDependencies": {
-        "aws-cdk": "^2.1020.2",
+        "aws-cdk": "^2.1021.0",
        "cross-env": "^7.0.3"
    }
 }
--- a/locale/de/LC_MESSAGES/django.po
+++ b/locale/de/LC_MESSAGES/django.po
@@ -40,7 +40,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-07-05 00:10+0000\n"
+"POT-Creation-Date: 2025-07-15 00:11+0000\n"
 "PO-Revision-Date: 2022-09-26 16:47+0000\n"
 "Last-Translator: Fabian, 2025\n"
 "Language-Team: German (https://app.transifex.com/authentik/teams/119923/de/)\n"
@@ -407,7 +407,7 @@ msgstr "Eigenschaft"

 #: authentik/core/models.py
 msgid "Property Mappings"
-msgstr "Eigenschaften"
+msgstr "Property Mappings"

 #: authentik/core/models.py
 msgid "session data"
@@ -593,7 +593,7 @@ msgstr "Google Workspace Provider Gruppen"
 #: authentik/providers/scim/models.py
 msgid "Property mappings used for group creation/updating."
 msgstr ""
-"Eigenschaft, die für die Erstellung/Aktualisierung von Gruppen verwendet "
+"Eigenschaften, die für die Erstellung/Aktualisierung von Gruppen verwendet "
 "werden."

 #: authentik/enterprise/providers/google_workspace/models.py
@@ -2754,6 +2754,14 @@ msgstr "Azure AD OAuth Quelle"
 msgid "Azure AD OAuth Sources"
 msgstr "Azure AD OAuth Quellen"

