flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) (#22371 )

flows: remove link to overview for non-internal user (#22362) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
providers/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5) (#22368 )
2026-05-15 03:16:22 +02:00 · 2026-05-15 01:20:59 +02:00 · 2026-05-14 11:54:21 -05:00 · 2026-05-14 16:21:41 +00:00 · 2026-05-14 17:53:30 +02:00 · 2026-05-14 16:34:45 +02:00
1378 changed files with 6298 additions and 28195 deletions
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -1,77 +0,0 @@
-name: "Setup Node.js and NPM"
-description: "Sets up Node.js with a specific NPM version via Corepack"
-inputs:
-  working-directory:
-    description: "Path to the working directory containing the package.json file"
-    required: false
-    default: "."
-  dependencies:
-    required: false
-    description: "List of dependencies to setup"
-    default: "monorepo,working-directory"
-  node-version-file:
-    description: "Path to file containing the Node.js version"
-    required: false
-    default: "package.json"
-  cache-dependency-path:
-    description: "Path to dependency lock file for caching"
-    required: false
-    default: "package-lock.json"
-  cache:
-    description: "Package manager to cache"
-    default: "npm"
-  registry-url:
-    description: "npm registry URL"
-    default: "https://registry.npmjs.org"
-
-runs:
-  using: "composite"
-  steps:
-    - name: Setup Node.js (Corepack bootstrap)
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4
-      with:
-        node-version-file: ${{ inputs.node-version-file }}
-        registry-url: ${{ inputs.registry-url }}
-        cache: ${{ inputs.cache }}
-        cache-dependency-path: |
-          ${{ inputs.cache-dependency-path }}
-          ${{ inputs.working-directory }}/${{ inputs.cache-dependency-path }}
-
-    - name: Install Corepack
-      working-directory: ${{ github.workspace}}
-      shell: bash
-      run: | #shell
-        node ./scripts/node/setup-corepack.mjs --force
-        corepack enable
-    - name: Lint Node.js and NPM versions
-      shell: bash
-      run: node ./scripts/node/lint-runtime.mjs
-    - name: Setup Node.js (Monorepo Root)
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4
-      with:
-        node-version-file: ${{ inputs.node-version-file }}
-        registry-url: ${{ inputs.registry-url }}
-    - name: Install monorepo dependencies
-      if: ${{ contains(inputs.dependencies, 'monorepo') }}
-      shell: bash
-      run: | #shell
-        node ./scripts/node/lint-lockfile.mjs
-        corepack npm ci
-    - name: Setup Node.js (Working Directory)
-      if: ${{ contains(inputs.dependencies, 'working-directory') }}
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4
-      with:
-        node-version-file: ${{ inputs.working-directory }}/${{ inputs.node-version-file }}
-        registry-url: ${{ inputs.registry-url }}
-
-    - name: Install working directory dependencies
-      if: ${{ contains(inputs.dependencies, 'working-directory') }}
-      shell: bash
-      run: | # shell
-        corepack install
-
-        echo "node version: $(node --version)"
-        echo "npm version: $(corepack npm --version)"
-
-        node ./scripts/node/lint-lockfile.mjs ${{ inputs.working-directory }}
-        corepack npm ci --prefix ${{ inputs.working-directory }}
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -52,26 +52,42 @@ runs:
      run: uv sync --all-extras --dev --locked
    - name: Setup rust (stable)
      if: ${{ contains(inputs.dependencies, 'rust') && !contains(inputs.dependencies, 'rust-nightly') }}
-      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+      uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
      with:
        rustflags: ""
    - name: Setup rust (nightly)
      if: ${{ contains(inputs.dependencies, 'rust-nightly') }}
-      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+      uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
      with:
        toolchain: nightly
        components: rustfmt
        rustflags: ""
    - name: Setup rust dependencies
      if: ${{ contains(inputs.dependencies, 'rust') }}
-      uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2
+      uses: taiki-e/install-action@711e1c3275189d76dcc4d34ddea63bf96ac49090 # v2
      with:
        tool: cargo-deny cargo-machete cargo-llvm-cov nextest
-    - name: Setup node (root, web)
+    - name: Setup node (web)
      if: ${{ contains(inputs.dependencies, 'node') }}
-      uses: ./.github/actions/setup-node
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4
      with:
-        working-directory: web
+        node-version-file: "${{ inputs.working-directory }}web/package.json"
+        cache: "npm"
+        cache-dependency-path: "${{ inputs.working-directory }}web/package-lock.json"
+        registry-url: "https://registry.npmjs.org"
+    - name: Setup node (root)
+      if: ${{ contains(inputs.dependencies, 'node') }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4
+      with:
+        node-version-file: "${{ inputs.working-directory }}package.json"
+        cache: "npm"
+        cache-dependency-path: "