+#: authentik/sources/oauth/models.py
+msgid "Entra ID OAuth Source"
+msgstr "Entra ID OAuth-Quelle"
+
+#: authentik/sources/oauth/models.py
+msgid "Entra ID OAuth Sources"
+msgstr "Entra ID OAuth-Quellen"
+
 #: authentik/sources/oauth/models.py
 msgid "OpenID OAuth Source"
 msgstr "OpenID OAuth Quelle"
--- a/packages/docusaurus-config/package-lock.json
+++ b/packages/docusaurus-config/package-lock.json
@@ -5954,9 +5954,9 @@
            }
        },
        "node_modules/compression": {
-            "version": "1.8.0",
-            "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.0.tgz",
-            "integrity": "sha512-k6WLKfunuqCYD3t6AsuPGvQWaKwuLLh2/xHNcX4qE+vIfDNXpSqnrhwA7O53R7WVQUnt8dVAIW+YHr7xTgOgGA==",
+            "version": "1.8.1",
+            "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
+            "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -5964,7 +5964,7 @@
                "compressible": "~2.0.18",
                "debug": "2.6.9",
                "negotiator": "~0.6.4",
-                "on-headers": "~1.0.2",
+                "on-headers": "~1.1.0",
                "safe-buffer": "5.2.1",
                "vary": "~1.1.2"
            },
@@ -12708,9 +12708,9 @@
            }
        },
        "node_modules/on-headers": {
-            "version": "1.0.2",
-            "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
-            "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==",
+            "version": "1.1.0",
+            "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+            "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
            "dev": true,
            "license": "MIT",
            "engines": {
--- a/packages/esbuild-plugin-live-reload/package-lock.json
+++ b/packages/esbuild-plugin-live-reload/package-lock.json
@@ -132,9 +132,9 @@
            }
        },
        "node_modules/@esbuild/aix-ppc64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.6.tgz",
-            "integrity": "sha512-ShbM/3XxwuxjFiuVBHA+d3j5dyac0aEVVq1oluIDf71hUw0aRF59dV/efUsIwFnR6m8JNM2FjZOzmaZ8yG61kw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.8.tgz",
+            "integrity": "sha512-urAvrUedIqEiFR3FYSLTWQgLu5tb+m0qZw0NBEasUeo6wuqatkMDaRT+1uABiGXEu5vqgPd7FGE1BhsAIy9QVA==",
            "cpu": [
                "ppc64"
            ],
@@ -149,9 +149,9 @@
            }
        },
        "node_modules/@esbuild/android-arm": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.6.tgz",
-            "integrity": "sha512-S8ToEOVfg++AU/bHwdksHNnyLyVM+eMVAOf6yRKFitnwnbwwPNqKr3srzFRe7nzV69RQKb5DgchIX5pt3L53xg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.8.tgz",
+            "integrity": "sha512-RONsAvGCz5oWyePVnLdZY/HHwA++nxYWIX1atInlaW6SEkwq6XkP3+cb825EUcRs5Vss/lGh/2YxAb5xqc07Uw==",
            "cpu": [
                "arm"
            ],
@@ -166,9 +166,9 @@
            }
        },
        "node_modules/@esbuild/android-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.6.tgz",
-            "integrity": "sha512-hd5zdUarsK6strW+3Wxi5qWws+rJhCCbMiC9QZyzoxfk5uHRIE8T287giQxzVpEvCwuJ9Qjg6bEjcRJcgfLqoA==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.8.tgz",
+            "integrity": "sha512-OD3p7LYzWpLhZEyATcTSJ67qB5D+20vbtr6vHlHWSQYhKtzUYrETuWThmzFpZtFsBIxRvhO07+UgVA9m0i/O1w==",
            "cpu": [
                "arm64"
            ],
@@ -183,9 +183,9 @@
            }
        },
        "node_modules/@esbuild/android-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.6.tgz",
-            "integrity": "sha512-0Z7KpHSr3VBIO9A/1wcT3NTy7EB4oNC4upJ5ye3R7taCc2GUdeynSLArnon5G8scPwaU866d3H4BCrE5xLW25A==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.8.tgz",
+            "integrity": "sha512-yJAVPklM5+4+9dTeKwHOaA+LQkmrKFX96BM0A/2zQrbS6ENCmxc4OVoBs5dPkCCak2roAD+jKCdnmOqKszPkjA==",
            "cpu": [
                "x64"
            ],
@@ -200,9 +200,9 @@
            }
        },
        "node_modules/@esbuild/darwin-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.6.tgz",
-            "integrity": "sha512-FFCssz3XBavjxcFxKsGy2DYK5VSvJqa6y5HXljKzhRZ87LvEi13brPrf/wdyl/BbpbMKJNOr1Sd0jtW4Ge1pAA==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.8.tgz",
+            "integrity": "sha512-Jw0mxgIaYX6R8ODrdkLLPwBqHTtYHJSmzzd+QeytSugzQ0Vg4c5rDky5VgkoowbZQahCbsv1rT1KW72MPIkevw==",
            "cpu": [
                "arm64"
            ],
@@ -217,9 +217,9 @@
            }
        },
        "node_modules/@esbuild/darwin-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.6.tgz",
-            "integrity": "sha512-GfXs5kry/TkGM2vKqK2oyiLFygJRqKVhawu3+DOCk7OxLy/6jYkWXhlHwOoTb0WqGnWGAS7sooxbZowy+pK9Yg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.8.tgz",
+            "integrity": "sha512-Vh2gLxxHnuoQ+GjPNvDSDRpoBCUzY4Pu0kBqMBDlK4fuWbKgGtmDIeEC081xi26PPjn+1tct+Bh8FjyLlw1Zlg==",
            "cpu": [
                "x64"
            ],
@@ -234,9 +234,9 @@
            }
        },
        "node_modules/@esbuild/freebsd-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.6.tgz",
-            "integrity": "sha512-aoLF2c3OvDn2XDTRvn8hN6DRzVVpDlj2B/F66clWd/FHLiHaG3aVZjxQX2DYphA5y/evbdGvC6Us13tvyt4pWg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.8.tgz",
+            "integrity": "sha512-YPJ7hDQ9DnNe5vxOm6jaie9QsTwcKedPvizTVlqWG9GBSq+BuyWEDazlGaDTC5NGU4QJd666V0yqCBL2oWKPfA==",
            "cpu": [
                "arm64"
            ],
@@ -251,9 +251,9 @@
            }
        },
        "node_modules/@esbuild/freebsd-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.6.tgz",
-            "integrity": "sha512-2SkqTjTSo2dYi/jzFbU9Plt1vk0+nNg8YC8rOXXea+iA3hfNJWebKYPs3xnOUf9+ZWhKAaxnQNUf2X9LOpeiMQ==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.8.tgz",
+            "integrity": "sha512-MmaEXxQRdXNFsRN/KcIimLnSJrk2r5H8v+WVafRWz5xdSVmWLoITZQXcgehI2ZE6gioE6HirAEToM/RvFBeuhw==",
            "cpu": [
                "x64"
            ],
@@ -268,9 +268,9 @@
            }
        },
        "node_modules/@esbuild/linux-arm": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.6.tgz",
-            "integrity": "sha512-SZHQlzvqv4Du5PrKE2faN0qlbsaW/3QQfUUc6yO2EjFcA83xnwm91UbEEVx4ApZ9Z5oG8Bxz4qPE+HFwtVcfyw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.8.tgz",
+            "integrity": "sha512-FuzEP9BixzZohl1kLf76KEVOsxtIBFwCaLupVuk4eFVnOZfU+Wsn+x5Ryam7nILV2pkq2TqQM9EZPsOBuMC+kg==",
            "cpu": [
                "arm"
            ],
@@ -285,9 +285,9 @@
            }
        },
        "node_modules/@esbuild/linux-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.6.tgz",
-            "integrity": "sha512-b967hU0gqKd9Drsh/UuAm21Khpoh6mPBSgz8mKRq4P5mVK8bpA+hQzmm/ZwGVULSNBzKdZPQBRT3+WuVavcWsQ==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.8.tgz",
+            "integrity": "sha512-WIgg00ARWv/uYLU7lsuDK00d/hHSfES5BzdWAdAig1ioV5kaFNrtK8EqGcUBJhYqotlUByUKz5Qo6u8tt7iD/w==",
            "cpu": [
                "arm64"
            ],
@@ -302,9 +302,9 @@
            }
        },
        "node_modules/@esbuild/linux-ia32": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.6.tgz",
-            "integrity": "sha512-aHWdQ2AAltRkLPOsKdi3xv0mZ8fUGPdlKEjIEhxCPm5yKEThcUjHpWB1idN74lfXGnZ5SULQSgtr5Qos5B0bPw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.8.tgz",
+            "integrity": "sha512-A1D9YzRX1i+1AJZuFFUMP1E9fMaYY+GnSQil9Tlw05utlE86EKTUA7RjwHDkEitmLYiFsRd9HwKBPEftNdBfjg==",
            "cpu": [
                "ia32"
            ],
@@ -319,9 +319,9 @@
            }
        },
        "node_modules/@esbuild/linux-loong64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.6.tgz",
-            "integrity": "sha512-VgKCsHdXRSQ7E1+QXGdRPlQ/e08bN6WMQb27/TMfV+vPjjTImuT9PmLXupRlC90S1JeNNW5lzkAEO/McKeJ2yg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.8.tgz",
+            "integrity": "sha512-O7k1J/dwHkY1RMVvglFHl1HzutGEFFZ3kNiDMSOyUrB7WcoHGf96Sh+64nTRT26l3GMbCW01Ekh/ThKM5iI7hQ==",
            "cpu": [
                "loong64"
            ],
@@ -336,9 +336,9 @@
            }
        },
        "node_modules/@esbuild/linux-mips64el": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.6.tgz",
-            "integrity": "sha512-WViNlpivRKT9/py3kCmkHnn44GkGXVdXfdc4drNmRl15zVQ2+D2uFwdlGh6IuK5AAnGTo2qPB1Djppj+t78rzw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.8.tgz",
+            "integrity": "sha512-uv+dqfRazte3BzfMp8PAQXmdGHQt2oC/y2ovwpTteqrMx2lwaksiFZ/bdkXJC19ttTvNXBuWH53zy/aTj1FgGw==",
            "cpu": [
                "mips64el"
            ],
@@ -353,9 +353,9 @@
            }
        },
        "node_modules/@esbuild/linux-ppc64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.6.tgz",
-            "integrity": "sha512-wyYKZ9NTdmAMb5730I38lBqVu6cKl4ZfYXIs31Baf8aoOtB4xSGi3THmDYt4BTFHk7/EcVixkOV2uZfwU3Q2Jw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.8.tgz",
+            "integrity": "sha512-GyG0KcMi1GBavP5JgAkkstMGyMholMDybAf8wF5A70CALlDM2p/f7YFE7H92eDeH/VBtFJA5MT4nRPDGg4JuzQ==",
            "cpu": [
                "ppc64"
            ],
@@ -370,9 +370,9 @@
            }
        },
        "node_modules/@esbuild/linux-riscv64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.6.tgz",
-            "integrity": "sha512-KZh7bAGGcrinEj4qzilJ4hqTY3Dg2U82c8bv+e1xqNqZCrCyc+TL9AUEn5WGKDzm3CfC5RODE/qc96OcbIe33w==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.8.tgz",
+            "integrity": "sha512-rAqDYFv3yzMrq7GIcen3XP7TUEG/4LK86LUPMIz6RT8A6pRIDn0sDcvjudVZBiiTcZCY9y2SgYX2lgK3AF+1eg==",
            "cpu": [
                "riscv64"
            ],
@@ -387,9 +387,9 @@
            }
        },
        "node_modules/@esbuild/linux-s390x": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.6.tgz",
-            "integrity": "sha512-9N1LsTwAuE9oj6lHMyyAM+ucxGiVnEqUdp4v7IaMmrwb06ZTEVCIs3oPPplVsnjPfyjmxwHxHMF8b6vzUVAUGw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.8.tgz",
+            "integrity": "sha512-Xutvh6VjlbcHpsIIbwY8GVRbwoviWT19tFhgdA7DlenLGC/mbc3lBoVb7jxj9Z+eyGqvcnSyIltYUrkKzWqSvg==",
            "cpu": [
                "s390x"
            ],
@@ -404,9 +404,9 @@
            }
        },
        "node_modules/@esbuild/linux-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.6.tgz",
-            "integrity": "sha512-A6bJB41b4lKFWRKNrWoP2LHsjVzNiaurf7wyj/XtFNTsnPuxwEBWHLty+ZE0dWBKuSK1fvKgrKaNjBS7qbFKig==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.8.tgz",
+            "integrity": "sha512-ASFQhgY4ElXh3nDcOMTkQero4b1lgubskNlhIfJrsH5OKZXDpUAKBlNS0Kx81jwOBp+HCeZqmoJuihTv57/jvQ==",
            "cpu": [
                "x64"
            ],
@@ -421,9 +421,9 @@
            }
        },
        "node_modules/@esbuild/netbsd-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.6.tgz",
-            "integrity": "sha512-IjA+DcwoVpjEvyxZddDqBY+uJ2Snc6duLpjmkXm/v4xuS3H+3FkLZlDm9ZsAbF9rsfP3zeA0/ArNDORZgrxR/Q==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.8.tgz",
+            "integrity": "sha512-d1KfruIeohqAi6SA+gENMuObDbEjn22olAR7egqnkCD9DGBG0wsEARotkLgXDu6c4ncgWTZJtN5vcgxzWRMzcw==",
            "cpu": [
                "arm64"
            ],
@@ -438,9 +438,9 @@
            }
        },
        "node_modules/@esbuild/netbsd-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.6.tgz",
-            "integrity": "sha512-dUXuZr5WenIDlMHdMkvDc1FAu4xdWixTCRgP7RQLBOkkGgwuuzaGSYcOpW4jFxzpzL1ejb8yF620UxAqnBrR9g==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.8.tgz",
+            "integrity": "sha512-nVDCkrvx2ua+XQNyfrujIG38+YGyuy2Ru9kKVNyh5jAys6n+l44tTtToqHjino2My8VAY6Lw9H7RI73XFi66Cg==",
            "cpu": [
                "x64"
            ],
@@ -455,9 +455,9 @@
            }
        },
        "node_modules/@esbuild/openbsd-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.6.tgz",
-            "integrity": "sha512-l8ZCvXP0tbTJ3iaqdNf3pjaOSd5ex/e6/omLIQCVBLmHTlfXW3zAxQ4fnDmPLOB1x9xrcSi/xtCWFwCZRIaEwg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.8.tgz",
+            "integrity": "sha512-j8HgrDuSJFAujkivSMSfPQSAa5Fxbvk4rgNAS5i3K+r8s1X0p1uOO2Hl2xNsGFppOeHOLAVgYwDVlmxhq5h+SQ==",
            "cpu": [
                "arm64"
            ],
@@ -472,9 +472,9 @@
            }
        },
        "node_modules/@esbuild/openbsd-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.6.tgz",
-            "integrity": "sha512-hKrmDa0aOFOr71KQ/19JC7az1P0GWtCN1t2ahYAf4O007DHZt/dW8ym5+CUdJhQ/qkZmI1HAF8KkJbEFtCL7gw==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.8.tgz",
+            "integrity": "sha512-1h8MUAwa0VhNCDp6Af0HToI2TJFAn1uqT9Al6DJVzdIBAd21m/G0Yfc77KDM3uF3T/YaOgQq3qTJHPbTOInaIQ==",
            "cpu": [
                "x64"
            ],
@@ -489,9 +489,9 @@
            }
        },
        "node_modules/@esbuild/openharmony-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.6.tgz",
-            "integrity": "sha512-+SqBcAWoB1fYKmpWoQP4pGtx+pUUC//RNYhFdbcSA16617cchuryuhOCRpPsjCblKukAckWsV+aQ3UKT/RMPcA==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.8.tgz",
+            "integrity": "sha512-r2nVa5SIK9tSWd0kJd9HCffnDHKchTGikb//9c7HX+r+wHYCpQrSgxhlY6KWV1nFo1l4KFbsMlHk+L6fekLsUg==",
            "cpu": [
                "arm64"
            ],
@@ -506,9 +506,9 @@
            }
        },
        "node_modules/@esbuild/sunos-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.6.tgz",
-            "integrity": "sha512-dyCGxv1/Br7MiSC42qinGL8KkG4kX0pEsdb0+TKhmJZgCUDBGmyo1/ArCjNGiOLiIAgdbWgmWgib4HoCi5t7kA==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.8.tgz",
+            "integrity": "sha512-zUlaP2S12YhQ2UzUfcCuMDHQFJyKABkAjvO5YSndMiIkMimPmxA+BYSBikWgsRpvyxuRnow4nS5NPnf9fpv41w==",
            "cpu": [
                "x64"
            ],
@@ -523,9 +523,9 @@
            }
        },
        "node_modules/@esbuild/win32-arm64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.6.tgz",
-            "integrity": "sha512-42QOgcZeZOvXfsCBJF5Afw73t4veOId//XD3i+/9gSkhSV6Gk3VPlWncctI+JcOyERv85FUo7RxuxGy+z8A43Q==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.8.tgz",
+            "integrity": "sha512-YEGFFWESlPva8hGL+zvj2z/SaK+pH0SwOM0Nc/d+rVnW7GSTFlLBGzZkuSU9kFIGIo8q9X3ucpZhu8PDN5A2sQ==",
            "cpu": [
                "arm64"
            ],
@@ -540,9 +540,9 @@
            }
        },
        "node_modules/@esbuild/win32-ia32": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.6.tgz",
-            "integrity": "sha512-4AWhgXmDuYN7rJI6ORB+uU9DHLq/erBbuMoAuB4VWJTu5KtCgcKYPynF0YI1VkBNuEfjNlLrFr9KZPJzrtLkrQ==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.8.tgz",
+            "integrity": "sha512-hiGgGC6KZ5LZz58OL/+qVVoZiuZlUYlYHNAmczOm7bs2oE1XriPFi5ZHHrS8ACpV5EjySrnoCKmcbQMN+ojnHg==",
            "cpu": [
                "ia32"
            ],
@@ -557,9 +557,9 @@
            }
        },
        "node_modules/@esbuild/win32-x64": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.6.tgz",
-            "integrity": "sha512-NgJPHHbEpLQgDH2MjQu90pzW/5vvXIZ7KOnPyNBm92A6WgZ/7b6fJyUBjoumLqeOQQGqY2QjQxRo97ah4Sj0cA==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.8.tgz",
+            "integrity": "sha512-cn3Yr7+OaaZq1c+2pe+8yxC8E144SReCQjN6/2ynubzYjvyqZjTXfQJpAcQpsdJq3My7XADANiYGHoFC69pLQw==",
            "cpu": [
                "x64"
            ],
@@ -832,9 +832,9 @@
            }
        },
        "node_modules/@pkgr/core": {
-            "version": "0.2.7",
-            "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.7.tgz",
-            "integrity": "sha512-YLT9Zo3oNPJoBjBc4q8G2mjU4tqIbf5CEOORbUUr48dCD9q3umJ3IPlVqOqDakPfd2HuwccBaqlGhN4Gmr5OWg==",
+            "version": "0.2.9",
+            "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
+            "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -904,9 +904,9 @@
            }
        },
        "node_modules/@types/node": {
-            "version": "24.0.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.10.tgz",
-            "integrity": "sha512-ENHwaH+JIRTDIEEbDK6QSQntAYGtbvdDXnMXnZaZ6k13Du1dPMmprkEHIL7ok2Wl2aZevetwTAb5S+7yIF+enA==",
+            "version": "24.0.15",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.15.tgz",
+            "integrity": "sha512-oaeTSbCef7U/z7rDeJA138xpG3NuKc64/rZ2qmUFkFJmnMsAPaluIifqyWd8hSSMxyP9oie3dLAqYPblag9KgA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -1269,9 +1269,9 @@
            }
        },
        "node_modules/esbuild": {
-            "version": "0.25.6",
-            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.6.tgz",
-            "integrity": "sha512-GVuzuUwtdsghE3ocJ9Bs8PNoF13HNQ5TXbEi2AhvVb8xU1Iwt9Fos9FEamfoee+u/TOsn7GUWc04lz46n2bbTg==",
+            "version": "0.25.8",
+            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.8.tgz",
+            "integrity": "sha512-vVC0USHGtMi8+R4Kz8rt6JhEWLxsv9Rnu/lGYbPR8u47B+DCBksq9JarW0zOO7bs37hyOK1l2/oqtbciutL5+Q==",
            "dev": true,
            "hasInstallScript": true,
            "license": "MIT",
@@ -1282,32 +1282,32 @@
                "node": ">=18"
            },
            "optionalDependencies": {
-                "@esbuild/aix-ppc64": "0.25.6",
-                "@esbuild/android-arm": "0.25.6",
-                "@esbuild/android-arm64": "0.25.6",
-                "@esbuild/android-x64": "0.25.6",
-                "@esbuild/darwin-arm64": "0.25.6",
-                "@esbuild/darwin-x64": "0.25.6",
-                "@esbuild/freebsd-arm64": "0.25.6",
-                "@esbuild/freebsd-x64": "0.25.6",
-                "@esbuild/linux-arm": "0.25.6",
-                "@esbuild/linux-arm64": "0.25.6",
-                "@esbuild/linux-ia32": "0.25.6",
-                "@esbuild/linux-loong64": "0.25.6",
-                "@esbuild/linux-mips64el": "0.25.6",
-                "@esbuild/linux-ppc64": "0.25.6",
-                "@esbuild/linux-riscv64": "0.25.6",
-                "@esbuild/linux-s390x": "0.25.6",
-                "@esbuild/linux-x64": "0.25.6",
-                "@esbuild/netbsd-arm64": "0.25.6",
-                "@esbuild/netbsd-x64": "0.25.6",
-                "@esbuild/openbsd-arm64": "0.25.6",
-                "@esbuild/openbsd-x64": "0.25.6",
-                "@esbuild/openharmony-arm64": "0.25.6",
-                "@esbuild/sunos-x64": "0.25.6",
-                "@esbuild/win32-arm64": "0.25.6",
-                "@esbuild/win32-ia32": "0.25.6",
-                "@esbuild/win32-x64": "0.25.6"
+                "@esbuild/aix-ppc64": "0.25.8",
+                "@esbuild/android-arm": "0.25.8",
+                "@esbuild/android-arm64": "0.25.8",
+                "@esbuild/android-x64": "0.25.8",
+                "@esbuild/darwin-arm64": "0.25.8",
+                "@esbuild/darwin-x64": "0.25.8",
+                "@esbuild/freebsd-arm64": "0.25.8",
+                "@esbuild/freebsd-x64": "0.25.8",
+                "@esbuild/linux-arm": "0.25.8",
+                "@esbuild/linux-arm64": "0.25.8",
+                "@esbuild/linux-ia32": "0.25.8",
+                "@esbuild/linux-loong64": "0.25.8",
+                "@esbuild/linux-mips64el": "0.25.8",
+                "@esbuild/linux-ppc64": "0.25.8",
+                "@esbuild/linux-riscv64": "0.25.8",
+                "@esbuild/linux-s390x": "0.25.8",
+                "@esbuild/linux-x64": "0.25.8",
+                "@esbuild/netbsd-arm64": "0.25.8",
+                "@esbuild/netbsd-x64": "0.25.8",
+                "@esbuild/openbsd-arm64": "0.25.8",
+                "@esbuild/openbsd-x64": "0.25.8",
+                "@esbuild/openharmony-arm64": "0.25.8",
+                "@esbuild/sunos-x64": "0.25.8",
+                "@esbuild/win32-arm64": "0.25.8",
+                "@esbuild/win32-ia32": "0.25.8",
+                "@esbuild/win32-x64": "0.25.8"
            }
        },
        "node_modules/escape-string-regexp": {
@@ -2260,9 +2260,9 @@
            "license": "ISC"
        },
        "node_modules/picomatch": {
-            "version": "4.0.2",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
-            "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
+            "version": "4.0.3",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+            "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -2328,14 +2328,14 @@
            }
        },
        "node_modules/prettier-plugin-packagejson": {
-            "version": "2.5.17",
-            "resolved": "https://registry.npmjs.org/prettier-plugin-packagejson/-/prettier-plugin-packagejson-2.5.17.tgz",
-            "integrity": "sha512-1WYvhTix+4EMYZQYSjAxb6+KTCULINuHUTBcxYa2ipoUS9Y2zJVjE3kuZ5I7ZWIFqyK8xpwYIunXqN5eiT7Hew==",
+            "version": "2.5.19",
+            "resolved": "https://registry.npmjs.org/prettier-plugin-packagejson/-/prettier-plugin-packagejson-2.5.19.tgz",
+            "integrity": "sha512-Qsqp4+jsZbKMpEGZB1UP1pxeAT8sCzne2IwnKkr+QhUe665EXUo3BAvTf1kAPCqyMv9kg3ZmO0+7eOni/C6Uag==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "sort-package-json": "3.3.1",
-                "synckit": "0.11.8"
+                "sort-package-json": "3.4.0",
+                "synckit": "0.11.11"
            },
            "peerDependencies": {
                "prettier": ">= 1.16.0"
@@ -2507,9 +2507,9 @@
            "license": "MIT"
        },
        "node_modules/sort-package-json": {
-            "version": "3.3.1",
-            "resolved": "https://registry.npmjs.org/sort-package-json/-/sort-package-json-3.3.1.tgz",
-            "integrity": "sha512-awjhQR2Iy5UN3NuguAK5+RezcEuUg9Ra4O8y2Aj+DlJa7MywyHaipAPf9bu4qqFj0hsYHHoT9sS3aV7Ucu728g==",
+            "version": "3.4.0",
+            "resolved": "https://registry.npmjs.org/sort-package-json/-/sort-package-json-3.4.0.tgz",
+            "integrity": "sha512-97oFRRMM2/Js4oEA9LJhjyMlde+2ewpZQf53pgue27UkbEXfHJnDzHlUxQ/DWUkzqmp7DFwJp8D+wi/TYeQhpA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -2628,13 +2628,13 @@
            }
        },
        "node_modules/synckit": {
-            "version": "0.11.8",
-            "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.8.tgz",
-            "integrity": "sha512-+XZ+r1XGIJGeQk3VvXhT6xx/VpbHsRzsTkGgF6E5RX9TTXD0118l87puaEBZ566FhqblC6U0d4XnubznJDm30A==",
+            "version": "0.11.11",
+            "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.11.tgz",
+            "integrity": "sha512-MeQTA1r0litLUf0Rp/iisCaL8761lKAZHaimlbGK4j0HysC4PLfqygQj9srcs0m2RdtDYnF8UuYyKpbjHYp7Jw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "@pkgr/core": "^0.2.4"
+                "@pkgr/core": "^0.2.9"
            },
            "engines": {
                "node": "^14.18.0 || >=16.0.0"
@@ -2728,9 +2728,9 @@
            }
        },
        "node_modules/typedoc-plugin-markdown": {
-            "version": "4.7.0",
-            "resolved": "https://registry.npmjs.org/typedoc-plugin-markdown/-/typedoc-plugin-markdown-4.7.0.tgz",
-            "integrity": "sha512-PitbnAps2vpcqK2gargKoiFXLWFttvwUbyns/E6zGIFG5Gz8ZQJGttHnYR9csOlcSjB/uyjd8tnoayrtsXG17w==",
+            "version": "4.7.1",
+            "resolved": "https://registry.npmjs.org/typedoc-plugin-markdown/-/typedoc-plugin-markdown-4.7.1.tgz",
+            "integrity": "sha512-HN/fHLm2S6MD4HX8txfB4eWvVBzX/mEYy5U5s1KTAdh3E5uX5/lilswqTzZlPTT6fNZInAboAdFGpbAuBKnE4A==",
            "dev": true,
            "license": "MIT",
            "engines": {
--- a/packages/eslint-config/index.js
+++ b/packages/eslint-config/index.js
@@ -23,9 +23,8 @@ export const DefaultIgnorePatterns = [
    "**/out",
    "**/dist",
    "**/.wireit",
-    // TODO: Replace after moving to `docs` directory.
-    "website/**/build/**",
-    "website/**/.docusaurus/**",
+    "website/build/**",
+    "website/.docusaurus/**",
    "**/node_modules",
    "**/coverage",
    "**/storybook-static",
--- a/packages/eslint-config/package-lock.json
+++ b/packages/eslint-config/package-lock.json
@@ -237,9 +237,9 @@
            }
        },
        "node_modules/@eslint/core": {
-            "version": "0.14.0",
-            "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.14.0.tgz",
-            "integrity": "sha512-qIbV0/JZr7iSDjqAc60IqbLdsj9GDt16xQtWD+B78d/HAlvysGdZZ6rpJHGAc2T0FQx1X6thsSPdnoiGKdNtdg==",
+            "version": "0.15.1",
+            "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.15.1.tgz",
+            "integrity": "sha512-bkOp+iumZCCbt1K1CmWf0R9pM5yKpDv+ZXtvSyQpudrI9kuFLp+bM2WOPXImuD/ceQuaa8f5pj93Y7zyECIGNA==",
            "license": "Apache-2.0",
            "dependencies": {
                "@types/json-schema": "^7.0.15"
@@ -292,12 +292,12 @@
            }
        },
        "node_modules/@eslint/plugin-kit": {
-            "version": "0.3.1",
-            "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.3.1.tgz",
-            "integrity": "sha512-0J+zgWxHN+xXONWIyPWKFMgVuJoZuGiIFu8yxk7RJjxkzpGmyja5wRFqZIVtjDVOQpV+Rw0iOAjYPE2eQyjr0w==",
+            "version": "0.3.3",
+            "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.3.3.tgz",
+            "integrity": "sha512-1+WqvgNMhmlAambTvT3KPtCl/Ibr68VldY2XY40SL1CE0ZXiakFR/cbTspaF5HsnpDMvcYYoJHfl4980NBjGag==",
            "license": "Apache-2.0",
            "dependencies": {
-                "@eslint/core": "^0.14.0",
+                "@eslint/core": "^0.15.1",
                "levn": "^0.4.1"
            },
            "engines": {
@@ -1822,18 +1822,6 @@
                "url": "https://opencollective.com/eslint"
            }
        },
-        "node_modules/eslint/node_modules/@eslint/core": {
-            "version": "0.15.1",
-            "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.15.1.tgz",
-            "integrity": "sha512-bkOp+iumZCCbt1K1CmWf0R9pM5yKpDv+ZXtvSyQpudrI9kuFLp+bM2WOPXImuD/ceQuaa8f5pj93Y7zyECIGNA==",
-            "license": "Apache-2.0",
-            "dependencies": {
-                "@types/json-schema": "^7.0.15"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            }
-        },
        "node_modules/espree": {
            "version": "10.4.0",
            "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
--- a/packages/prettier-config/package-lock.json
+++ b/packages/prettier-config/package-lock.json
@@ -360,9 +360,9 @@
            "license": "MIT"
        },
        "node_modules/@pkgr/core": {
-            "version": "0.2.7",
-            "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.7.tgz",
-            "integrity": "sha512-YLT9Zo3oNPJoBjBc4q8G2mjU4tqIbf5CEOORbUUr48dCD9q3umJ3IPlVqOqDakPfd2HuwccBaqlGhN4Gmr5OWg==",
+            "version": "0.2.9",
+            "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
+            "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -385,9 +385,9 @@
            "license": "MIT"
        },
        "node_modules/@types/node": {
-            "version": "24.0.4",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.4.tgz",
-            "integrity": "sha512-ulyqAkrhnuNq9pB76DRBTkcS6YsmDALy6Ua63V8OhrOBgbcYt6IOdzpw5P1+dyRIyMerzLkeYWBeOXPpA9GMAA==",
+            "version": "24.0.15",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.15.tgz",
+            "integrity": "sha512-oaeTSbCef7U/z7rDeJA138xpG3NuKc64/rZ2qmUFkFJmnMsAPaluIifqyWd8hSSMxyP9oie3dLAqYPblag9KgA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -1401,9 +1401,9 @@
            "license": "ISC"
        },
        "node_modules/picomatch": {
-            "version": "4.0.2",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
-            "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
+            "version": "4.0.3",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+            "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -1466,14 +1466,14 @@
            }
        },
        "node_modules/prettier-plugin-packagejson": {
-            "version": "2.5.16",
-            "resolved": "https://registry.npmjs.org/prettier-plugin-packagejson/-/prettier-plugin-packagejson-2.5.16.tgz",
-            "integrity": "sha512-1EORN4SahAWU55ll+xp0PXhiUmD93PJlBE88GbWv7X5xtZ7ycj3GNbRGX+r75zWn70KAoYVO08rF2C/TqGCHPA==",
+            "version": "2.5.19",
+            "resolved": "https://registry.npmjs.org/prettier-plugin-packagejson/-/prettier-plugin-packagejson-2.5.19.tgz",
+            "integrity": "sha512-Qsqp4+jsZbKMpEGZB1UP1pxeAT8sCzne2IwnKkr+QhUe665EXUo3BAvTf1kAPCqyMv9kg3ZmO0+7eOni/C6Uag==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "sort-package-json": "3.2.2",
-                "synckit": "0.11.8"
+                "sort-package-json": "3.4.0",
+                "synckit": "0.11.11"
            },
            "peerDependencies": {
                "prettier": ">= 1.16.0"
@@ -1556,9 +1556,9 @@
            "license": "MIT"
        },
        "node_modules/sort-package-json": {
-            "version": "3.2.2",
-            "resolved": "https://registry.npmjs.org/sort-package-json/-/sort-package-json-3.2.2.tgz",
-            "integrity": "sha512-twAMvmzOcEPsN3N9zKPDpl6zproGU0JcBOQFU4T6e5wrStH8iuPiAjFz9g+cMRC52eQBUbZlFCeGt+F4vginkw==",
+            "version": "3.4.0",
+            "resolved": "https://registry.npmjs.org/sort-package-json/-/sort-package-json-3.4.0.tgz",
+            "integrity": "sha512-97oFRRMM2/Js4oEA9LJhjyMlde+2ewpZQf53pgue27UkbEXfHJnDzHlUxQ/DWUkzqmp7DFwJp8D+wi/TYeQhpA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -1572,6 +1572,9 @@
            },
            "bin": {
                "sort-package-json": "cli.js"
+            },
+            "engines": {
+                "node": ">=20"
            }
        },
        "node_modules/source-map-js": {
@@ -1654,13 +1657,13 @@
            }
        },
        "node_modules/synckit": {
-            "version": "0.11.8",
-            "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.8.tgz",
-            "integrity": "sha512-+XZ+r1XGIJGeQk3VvXhT6xx/VpbHsRzsTkGgF6E5RX9TTXD0118l87puaEBZ566FhqblC6U0d4XnubznJDm30A==",
+            "version": "0.11.11",
+            "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.11.tgz",
+            "integrity": "sha512-MeQTA1r0litLUf0Rp/iisCaL8761lKAZHaimlbGK4j0HysC4PLfqygQj9srcs0m2RdtDYnF8UuYyKpbjHYp7Jw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "@pkgr/core": "^0.2.4"
+                "@pkgr/core": "^0.2.9"
            },
            "engines": {
                "node": "^14.18.0 || >=16.0.0"
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -44,7 +44,7 @@ dependencies = [
    "kubernetes==33.1.0",
    "ldap3==2.9.1",
    "lxml==6.0.0",
-    "msgraph-sdk==1.37.0",
+    "msgraph-sdk==1.38.0",
    "opencontainers==0.0.15",
    "packaging==25.0",
    "paramiko==3.5.1",
@@ -144,18 +144,13 @@ skip = [
    "**/web/out",
    "./web/storybook-static",
    "./web/custom-elements.json",
-    # TODO: Remove this after moving website to docs
    "./website/build",
-    "./website/api/build",
-    "./website/integrations/build",
-    "./docs/build",
-    "./docs/api/build",
-    "./docs/integrations/build",
    "./gen-ts-api",
    "./gen-py-api",
    "./gen-go-api",
    "*.api.mdx",
    "./htmlcov",
+    "./media",
 ]
 dictionary = ".github/codespell-dictionary.txt,-"
 ignore-words = ".github/codespell-words.txt"
@@ -205,9 +200,7 @@ omit = [
    "*/migrations/*",
    "*/management/commands/*",
    "*/apps.py",
-    # TODO: Remove this after moving website to docs
    "website/",
-    "docs/",
 ]

 [tool.coverage.report]
--- a/tests/e2e/test_provider_radius.py
+++ b/tests/e2e/test_provider_radius.py
@@ -3,7 +3,7 @@
 from dataclasses import asdict
 from time import sleep

-from pyrad.client import Client
+from pyrad.client import Client, Timeout
 from pyrad.dictionary import Dictionary
 from pyrad.packet import AccessAccept, AccessReject, AccessRequest

@@ -27,7 +27,7 @@ class TestProviderRadius(SeleniumTestCase):
        """Start radius container based on outpost created"""
        self.run_container(
            image=self.get_container_image("ghcr.io/goauthentik/dev-radius"),
-            ports={"1812/udp": "1812/udp"},
+            ports={"1812/udp": 1812},
            environment={
                "AUTHENTIK_TOKEN": outpost.token.key,
            },
@@ -63,7 +63,7 @@ class TestProviderRadius(SeleniumTestCase):
        sleep(5)
        return outpost

-    @retry()
+    @retry(exceptions=[Timeout])
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
@@ -85,7 +85,7 @@ class TestProviderRadius(SeleniumTestCase):
        reply = srv.SendPacket(req)
        self.assertEqual(reply.code, AccessAccept)

-    @retry()
+    @retry(exceptions=[Timeout])
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
--- a/uv.lock
+++ b/uv.lock
@@ -306,7 +306,7 @@ requires-dist = [
    { name = "kubernetes", specifier = "==33.1.0" },
    { name = "ldap3", specifier = "==2.9.1" },
    { name = "lxml", specifier = "==6.0.0" },
-    { name = "msgraph-sdk", specifier = "==1.37.0" },
+    { name = "msgraph-sdk", specifier = "==1.38.0" },
    { name = "opencontainers", git = "https://github.com/vsoch/oci-python?rev=ceb4fcc090851717a3069d78e85ceb1e86c2740c" },
    { name = "packaging", specifier = "==25.0" },
    { name = "paramiko", specifier = "==3.5.1" },
@@ -2071,7 +2071,7 @@ wheels = [

 [[package]]
 name = "msgraph-sdk"
-version = "1.37.0"
+version = "1.38.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "azure-identity" },
@@ -2081,9 +2081,9 @@ dependencies = [
    { name = "microsoft-kiota-serialization-text" },
    { name = "msgraph-core" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a5/97/c3da48fa964afa07f5dd644d0fca57dbf6bb6a254c6741e10e1fb1552195/msgraph_sdk-1.37.0.tar.gz", hash = "sha256:92ccafe9f3d10f92e3d24794ff77924e4cc4f03202278595d3221f8cf1220d2f", size = 6001375, upload-time = "2025-07-08T12:33:35.195Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/10/4a/1231a710be05849b8f2c2ce484dcc5a84066bbbc01e8e2c0e7b812a8909c/msgraph_sdk-1.38.0.tar.gz", hash = "sha256:4bb5b30515e64de1e507641f923a348ce83bacb52e2703bb941c144a319c4ca7", size = 6085852, upload-time = "2025-07-17T01:14:36.377Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/77/22/8985a3fee5ed411f12775541898b2a9d470afd230419b709b5318da84556/msgraph_sdk-1.37.0-py3-none-any.whl", hash = "sha256:e51580cb12b78984280cf3094892e254f34405c9bd6450931b0baa91d7dad8f6", size = 24606234, upload-time = "2025-07-08T12:33:31.986Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/79/a97b43015afd7112b6f6b0ec1cc65fd06d4f0a9f6737427ba6faf1d5aed4/msgraph_sdk-1.38.0-py3-none-any.whl", hash = "sha256:a6c4725085323152581ed9c9b3433b3f4b6a2e3365a2674354c78a72da8bce9a", size = 24989016, upload-time = "2025-07-17T01:14:32.033Z" },
 ]

 [[package]]
--- a/web/bundler/mdx-plugin/node.js
+++ b/web/bundler/mdx-plugin/node.js
@@ -40,8 +40,6 @@ const pluginName = "mdx-plugin";
 * @returns {Plugin}
 */
 export function mdxPlugin({ root }) {
-    const prefix = "~docs";
-
    // TODO: Replace with `resolvePackage` after NPM Workspaces support is added.
    const docsPackageRoot = path.resolve(MonoRepoRoot, "website");

@@ -57,8 +55,7 @@ export function mdxPlugin({ root }) {
            if (!args.path.startsWith("~")) return args;

            return {
-                path: path.join(docsPackageRoot, "docs", args.path.slice(prefix.length)),
-
+                path: path.resolve(docsPackageRoot, args.path.slice(1)),
                pluginName,
            };
        }
@@ -78,7 +75,7 @@ export function mdxPlugin({ root }) {

            const publicPath = path.resolve(
                "/",
-                path.relative(path.join(root, "website", "docs"), data.path),
+                path.relative(path.join(root, "website"), data.path),
            );
            const publicDirectory = path.dirname(publicPath);

--- a/web/package-lock.json
+++ b/web/package-lock.json
--- a/web/package.json
+++ b/web/package.json
@@ -88,8 +88,8 @@
        "@codemirror/lang-javascript": "^6.2.4",
        "@codemirror/lang-python": "^6.2.1",
        "@codemirror/lang-xml": "^6.1.0",
-        "@codemirror/legacy-modes": "^6.4.1",
-        "@codemirror/theme-one-dark": "^6.1.2",
+        "@codemirror/legacy-modes": "^6.5.1",
+        "@codemirror/theme-one-dark": "^6.1.3",
        "@floating-ui/dom": "^1.6.11",
        "@formatjs/intl-listformat": "^7.7.11",
        "@fortawesome/fontawesome-free": "^6.7.2",
@@ -97,7 +97,7 @@
        "@lit/context": "^1.1.2",
        "@lit/localize": "^0.12.2",
        "@lit/reactive-element": "^2.0.4",
-        "@lit/task": "^1.0.2",
+        "@lit/task": "^1.0.3",
        "@mdx-js/mdx": "^3.1.0",
        "@mrmarble/djangoql-completion": "^0.8.3",
        "@open-wc/lit-helpers": "^0.7.0",
@@ -105,16 +105,16 @@
        "@openlayers-elements/maps": "^0.4.0",
        "@patternfly/elements": "^4.1.0",
        "@patternfly/patternfly": "^4.224.2",
-        "@sentry/browser": "^9.39.0",
+        "@sentry/browser": "^9.40.0",
        "@spotlightjs/spotlight": "^3.0.1",
        "@webcomponents/webcomponentsjs": "^2.8.0",
        "base64-js": "^1.5.1",
        "change-case": "^5.4.4",
-        "chart.js": "^4.4.9",
+        "chart.js": "^4.5.0",
        "chartjs-adapter-date-fns": "^3.0.0",
-        "codemirror": "^6.0.1",
+        "codemirror": "^6.0.2",
        "construct-style-sheets-polyfill": "^3.1.0",
-        "core-js": "^3.42.0",
+        "core-js": "^3.44.0",
        "country-flag-icons": "^1.5.19",
        "date-fns": "^4.1.0",
        "deepmerge-ts": "^7.1.5",
@@ -124,7 +124,7 @@
        "hastscript": "^9.0.1",
        "lit": "^3.2.0",
        "md-front-matter": "^1.0.4",
-        "mermaid": "^11.6.0",
+        "mermaid": "^11.9.0",
        "rapidoc": "^9.3.8",
        "react": "^19.1.0",
        "react-dom": "^19.1.0",
@@ -156,13 +156,13 @@
        "@storybook/addon-links": "^9.0.17",
        "@storybook/web-components": "^9.0.17",
        "@storybook/web-components-vite": "^9.0.17",
-        "@types/chart.js": "^2.9.41",
+        "@types/chart.js": "^4.0.1",
        "@types/codemirror": "^5.60.15",
-        "@types/dompurify": "^3.0.5",
+        "@types/dompurify": "^3.2.0",
        "@types/grecaptcha": "^3.0.9",
        "@types/guacamole-common-js": "^1.5.3",
        "@types/mocha": "^10.0.10",
-        "@types/node": "^22.15.21",
+        "@types/node": "^24.0.15",
        "@types/react": "^19.1.8",
        "@types/react-dom": "^19.1.6",
        "@typescript-eslint/eslint-plugin": "^8.8.0",
@@ -172,7 +172,7 @@
        "@wdio/spec-reporter": "^9.15.0",
        "@web/test-runner": "^0.20.2",
        "chromedriver": "^136.0.3",
-        "esbuild": "^0.25.6",
+        "esbuild": "^0.25.8",
        "esbuild-plugin-copy": "^2.1.1",
        "esbuild-plugin-polyfill-node": "^0.3.0",
        "esbuild-plugins-node-modules-polyfill": "^1.7.1",
@@ -181,7 +181,7 @@
        "eslint-plugin-wc": "^3.0.1",
        "github-slugger": "^2.0.0",
        "globals": "^15.10.0",
-        "knip": "^5.58.0",
+        "knip": "^5.61.3",
        "lit-analyzer": "^2.0.3",
        "npm-run-all": "^4.1.5",
        "prettier": "^3.3.3",
--- a/web/packages/core/package.json
+++ b/web/packages/core/package.json
@@ -47,7 +47,7 @@
    "devDependencies": {
        "@goauthentik/prettier-config": "^1.0.5",
        "@goauthentik/tsconfig": "^1.0.4",
-        "@types/node": "^22.15.21",
+        "@types/node": "^24.0.15",
        "prettier": "^3.3.3",
        "typescript": "^5.6.3"
    },
--- a/web/packages/sfe/package.json
+++ b/web/packages/sfe/package.json
@@ -12,7 +12,7 @@
    "dependencies": {
        "@goauthentik/api": "^2024.6.0-1719577139",
        "base64-js": "^1.5.1",
-        "bootstrap": "^4.6.1",
+        "bootstrap": "^5.3.7",
        "formdata-polyfill": "^4.0.10",
        "jquery": "^3.7.1",
        "weakmap-polyfill": "^2.0.4"
@@ -23,7 +23,7 @@
        "@rollup/plugin-node-resolve": "^16.0.1",
        "@rollup/plugin-swc": "^0.4.0",
        "@swc/cli": "^0.7.8",
-        "@swc/core": "^1.12.14",
+        "@swc/core": "^1.13.1",
        "@trivago/prettier-plugin-sort-imports": "^5.2.2",
        "prettier": "^3.5.3",
        "rollup": "^4.45.1",
--- a/web/src/admin/AdminInterface/AboutModal.ts
+++ b/web/src/admin/AdminInterface/AboutModal.ts
@@ -59,7 +59,7 @@ export class AboutModal extends WithLicenseSummary(WithBrandConfig(ModalButton))
    renderModal() {
        let product = this.brandingTitle;

-        if (this.licenseSummary.status !== LicenseSummaryStatusEnum.Unlicensed) {
+        if (this.licenseSummary?.status !== LicenseSummaryStatusEnum.Unlicensed) {
            product += ` ${msg("Enterprise")}`;
        }
        return html`<div
--- a/web/src/admin/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
+++ b/web/src/admin/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
@@ -161,38 +161,6 @@ export class AuthenticatorSMSStageForm extends BaseStageForm<AuthenticatorSMSSta
                    ${msg("This is the password to be used with basic auth")}
                </p>
            </ak-form-element-horizontal>
-            <ak-form-element-horizontal label=${msg("Mapping")} name="mapping">
-                <ak-search-select
-                    .fetchObjects=${async (
-                        query?: string,
-                    ): Promise<NotificationWebhookMapping[]> => {
-                        const args: PropertymappingsNotificationListRequest = {
-                            ordering: "saml_name",
-                        };
-                        if (query !== undefined) {
-                            args.search = query;
-                        }
-                        const items = await new PropertymappingsApi(
-                            DEFAULT_CONFIG,
-                        ).propertymappingsNotificationList(args);
-                        return items.results;
-                    }}
-                    .renderElement=${(item: NotificationWebhookMapping): string => {
-                        return item.name;
-                    }}
-                    .value=${(item: NotificationWebhookMapping | undefined): string | undefined => {
-                        return item?.pk;
-                    }}
-                    .selected=${(item: NotificationWebhookMapping): boolean => {
-                        return this.instance?.mapping === item.pk;
-                    }}
-                    blankable
-                >
-                </ak-search-select>
-                <p class="pf-c-form__helper-text">
-                    ${msg("Modify the payload sent to the custom provider.")}
-                </p>
-            </ak-form-element-horizontal>
        `;
    }

@@ -269,6 +237,38 @@ export class AuthenticatorSMSStageForm extends BaseStageForm<AuthenticatorSMSSta
                    ${this.provider === ProviderEnum.Generic
                        ? this.renderProviderGeneric()
                        : this.renderProviderTwillio()}
+                    <ak-form-element-horizontal label=${msg("Mapping")} name="mapping">
+                        <ak-search-select
+                            .fetchObjects=${async (
+                                query?: string,
+                            ): Promise<NotificationWebhookMapping[]> => {
+                                const args: PropertymappingsNotificationListRequest = {
+                                    ordering: "name",
+                                };
+                                if (query) {
+                                    args.search = query;
+                                }
+                                const items = await new PropertymappingsApi(
+                                    DEFAULT_CONFIG,
+                                ).propertymappingsNotificationList(args);
+                                return items.results;
+                            }}
+                            .renderElement=${(item: NotificationWebhookMapping): string => {
+                                return item.name;
+                            }}
+                            .value=${(item?: NotificationWebhookMapping) => {
+                                return item?.pk;
+                            }}
+                            .selected=${(item: NotificationWebhookMapping): boolean => {
+                                return this.instance?.mapping === item.pk;
+                            }}
+                            blankable
+                        >
+                        </ak-search-select>
+                        <p class="pf-c-form__helper-text">
+                            ${msg("Modify the payload sent to the provider.")}
+                        </p>
+                    </ak-form-element-horizontal>
                    <ak-form-element-horizontal name="verifyOnly">
                        <label class="pf-c-switch">
                            <input
--- a/web/src/elements/ak-mdx/components/MDXAnchor.tsx
+++ b/web/src/elements/ak-mdx/components/MDXAnchor.tsx
@@ -4,7 +4,7 @@ import { useMDXModule } from "#elements/ak-mdx/MDXModuleContext";

 import React from "react";

-const DOCS_DOMAIN = "https://docs.goauthentik.io";
+const DOCS_DOMAIN = "https://goauthentik.io";

 /**
 * A custom anchor element that applies special behavior for MDX content.
--- a/web/src/elements/banner/EnterpriseStatusBanner.ts
+++ b/web/src/elements/banner/EnterpriseStatusBanner.ts
@@ -20,7 +20,7 @@ export class EnterpriseStatusBanner extends WithLicenseSummary(AKElement) {

    renderStatusBanner() {
        // Check if we're in the correct interface to render a banner
-        switch (this.licenseSummary.status) {
+        switch (this.licenseSummary?.status) {
            // user warning is both on admin interface and user interface
            case LicenseSummaryStatusEnum.LimitExceededUser:
                if (
@@ -45,7 +45,7 @@ export class EnterpriseStatusBanner extends WithLicenseSummary(AKElement) {
                break;
        }
        let message = "";
-        switch (this.licenseSummary.status) {
+        switch (this.licenseSummary?.status) {
            case LicenseSummaryStatusEnum.LimitExceededAdmin:
            case LicenseSummaryStatusEnum.LimitExceededUser:
                message = msg(
@@ -83,12 +83,12 @@ export class EnterpriseStatusBanner extends WithLicenseSummary(AKElement) {

    renderFlagBanner() {
        return html`
-            ${this.licenseSummary.licenseFlags.includes(LicenseFlagsEnum.Trial)
+            ${this.licenseSummary?.licenseFlags.includes(LicenseFlagsEnum.Trial)
                ? html`<div class="pf-c-banner pf-m-sticky pf-m-gold">
                      ${msg("This authentik instance uses a Trial license.")}
                  </div>`
                : nothing}
-            ${this.licenseSummary.licenseFlags.includes(LicenseFlagsEnum.NonProduction)
+            ${this.licenseSummary?.licenseFlags.includes(LicenseFlagsEnum.NonProduction)
                ? html`<div class="pf-c-banner pf-m-sticky pf-m-gold">
                      ${msg("This authentik instance uses a Non-production license.")}
                  </div>`
--- a/web/src/elements/mixins/license.ts
+++ b/web/src/elements/mixins/license.ts
@@ -17,7 +17,7 @@ export interface LicenseMixin {
    /**
     * Summary of the current license.
     */
-    readonly licenseSummary: LicenseSummary;
+    readonly licenseSummary: LicenseSummary | null;

    /**
     * Whether or not the current license is an enterprise license.
@@ -39,12 +39,12 @@ export const WithLicenseSummary = createMixin<LicenseMixin>(
                context: LicenseContext,
                subscribe,
            })
-            public readonly licenseSummary!: LicenseSummary;
+            public readonly licenseSummary: LicenseSummary | null = null;

            get hasEnterpriseLicense() {
                return (
-                    this.licenseSummary.status === LicenseSummaryStatusEnum.Valid ||
-                    this.licenseSummary.status === LicenseSummaryStatusEnum.ExpirySoon
+                    this.licenseSummary?.status === LicenseSummaryStatusEnum.Valid ||
+                    this.licenseSummary?.status === LicenseSummaryStatusEnum.ExpirySoon
                );
            }
        }
--- a/web/xliff/de.xlf
+++ b/web/xliff/de.xlf
@@ -4632,11 +4632,6 @@ Beim Erstellen eines festen Auswahlfelds aktiviere „Als Ausdruck interpretiere
        <source>Mapping</source>
        <target>Zuordnung</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Passe die an den Custom Provider gesendete Payload an.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9907,12 +9902,18 @@ Bindings zu Gruppen/Benutzern werden mit dem Benutzer des Ereignisses abgegliche
 </trans-unit>
 <trans-unit id="s059358bf402de018">
  <source>Element inside the form slot is not a Form</source>
+  <target>Das Element im Formular-Slot ist kein Formular.</target>
 </trans-unit>
 <trans-unit id="s8563c5a14e9a42f2">
  <source>New Password</source>
+  <target>Neues Passwort</target>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+  <target><x id="0" equiv-text="${item.name || item.username}"/> - Passwort ändern.</target>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/en.xlf
+++ b/web/xliff/en.xlf
@@ -3708,10 +3708,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>Mapping</target>
      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Modify the payload sent to the custom provider.</target>
-      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
        <target>Stage used to configure an SMS-based TOTP authenticator.</target>
@@ -7777,6 +7773,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/es.xlf
+++ b/web/xliff/es.xlf
@@ -4569,11 +4569,6 @@ no se aprueba cuando una o ambas de las opciones seleccionadas son iguales o sup
        <source>Mapping</source>
        <target>Asignación</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Modificar la carga útil enviada al proveedor personalizado.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9328,6 +9323,9 @@ Las vinculaciones a grupos o usuarios se comparan con el usuario del evento.</ta
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/fr.xlf
+++ b/web/xliff/fr.xlf
@@ -4633,11 +4633,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>Mappage</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Modifier le contenu envoyé aux fournisseurs personnalisés.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9893,6 +9888,9 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/it.xlf
+++ b/web/xliff/it.xlf
@@ -4634,11 +4634,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>Mappatura</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Modifica il payload inviato al provider personalizzato.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9920,6 +9915,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
  <target>Aggiorna <x id="0" equiv-text="${item.name || item.username}"/> password</target>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/ko.xlf
+++ b/web/xliff/ko.xlf
@@ -4579,11 +4579,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>매핑</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>사용자 지정 공급자로 전송되는 페이로드를 수정합니다.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9234,6 +9229,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/nl.xlf
+++ b/web/xliff/nl.xlf
@@ -4590,11 +4590,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
        <source>Mapping</source>
        <target>Toewijzing</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Wijzig het payload-bericht dat naar de aangepaste provider wordt verzonden.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9138,6 +9133,9 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/pl.xlf
+++ b/web/xliff/pl.xlf
@@ -4635,11 +4635,6 @@ Można tu używać tylko zasad, ponieważ dostęp jest sprawdzany przed uwierzyt
        <source>Mapping</source>
        <target>Mapowanie</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Zmodyfikuj payload wysłany do niestandardowego dostawcy.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9560,6 +9555,9 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/pseudo-LOCALE.xlf
+++ b/web/xliff/pseudo-LOCALE.xlf
@@ -4603,11 +4603,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
  <target>Ḿàƥƥĩńĝ</target>

-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-  <target>Ḿōďĩƒŷ ţĥē ƥàŷĺōàď śēńţ ţō ţĥē ćũśţōḿ ƥŕōvĩďēŕ.</target>
-
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9569,4 +9564,7 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
 </trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
+</trans-unit>
 </body></file></xliff>
--- a/web/xliff/ru.xlf
+++ b/web/xliff/ru.xlf
@@ -4634,11 +4634,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>Сопоставление</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Изменить данные, отправляемые пользовательскому провайдеру.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9652,6 +9647,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/tr.xlf
+++ b/web/xliff/tr.xlf
@@ -4603,11 +4603,6 @@ Belirlenen seçeneklerden biri veya her ikisi de eşiğe eşit veya eşiğin üz
        <source>Mapping</source>
        <target>Eşleme</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>Özel sağlayıcıya gönderilen yükü değiştirin.</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9624,6 +9619,9 @@ Gruplara/kullanıcılara yapılan bağlamalar, etkinliğin kullanıcısına kar
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh-CN.xlf
+++ b/web/xliff/zh-CN.xlf
@@ -3309,9 +3309,6 @@ doesn't pass when either or both of the selected options are equal or above the
 <trans-unit id="sa92398dba8b12d85">
  <source>Mapping</source>
 </trans-unit>
-<trans-unit id="s38162f615710c7b4">
-  <source>Modify the payload sent to the custom provider.</source>
-</trans-unit>
 <trans-unit id="s5e830ae7688d1219">
  <source>Stage used to configure an SMS-based TOTP authenticator.</source>
 </trans-unit>
@@ -6395,6 +6392,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
 </trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
+</trans-unit>
 </body>
 </file>
 </xliff>
--- a/web/xliff/zh-Hans.xlf
+++ b/web/xliff/zh-Hans.xlf
@@ -4634,11 +4634,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>映射</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>修改发送到自定义提供程序的载荷。</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9917,6 +9912,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh-Hant.xlf
+++ b/web/xliff/zh-Hant.xlf
@@ -3510,9 +3510,6 @@ doesn't pass when either or both of the selected options are equal or above the
      <trans-unit id="sa92398dba8b12d85">
        <source>Mapping</source>
      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
        <target>用于配置基于短信的 TOTP 身份验证器的阶段。</target>
@@ -7479,6 +7476,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh_TW.xlf
+++ b/web/xliff/zh_TW.xlf
@@ -4571,11 +4571,6 @@ doesn't pass when either or both of the selected options are equal or above the
        <source>Mapping</source>
        <target>對應</target>
        
-      </trans-unit>
-      <trans-unit id="s38162f615710c7b4">
-        <source>Modify the payload sent to the custom provider.</source>
-        <target>修改發送至客製化供應商的酬載。</target>
-        
      </trans-unit>
      <trans-unit id="s5e830ae7688d1219">
        <source>Stage used to configure an SMS-based TOTP authenticator.</source>
@@ -9213,6 +9208,9 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s547b687213f48489">
  <source>Update <x id="0" equiv-text="${item.name || item.username}"/>'s password</source>
+</trans-unit>
+<trans-unit id="s3c619d54c995d4ab">
+  <source>Modify the payload sent to the provider.</source>
 </trans-unit>
    </body>
  </file>
--- a/website/README.md
+++ b/website/README.md
@@ -2,10 +2,10 @@

 This directory contains the source files for the [authentik technical documentation](https://docs.goauthentik.io/docs?utm_source=github) and the [authentik integration guides](https://integrations.goauthentik.io?utm_source=github).

-Contributions are welcome! Please refer to our [contributor guidelines](https://docs.goauthentik.io/developer-docs?utm_source=github) for details about contributing code or docs.
+Contributions are welcome! Please refer to our [contributor guidelines](https://docs.goauthentik.io/docs/developer-docs?utm_source=github) for details about contributing code or docs.

-For instructions to set up your local environment for building docs locally, refer to our [Docs development environment](https://docs.goauthentik.io/developer-docs/setup/website-dev-environment?utm_source=github) page.
+For instructions to set up your local environment for building docs locally, refer to our [Docs development environment](https://docs.goauthentik.io/docs/developer-docs/setup/website-dev-environment?utm_source=github) page.

-For instructions for writing the docs and then testing in your local build, plus tips on writing, links to our Style Guide and templates, see the [Writing documentation guide](https://docs.goauthentik.io/developer-docs/docs/writing-documentation?utm_source=github).
+For instructions for writing the docs and then testing in your local build, plus tips on writing, links to our Style Guide and templates, see the [Writing documentation guide](https://docs.goauthentik.io/docs/developer-docs/docs/writing-documentation?utm_source=github).

 To ensure a smooth review process, we encourage you to build the documentation locally to preview and test your documentation contributions. Be sure to test locally before opening a pull request. Let us know if you have any questions or want help with any part of the process.
--- a/website/api/package.json
+++ b/website/api/package.json
@@ -20,40 +20,40 @@
        "#reference/sidebar": "./reference/sidebar.ts"
    },
    "dependencies": {
-        "@docusaurus/core": "^3.8.1",
-        "@docusaurus/faster": "^3.8.1",
-        "@docusaurus/module-type-aliases": "^3.8.1",
-        "@docusaurus/plugin-client-redirects": "^3.8.1",
-        "@docusaurus/plugin-content-docs": "^3.8.1",
-        "@docusaurus/preset-classic": "^3.8.1",
-        "@docusaurus/theme-common": "^3.8.1",
-        "@docusaurus/tsconfig": "^3.8.1",
-        "@docusaurus/types": "^3.8.1",
-        "@goauthentik/docusaurus-config": "^2.1.1",
+        "@docusaurus/core": "3.7.0",
+        "@docusaurus/faster": "3.7.0",
+        "@docusaurus/module-type-aliases": "3.7.0",
+        "@docusaurus/plugin-client-redirects": "3.7.0",
+        "@docusaurus/plugin-content-docs": "3.7.0",
+        "@docusaurus/preset-classic": "3.7.0",
+        "@docusaurus/theme-common": "3.7.0",
+        "@docusaurus/tsconfig": "3.7.0",
+        "@docusaurus/types": "3.7.0",
+        "@goauthentik/docusaurus-config": "1.1.0",
        "@goauthentik/docusaurus-theme": "*",
        "@goauthentik/tsconfig": "^1.0.4",
        "@mdx-js/react": "^3.1.0",
        "@types/postman-collection": "^3.5.11",
-        "@types/react": "^19.1.8",
-        "@types/react-dom": "^19.1.6",
-        "docusaurus-plugin-openapi-docs": "^4.5.1",
-        "docusaurus-theme-openapi-docs": "^4.5.1",
+        "@types/react": "^18.3.22",
+        "@types/react-dom": "^18.3.0",
+        "docusaurus-plugin-openapi-docs": "^4.4.0",
+        "docusaurus-theme-openapi-docs": "^4.4.0",
        "npm-run-all": "^4.1.5",
        "prism-react-renderer": "^2.4.1",
-        "react": "^19.1.0",
-        "react-dom": "^19.1.0",
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1",
        "typescript": "^5.8.3"
    },
    "optionalDependencies": {
        "@rspack/binding-darwin-arm64": "1.4.8",
        "@rspack/binding-linux-arm64-gnu": "1.4.8",
        "@rspack/binding-linux-x64-gnu": "1.4.8",
-        "@swc/core-darwin-arm64": "1.12.14",
-        "@swc/core-linux-arm64-gnu": "1.12.14",
-        "@swc/core-linux-x64-gnu": "1.12.14",
-        "@swc/html-darwin-arm64": "1.12.14",
-        "@swc/html-linux-arm64-gnu": "1.12.14",
-        "@swc/html-linux-x64-gnu": "1.12.14",
+        "@swc/core-darwin-arm64": "1.13.0",
+        "@swc/core-linux-arm64-gnu": "1.13.0",
+        "@swc/core-linux-x64-gnu": "1.13.0",
+        "@swc/html-darwin-arm64": "1.13.0",
+        "@swc/html-linux-arm64-gnu": "1.13.0",
+        "@swc/html-linux-x64-gnu": "1.13.0",
        "lightningcss-darwin-arm64": "1.30.1",
        "lightningcss-linux-arm64-gnu": "1.30.1",
        "lightningcss-linux-x64-gnu": "1.30.1"
--- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx
+++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx
@@ -6,7 +6,7 @@ This stage configures an SMS-based authenticator using either Twilio, or a gener

 ## Providers

-#### Twilio
+### Twilio

 Navigate to https://console.twilio.com/, and log in to your existing account, or create a new one.

@@ -22,7 +22,23 @@ The other two steps can be skipped using the _Skip setup_ button.

 Navigate back to the root of your Twilio console, and copy the Auth token. This is the value for the _Twilio Auth Token_ field in authentik. Copy the value of **Account SID**. This is the value for the _Twilio Account SID_ field in authentik.

-#### Generic
+#### Custom SMS message :ak-version[2025.8]
+
+Using a property mapping, it is possible to customize the SMS message sent via Twilio. The mapping should return a dictionary with the `message` key, which will be sent to the user. For example:
+
+```python
+return {
+    "message": f"This is a custom message for {request.http_request.brand.branding_title} SMS authentication. The code is {token}".
+}
+```
+
+Variables related to different objects can be used within the message:
+
+    - The end user device, for example: `device.phone_number`
+    - The stage sending the message, for example: `stage.from_number`
+    - The request this verification code is being sent from, for example: `request.http_request.brand`
+
+### Generic

 For the generic provider, a POST request will be sent to the URL you have specified in the _External API URL_ field. The request payload looks like this

@@ -36,7 +52,9 @@ For the generic provider, a POST request will be sent to the URL you have specif

 Authentication can either be done as HTTP Basic, or via a Bearer Token. Any response with status 400 or above is counted as failed, and will prevent the user from proceeding.

-Starting with authentik 2022.10, a custom webhook mapping can be specified to freely customize the payload of the request. For example:
+#### Custom SMS message
+
+A custom webhook mapping can be used to customize the SMS message sent to users. For example:

 ```python
 return {
--- a/website/docs/developer-docs/docs/writing-documentation.md
+++ b/website/docs/developer-docs/docs/writing-documentation.md
@@ -4,60 +4,81 @@ title: Writing documentation

 Writing documentation for authentik is a great way for both new and experienced users to improve and contribute to the project. We appreciate contributions to our documentation; everything from fixing a typo to adding additional content to writing a completely new topic.

+The technical documentation (https://docs.goauthentik.io/docs/) and our integration guides (https://integrations.goauthentik.io/) are built, formatted, and tested using npm. The commands to build the content locally are defined in the `Makefile` in the root of the repository. Each command is prefixed with `docs-` or `integrations-` and corresponds to an NPM script within the `website` directory.
+
+## Requirements
+
+- Node.js 24 (or later)
+
+## Guidelines
+
 Adhering to the following guidelines will help us get your PRs merged much easier and faster, with fewer edits needed.

- Ideally, when you are making contributions to the documentation, you should fork and clone our repo, then [build it locally](#set-up-your-local-build), so that you can test the docs and run the required linting and spell checkers before pushing your PR. While you can do much of the writing and editing within the GitHub UI, you cannot run the required linters from the GitHub UI.
+- Ideally, when you are making contributions to the documentation, you should fork and clone our repo, then [build it locally](#set-up-your-local-build-tools), so that you can test the docs and run the required linting and spell checkers before pushing your PR. While you can do much of the writing and editing within the GitHub UI, you cannot run the required linters from the GitHub UI.
+
+- After submitting a PR, you can view the Netlify Deploy Preview for the PR on GitHub, to check that your content rendered correctly, links work, etc. This is especially useful when using Docusaurus-specific features in your content.

 - Please refer to our [Style Guide](./style-guide.mdx) for authentik documentation. Here you will learn important guidelines about not capitalizing authentik, how we format our titles and headers, and much more.

- Remember to use our [docs templates](./templates/index.md) when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and keeps the documentation structure and headings consistent.
+- Remember to use our templates when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and they keep the documentation structure and headings consistent.
+    - [docs templates](./templates/index.md)
+    - [integration guide template](https://integrations.goauthentik.io/applications#add-a-new-application)

- To test how the documentation renders you can build locally and then use the Netlify Deploy Preview, especially when using Docusaurus-specific features. You can also run the `make docs-watch` command on your local build, to see the rendered pages as you make changes.
+:::tip
+If you encounter build check fails, or issues you with your local build, you might need to run `make docs-install` in order to get the latest build tools and dependencies; we do occasionally update our build tools.
+:::

- Be sure to run the `make docs` command on your local branch, before pushing the PR to the authentik repo. This command does important linting, and the build check in our repo will fail if the linting has not been done.
+## Clone and fork the authentik repository

- For new entries, make sure to add any new pages to the appropriate `sidebar.js` file. Otherwise, the new page will not appear in the table of contents to the left.
+The documentation, integration guides, API docs, and the code are in the same [GitHub repo](https://github.com/goauthentik/authentik), so if you have cloned and forked the repo, you already have the docs and integration guides.

-## Set up your local build
+## Set up your local build tools

-Requirements:
+Run the following command to install the build tools for both the technical docs and integration guides.

- Node.js 20 (or greater, we use Node.js 24)
+- **Install (or update) the build tools**: `make docs-install`

-The docs and the code are in the same Github repo, at https://github.com/goauthentik/authentik, so if you have cloned the repo, you already have the docs.
+    Installs the build dependencies such as Docusaurus, Prettier, and ESLint. You should run this command when you are first setting up your writing environment, and also if you encounter build check fails either when you build locally or when you push your PR to the authentik repository. Running this command will grab any new dependencies that we might have added to our build tool package.

-You can do local builds of the documentation to test your changes or review your new content, and to run the required `make docs` command (which runs `prettier` and other linters) before pushing your PR.
+## Writing or modifying technical docs

-The documentation site is situated in the `/website` folder of the repo.
+In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our technical documentation (https://docs.goauthentik.io/docs/):

-The site is built using npm, below are some useful make commands:
+- For new entries, make sure to add any new pages to the `/docs/sidebar.mjs` file.
+  Otherwise, the new page will not appear in the table of contents to the left.

- **Installation**: `make docs-install`
+- Always be sure to run the `make docs` command on your local branch _before_ pushing the PR to the authentik repo. This command does important linting, and the build check in our repo will fail if the linting has not been done. In general, check on the health of your build before pushing to the authentik repo, and also check on the build status of your PR after you create it.

-    This command is required before running any of the following commands, and after upgrading any dependencies.
+For our technical documentation (https://docs.goauthentik.io/docs/), the following commands are used:

- **Formatting**: `make docs`, `make docs-lint-fix`, or `npm run prettier`
+- **Build locally**: `make docs`

-    Run the appropriate formatting command for your set up before committing, to ensure consistent syntax, clean formatting, and verify links. Note that if the formatting command is not run, the build will fail with an error about linting.
+    This command is a combination of `make docs-lint-fix` and `make docs-build`. It is important to run this command before committing changes because linter errors will prevent the build checks from passing.

 - **Live editing**: `make docs-watch`

-    For real-time viewing of changes, as you make them.
+    Starts a development server for the documentation site. This command will automatically rebuild your local documentation site whenever you make changes to the Markdown files in the `website/docs` directory.

-:::info
-Be sure to run a formatting command before committing changes.
-:::
+## Writing or modifying integration guides

-## Documentation for integrations
+In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our integration guides (https://integrations.goauthentik.io/).

-In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines.
-
-For new integration documentation, please use the Integrations template in our [Github repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.md`.
+- For new integration documentation, please use the Integrations template in our [Github repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.md`.

 - For placeholder domains, use `authentik.company` and `app-name.company`, where `app-name` is the name of the application that you are writing documentation for.

-Make sure to create a directory for your service in a fitting category within `/website/integrations/`.
+- Make sure to create a directory for your service in a fitting category within [`/website/integrations/`](https://github.com/goauthentik/authentik/tree/main/website/integrations).

-:::tip
-You no longer need to modify the integrations sidebar file manually. This is now automatically generated from the categories in `/website/integrations/categories.mjs`.
+:::tip Sidebars and categories
+You no longer need to modify the integrations sidebar file manually. This is now automatically generated from the categories in [`/website/integrations/categories.mjs`](https://github.com/goauthentik/authentik/blob/main/website/integrations/categories.mjs).
 :::
+
+When authoring integration guides, the following commands are used:
+
+- **Build locally**: `make integrations`
+
+    This command is a combination of `make docs-lint-fix` and `make integrations-build`. This command should always be run on your local branch before committing your changes to a pull request to the authentik repo. It is important to run this command before committing changes because linter errors will prevent the build checks from passing.
+
+- **Live editing**: `make integrations-watch`
+
+    Starts a development server for the integrations guides. This command will automatically rebuild your local integrations site whenever you make changes to the Markdown files in the [`/website/integrations/`](https://github.com/goauthentik/authentik/tree/main/website/integrations) directory.
--- a/website/docs/developer-docs/setup/full-dev-environment.mdx
+++ b/website/docs/developer-docs/setup/full-dev-environment.mdx
@@ -26,8 +26,8 @@ import Tabs from "@theme/Tabs";

 ## Services Setup

-For PostgreSQL and Redis, you can use the `docker-compose.yml` file in `/scripts`.To use these pre-configured database instances, navigate to the `/scripts` directory in your local copy of the authentik git repo, and run `docker compose up -d`.
-You can also use a native install, if you prefer.
+For PostgreSQL and Redis, you can use the `docker-compose.yml` file in `/scripts`. To use these pre-configured database instances, navigate to the `/scripts` directory in your local copy of the authentik git repo, and start the services by running `docker compose up -d`.
+Alternatively, you can also use a native install, if you prefer.

 :::info
 If you use locally installed databases, the PostgreSQL credentials given to authentik should have permissions for `CREATE DATABASE` and `DROP DATABASE`, because authentik creates a temporary database for tests.
@@ -147,6 +147,18 @@ To define a password for the default admin (called **akadmin**), you can manuall
 In case of issues in this process, feel free to use `make dev-reset` which drops and restores the authentik PostgreSQL instance to a "fresh install" state.
 :::

+## End-to-End (E2E) Setup
+
+To run E2E tests, navigate to the `/tests/e2e` directory in your local copy of the authentik git repo, and start the services by running `docker compose up -d`.
+
+You can then view the Selenium Chrome browser via http://localhost:7900/ using the password: `secret`.
+
+Alternatively, you can connect directly via VNC on port `5900` using the password: `secret`.
+
+:::note
+When using Docker Desktop, host networking needs to be enabled via **Docker Settings** > **Resources** > **Network** > **Enable host networking**.
+:::
+
 ## Submitting Pull Requests

 Before submitting a pull request, run the following commands in the same directory as your local authentik git repository:
--- a/website/docs/package.json
+++ b/website/docs/package.json
@@ -13,21 +13,21 @@
        "start": "docusaurus start"
    },
    "dependencies": {
-        "@docusaurus/core": "^3.8.1",
-        "@docusaurus/module-type-aliases": "^3.8.1",
-        "@docusaurus/preset-classic": "^3.8.1",
-        "@docusaurus/theme-mermaid": "^3.8.1",
-        "@docusaurus/tsconfig": "^3.8.1",
-        "@docusaurus/types": "^3.8.1",
-        "@goauthentik/docusaurus-config": "^2.1.1",
+        "@docusaurus/core": "3.7.0",
+        "@docusaurus/module-type-aliases": "3.7.0",
+        "@docusaurus/preset-classic": "3.7.0",
+        "@docusaurus/theme-mermaid": "3.7.0",
+        "@docusaurus/tsconfig": "3.7.0",
+        "@docusaurus/types": "3.7.0",
+        "@goauthentik/docusaurus-config": "1.1.0",
        "@goauthentik/docusaurus-theme": "*",
        "@mdx-js/react": "^3.1.0",
-        "@types/react": "^19.1.8",
-        "@types/react-dom": "^19.1.6",
+        "@types/react": "^18.3.22",
+        "@types/react-dom": "^18.3.0",
        "prism-react-renderer": "^2.3.0",
-        "react": "^19.1.0",
+        "react": "^18.3.1",
        "react-before-after-slider-component": "^1.1.8",
-        "react-dom": "^19.1.0",
+        "react-dom": "^18.3.1",
        "unist-util-visit": "^5.0.0"
    },
    "engines": {
--- a/website/docs/security/cves/CVE-2025-29928.md
+++ b/website/docs/security/cves/CVE-2025-29928.md
@@ -4,7 +4,7 @@

 ### ADDENDUM May 30, 2025

-As of version 2025.4, the option to store sessions in cache has been removed; sessions are now exclusively stored in the database. See our [2025.4 release notes](../../releases/2025/v2025.4.md#sessions-are-now-stored-in-the-database) for more information.
+As of version 2025.4, the option to store sessions in cache has been removed; sessions are now exclusively stored in the database. See our [2025.4 release notes](../../releases/2025.4#sessions-are-now-stored-in-the-database) for more information.

 ### Summary

--- a/website/docs/sidebar.mjs
+++ b/website/docs/sidebar.mjs
@@ -450,6 +450,7 @@ const items = [
                    "users-sources/user/user_basic_operations",
                    "users-sources/user/user_ref",
                    "users-sources/user/invitations",
+                    "users-sources/user/password_reset_on_login",
                ],
            },
            {
@@ -636,7 +637,7 @@ const items = [
        items: [
            {
                type: "link",
-                href: "https://api.goauthentik.io",
+                href: "pathname:///api",
                label: "API Overview",
                className: "api-overview",
            },
--- a/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx
+++ b/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx
@@ -0,0 +1,172 @@
+---
+title: Notification Rule Expression Policies
+---
+
+## Introduction
+
+Notification rules with bound expression policies are very powerful. The following are examples of what can be achieved.
+
+### Change user attributes upon account deactivation
+
+This example code is triggered when a user account with the `sshPublicKey` attribute set is deactivated. It saves the `sshPublicKey` attribute to a new `inactivesshPublicKey` attribute, and subsequently nullifies the `sshPublicKey` attribute.
+
+```python
+from authentik.core.models import User
+
+# Check if an event has occurred
+event = request.context.get("event", None)
+if not event:
+    ak_logger.info("no event")
+    return False
+
+# Check if the event action includes updating a model
+if event.action != "model_updated":
+    ak_logger.info("event action does not match")
+    return False
+
+model_app = event.context["model"]["app"]
+model_name = event.context["model"]["model_name"]
+
+# Check if the model that was updated is the user model
+if model_app != "authentik_core" or model_name != "user":
+    ak_logger.info("model does not match")
+
+user_pk = event.context["model"]["pk"]
+user = User.objects.filter(pk=user_pk).first()
+
+# Check if an user object was found
+if not user:
+    ak_logger.info("user not found")
+    return False
+
+# Check if user is active
+if user.is_active:
+    ak_logger.info("user is active, not changing")
+    return False
+
+# Check if user has the `sshPublicKey` attribute set
+if not user.attributes.get("sshPublicKey"):
+    ak_logger.info("no public keys to remove")
+    return False
+
+# Save the `sshPublicKey` attribute to a new `inactiveSSHPublicKey` attribute
+user.attributes["inactiveSSHPublicKey"] = user.attributes["sshPublicKey"]
+
+# Nullify the `sshPublicKey` attribute
+user.attributes["sshPublicKey"] = []
+
+# Save the changes made to the user
+user.save()
+
+return False
+```
+
+### Alert when application is created without binding
+
+This code is triggered when a new application is created without any user, group, or policy bound to it. The notification rule can then be configured to alert an administrator. This feature is useful for ensuring limited access to applications, as by default, an application without any users, groups, or policies bound to it can be accessed by all users.
+
+```python
+from authentik.core.models import Application
+from authentik.policies.models import PolicyBinding
+
+# Check if an event has occurred
+event = request.context.get("event", None)
+if not event:
+    ak_logger.info("no event")
+    return False
+
+# Check if the event action includes creating a model
+if event.action != "model_created":
+    ak_logger.info("event action does not match")
+    return False
+
+model_app = event.context["model"]["app"]
+model_name = event.context["model"]["model_name"]
+
+# Check if the model that was created is the application model
+if model_app != "authentik_core" or model_name != "application":
+    ak_logger.info("model does not match")
+
+application_pk = event.context["model"]["pk"]
+application = Application.objects.filter(pk=application_pk).first()
+
+# Check if an application object was found
+if not application:
+    ak_logger.info("application not found")
+    return False
+
+# Check if application has binding
+if PolicyBinding.objects.filter(target=application).exists():
+    output = PolicyBinding.objects.filter(target=application)
+    ak_logger.info("application has bindings, returning true")
+    return True
+
+return False
+```
+
+### Append user addition history to group attributes
+
+This code is triggered when a user is added to a group. It then creates and updates a `UserAddedHistory` attribute to the group with a date/time stamp and the username of the added user. This functionality is already available within the changelog of a group, but this code can be used as a template to trigger alerts or other events.
+
+:::note
+This policy interacts with the `diff` event output. This field is only available with an enterprise license.
+:::
+
+```python
+from authentik.core.models import User
+from authentik.core.models import Group
+from datetime import datetime
+
+# Check if an event has occurred
+event = request.context.get("event", None)
+if not event:
+    ak_logger.info("no event")
+    return False
+
+# Check if the event action includes updating a model
+if event.action != "model_updated":
+    ak_logger.info("event action does not match")
+    return False
+
+model_app = event.context["model"]["app"]
+model_name = event.context["model"]["model_name"]
+
+# Check if the model that was updated is the group model
+if model_app != "authentik_core" or model_name != "group":
+    ak_logger.info("model does not match")
+
+group_pk = event.context["model"]["pk"]
+group = Group.objects.filter(pk=group_pk).first()
+
+# If user was added to group, get user object, else return false
+if "add" in event.context["diff"]["users"]:
+    ak_logger.info("user added to group")
+
+    user_pk = event.context["diff"]["users"]["add"][0]
+    user = User.objects.filter(pk=user_pk).first()
+else:
+    ak_logger.info("user not added to group")
+    return False
+
+# Check if a group object was found
+if not group:
+    ak_logger.info("group not found")
+    return False
+
+# Check if an user object was found
+if not user:
+    ak_logger.info("user not found")
+    return False
+
+if not group.attributes.get("UserAddedHistory"):
+    group.attributes["UserAddedHistory"] = []
+
+current_date_time = datetime.now().isoformat(timespec='seconds')
+
+group.attributes["UserAddedHistory"].append(current_date_time + " - Added user: " + user.username)
+
+# Save the changes made to the group
+group.save()
+
+return False
+```
--- a/website/docs/sys-mgmt/events/notifications.md
+++ b/website/docs/sys-mgmt/events/notifications.md
@@ -27,13 +27,13 @@ You will need to create a policy (either the **Event Matcher** policy or a custo

 ### Event Matcher policy

-For simple event matching you can [create and configure](../../customize/policies/working_with_policies.md) a **Event Matcher** policy to define which events (known as _Actions_ in the policy) will trigger a notification. For example, whenever a user deletes a model object, or whenever any user fails to successfully log in.
+For simple event matching you can [create and configure](../../customize/policies/working_with_policies.md) an **Event Matcher policy** to define which events (known as _Actions_ in the policy) will trigger a notification. For example, whenever a user deletes a model object, or whenever any user fails to successfully log in.

 Be aware that an event has to match all configured fields in the policy, otherwise the notification rule will not trigger.

 ### Expression policy for events

-To match events with an "Expression Policy", you can write code like so:
+To match events with an **Expression Policy**, you can write code like so:

 ```python
 if "event" not in request.context:
@@ -42,6 +42,8 @@ if "event" not in request.context:
 return ip_address(request.context["event"].client_ip) in ip_network('192.0.2.0/24')
 ```

+For more code examples, see [notification rule expression policies](./notification_rule_expression_policies.mdx).
+
 ## 3. Create a notification rule and bind it to the policy

 After you've created the policies to match the events you want, create a notification rule.
--- a/website/docs/users-sources/user/password_reset_on_login.mdx
+++ b/website/docs/users-sources/user/password_reset_on_login.mdx
@@ -0,0 +1,112 @@
+---
+title: Force password reset on next login
+sidebar_label: Password reset on login
+---
+
+You can require users to reset their password on their next login, using expression policies, custom stages, and a custom user attribute. This guide explains how to configure this with the `default-authentication-flow`; however, the same steps apply to any authentication flow.
+
+Configuring forced password reset on next login involves the following steps:
+
+    1. Creating two expression policicies.
+    2. Creating and binding two stages to the active authentication flow.
+    3. Binding the expression policies to the stages.
+    4. Setting a custom user attribute which triggers the password prompt.
+
+## Create expression policies
+
+You'll need to create two expression policies; one that checks the value of a custom user attribute on the user account attempting to log in, and another that resets the value of the custom user attribute.
+
+1. Log in to authentik as an administrator and open the authentik Admin interface.
+2. Navigate to **Customization** > **Policies** and click **Create** to set up the first policy.
+3. Select **Expression Policy** as the policy type, click **Next**, and configure the following settings:
+    - **Name**: Provide a descriptive name for the policy (e.g. `reset_password_check`).
+    - **Expression**:
+
+        ```python
+        # Check if the "reset_password" attribute set to true for the pending user
+        if request.context["pending_user"].attributes.get("reset_password") == True:
+            return True
+
+        return False
+        ```
+
+4. Click **Finish** to save the first policy, then repeat the steps to create the second policy using the following settings:
+    - **Name**: Provide a descriptive name for the policy (e.g. `reset_password_update`).
+    - **Expression**:
+
+        ```python
+        # Check if the "reset_password" attribute is set to true for the pending user
+        if request.context["pending_user"].attributes.get("reset_password") == True:
+            # Reset the "reset_password" attribute to false to prevent forcing a password reset on next login
+            request.context["pending_user"].attributes["reset_password"] = False
+            return True
+
+        return False
+        ```
+
+5. Click **Finish**.
+
+## Create stages
+
+You'll need to create two stages; a _Prompt stage_ to prompt the user to enter a new password, and a _User Write stage_ to update the user's account with the new password. Both stages will need to be bound to the active authentication flow, typically the `default-authentication-flow`.
+
+1. Log in to authentik as an administrator and open the authentik Admin interface.
+2. Navigate to **Flows and Stages** > **Flows** and click on the name of the active authentication flow, typically the `default-authentication-flow`.
+3. Select the **Stage Bindings** tab and click **Create and bind stage**.
+4. Select **Prompt Stage** as the stage type, click **Next**, and configure the following settings for the stage:
+    - **Name**: Provide a descriptive name for the stage (e.g. `Force Password Reset Prompt Stage`).
+    - Under **Fields**:
+        - Click the `x` icon between **Available Fields** and **Selected Fields** to clear the selections.
+        - Select `default-password-change-field-password` and `default-password-change-field-password-repeat`.
+    - Under **Validation Policies**:
+        - Click the `x` icon between **Available Policies** and **Selected Policies** to clear the selections.
+        - _(Optional but recommended)_ Select `default-password-change-policy`.
+
+:::tip
+Optionally, you can create and add a text field to the prompt stage to inform users that they are required to reset their password. For more details on configuring this, refer to the [Prompt Stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.md).
+:::
+
+5. Click **Next** to create the stage and then configure the following settings for the binding:
+    - **Order**: `25` or any number higher than the `default-authentication-password` stage order and lower than the `default-authentication-mfa-validation` stage order.
+    - Leave the other settings as their default values.
+
+6. Click **Finish** to create the binding and repeat the process for the second stage using the following settings:
+    - **Stage type**: Select **User Write Stage** as the type.
+    - **Name**: Provide a descriptive name for the stage (e.g. `Force Password Reset User Write Stage`).
+    - Leave the other settings as their default values.
+
+7. Click **Next** to create the stage and then configure the following settings for the binding:
+    - **Order**: `26` or any number higher than the `Force Password Reset Prompt Stage` stage order and lower than the `default-authentication-mfa-validation` stage order.
+    - Leave the other settings as their default values.
+
+8. Click **Finish** to create the binding.
+
+## Bind policies to stages
+
+You will need to bind the previously created policies to the newly created stages. Specifically:
+
+    - The `reset_password_check` policy needs to be bound to the `Force Password Reset Prompt Stage`.
+    - The `reset_password_update` policy needs to be bound to the `Force Password Reset User Write Stage`.
+
+1. Log in to authentik as an administrator and open the authentik Admin interface.
+2. Navigate to **Flows and Stages** > **Flows** and click on the name of the active authentication flow, typically `default-authentication-flow`.
+3. Select the **Stage Bindings** tab and click the arrow next to the newly created `Force Password Reset Prompt Stage` to expand it.
+4. Click **Bind existing Policy / Group / User**.
+5. Set **Policy** to `reset_password_check` and click **Create**.
+6. Click the arrow next to the newly created `Force Password Reset User Write Stage` to expand it.
+7. Click **Bind existing Policy / Group / User**.
+8. Set **Policy** to `reset_password_update` and click **Create**.
+
+## Set custom user attribute
+
+To require a user to reset their password on next login, you will need to set a custom user attribute on their account.
+
+1. Log in to authentik as an administrator and open the authentik Admin interface.
+2. Navigate to **Directory** > **Users** and click the **Edit** icon of the user in question.
+3. Add the following values to the user's attribute field:
+    ```python
+    reset_password: True
+    ```
+4. Click **Update**.
+
+The next time the user logs in, they will be required to reset their password, and the `reset_password` attribute on their account will be set to `False`.
--- a/website/docs/users-sources/user/user_ref.mdx
+++ b/website/docs/users-sources/user/user_ref.mdx
@@ -16,7 +16,7 @@ The User object has the following properties:
 - `password_change_date`: Date password was last changed. Read-only.
 - `path`: User's path, see [Path](#path)
 - `attributes`: Dynamic attributes, see [Attributes](#attributes)
- `group_attributes()`: Merged attributes of all groups the user is member of and the user's own attributes. Ready-only.
+- `group_attributes()`: Merged attributes of all groups the user is a member of and the user's own attributes. Read-only.
 - `ak_groups`: This is a queryset of all the user's groups.

 ## Examples
--- a/website/docusaurus-theme/package.json
+++ b/website/docusaurus-theme/package.json
@@ -22,8 +22,8 @@
        "#theme/*": "./theme/*"
    },
    "dependencies": {
-        "@docusaurus/preset-classic": "^3.8.1",
-        "@goauthentik/docusaurus-config": "^2.1.1",
+        "@docusaurus/preset-classic": "3.7.0",
+        "@goauthentik/docusaurus-config": "1.1.0",
        "@types/semver": "^7.7.0",
        "clsx": "^2.1.1",
        "fast-glob": "^3.3.3",
--- a/website/integrations/development/node-red/index.md
+++ b/website/integrations/development/node-red/index.md
@@ -13,7 +13,7 @@ support_level: community
 > -- https://nodered.org/

 :::caution
-This requires modification of the Node-RED settings.js and installing additional Passport-js packages, see [Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication) documentation for further details.
+This requires modification of the Node-RED `settings.js` file and installing additional Passport-js packages; see [Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication) documentation for further details.
 :::

 ## Preparation
@@ -66,29 +66,29 @@ Edit the node-red settings.js file `/data/settings.js` to use the external authe

 ```js
 adminAuth: {
-type:"strategy",
-strategy: {
-        name: "openidconnect",
-        label: 'Sign in with authentik',
-        icon:"fa-cloud",
-        strategy: require("passport-openidconnect").Strategy,
-        options: {
-                issuer: 'https://authentik.company/application/o/<application_slug>/',
-                authorizationURL: 'https://authentik.company/application/o/authorize/',
-                tokenURL: 'https://authentik.company/application/o/token/',
-                userInfoURL: 'https://authentik.company/application/o/userinfo/',
-                clientID: '<Client ID (Key): Step 2>',
-                clientSecret: '<Client Secret: Step 2>',
-                callbackURL: 'https://nodered.company/auth/strategy/callback/',
-                scope: ['email', 'profile', 'openid'],
-                proxy: true,
-        verify: function(issuer, profile, done) {
-                done(null, profile)
+        type:"strategy",
+        strategy: {
+                name: "openidconnect",
+                label: 'Sign in with authentik',
+                icon:"fa-cloud",
+                strategy: require("passport-openidconnect").Strategy,
+                options: {
+                        issuer: 'https://authentik.company/application/o/<application_slug>/',
+                        authorizationURL: 'https://authentik.company/application/o/authorize/',
+                        tokenURL: 'https://authentik.company/application/o/token/',
+                        userInfoURL: 'https://authentik.company/application/o/userinfo/',
+                        clientID: '<Client ID (Key): Step 2>',
+                        clientSecret: '<Client Secret: Step 2>',
+                        callbackURL: 'https://nodered.company/auth/strategy/callback/',
+                        scope: ['email', 'profile', 'openid'],
+                        proxy: true,
+                        verify: function(context, issuer, profile, done) {
+                                return done(null, profile);
+                        },
+                }
+        },
+        users: function(user) {
+                return Promise.resolve({ username: user, permissions: "*" });
        }
-      }
-    },
-    users: function(user) {
-        return Promise.resolve({ username: user, permissions: "*" });
-    }
 },
 ```
--- a/website/integrations/infrastructure/apache-guacamole/index.mdx
+++ b/website/integrations/infrastructure/apache-guacamole/index.mdx
@@ -140,54 +140,6 @@ This section depends on the operating system hosting Apache Guacamole.
 More information on the keytool command can be found in the [Oracle documentation.](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html)
 :::

-### Self Signed Certificates
-
-When using a self-signed certificate, it is necessary to incorporate the certificate of the corresponding Certificate Authority into both the `/etc/ssl/certs/ca-certificates.crt` file and the `/opt/java/openjkd/jre/lib/security/cacerts` keystore on your Apache Guacamole host. This ensures that the self-signed certificate is trusted by both the system and the Java runtime environment used by Guacamole.
-
-#### Adding Certificate Authority certificate as trusted in `/etc/ssl/certs/ca-certificates.crt`
-
-:::note
-This section depends on the operating system hosting Apache Guacamole.
-:::
-
-##### For _Debian_ based operating systems:
-
-1. Copy the certificate of the Certificate Authority (e.g. `<CA_certificate>.crt`) to the `/usr/local/share/ca-certificates/` directory on the Apache Guacamole host. Ensure that the file extension is `.crt`.
-
-2. To add the certificate as trusted in `/etc/ssl/certs/ca-certificates.crt`, use the following command:
-
-    ```shell
-    update-ca-certificates
-    ```
-
-##### For _Synology_ systems:
-
-1. Copy the certificate of the Certificate Authority (e.g. `<CA_certificate>.crt`) to the `/usr/syno/etc/security-profile/ca-bundle-profile/ca-certificates/` directory on the Synology host. Ensure that the filetype is `.crt`.
-
-2. To add the certificate as trusted in `/etc/ssl/certs/ca-certificates.crt`, use the following command:
-
-    ```shell
-    update-ca-certificates.sh
-    ```
-
-#### Adding Certificate Authority certificate to `/opt/java/openjkd/jre/lib/security/cacerts`
-
-1. To export the certificate of the Certificate Authority, use the following command on the Certificate Authority host:
-
-    ```shell
-    openssl pkcs12 -export -in <CA_certificate>.crt -inkey <CA_certificate>.key -out <CA_certificate>.p12 -passout pass:<password>
-    ```
-
-2. To import the certificate to the `/opt/java/openjdk/jre/lib/security/cacerts` keystore on the Apache Guacamole host, use the following command:
-
-    ```shell
-    keytool -importkeystore -srckeystore <CA_certificate>.p12 -srcstoretype PKCS12 -keystore /opt/java/openjdk/jre/lib/security/cacerts -deststorepass <destination_store_password> -nopromt -srcstorepass <password>
-    ```
-
-:::note
-More information on the keytool command can be found in the [Oracle documentation.](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html)
-:::
-
 ## Configuration verification

 To verify that authentik is correctly configured with Apache Guacamole, log out and log back in through authentik. You should notice a new button appearing at the bottom left of the login page.
--- a/website/integrations/media/seafile/index.md
+++ b/website/integrations/media/seafile/index.md
@@ -59,7 +59,7 @@ OAUTH_REDIRECT_URL = 'https://seafile.company/oauth/callback/'

 OAUTH_PROVIDER = 'authentik'

-OAUTH_PROVIDER_DOMAIN = 'https:/authentik.company'
+OAUTH_PROVIDER_DOMAIN = 'https://authentik.company'
 OAUTH_AUTHORIZATION_URL = 'https://authentik.company/application/o/authorize/'
 OAUTH_TOKEN_URL = 'https://authentik.company/application/o/token/'
 OAUTH_USER_INFO_URL = 'https://authentik.company/application/o/userinfo/'
--- a/website/integrations/package.json
+++ b/website/integrations/package.json
@@ -12,21 +12,21 @@
        "start": "docusaurus start"
    },
    "dependencies": {
-        "@docusaurus/core": "^3.8.1",
-        "@docusaurus/module-type-aliases": "^3.8.1",
-        "@docusaurus/plugin-client-redirects": "^3.8.1",
-        "@docusaurus/preset-classic": "^3.8.1",
-        "@docusaurus/theme-mermaid": "^3.8.1",
-        "@docusaurus/tsconfig": "^3.8.1",
-        "@docusaurus/types": "^3.8.1",
-        "@goauthentik/docusaurus-config": "^2.1.1",
+        "@docusaurus/core": "3.7.0",
+        "@docusaurus/module-type-aliases": "3.7.0",
+        "@docusaurus/plugin-client-redirects": "3.7.0",
+        "@docusaurus/preset-classic": "3.7.0",
+        "@docusaurus/theme-mermaid": "3.7.0",
+        "@docusaurus/tsconfig": "3.7.0",
+        "@docusaurus/types": "3.7.0",
+        "@goauthentik/docusaurus-config": "1.1.0",
        "@goauthentik/docusaurus-theme": "*",
        "@mdx-js/react": "^3.0.0",
-        "@types/react": "^19.1.8",
-        "@types/react-dom": "^19.1.6",
+        "@types/react": "^18.3.22",
+        "@types/react-dom": "^18.3.0",
        "prism-react-renderer": "^2.3.0",
-        "react": "^19.1.0",
-        "react-dom": "^19.1.0"
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1"
    },
    "engines": {
        "node": ">=24"
--- a/website/package-lock.json
+++ b/website/package-lock.json
--- a/website/package.json
+++ b/website/package.json
@@ -24,25 +24,25 @@
        "@goauthentik/eslint-config": "^1.0.5",
        "@goauthentik/prettier-config": "^3.1.0",
        "@goauthentik/tsconfig": "^1.0.4",
-        "@types/node": "^24.0.14",
+        "@types/node": "^24.0.15",
        "@typescript-eslint/eslint-plugin": "^8.37.0",
        "@typescript-eslint/parser": "^8.37.0",
        "eslint": "^9.30.1",
        "npm-run-all": "^4.1.5",
        "prettier": "^3.6.2",
-        "prettier-plugin-packagejson": "^2.5.18",
+        "prettier-plugin-packagejson": "^2.5.19",
        "typescript-eslint": "^8.37.0"
    },
    "optionalDependencies": {
        "@rspack/binding-darwin-arm64": "1.4.8",
        "@rspack/binding-linux-arm64-gnu": "1.4.8",
        "@rspack/binding-linux-x64-gnu": "1.4.8",
-        "@swc/core-darwin-arm64": "1.12.14",
-        "@swc/core-linux-arm64-gnu": "1.12.14",
-        "@swc/core-linux-x64-gnu": "1.12.14",
-        "@swc/html-darwin-arm64": "1.12.14",
-        "@swc/html-linux-arm64-gnu": "1.12.14",
-        "@swc/html-linux-x64-gnu": "1.12.14",
+        "@swc/core-darwin-arm64": "1.13.0",
+        "@swc/core-linux-arm64-gnu": "1.13.0",
+        "@swc/core-linux-x64-gnu": "1.13.0",
+        "@swc/html-darwin-arm64": "1.13.0",
+        "@swc/html-linux-arm64-gnu": "1.13.0",
+        "@swc/html-linux-x64-gnu": "1.13.0",
        "lightningcss-darwin-arm64": "1.30.1",
        "lightningcss-linux-arm64-gnu": "1.30.1",
        "lightningcss-linux-x64-gnu": "1.30.1"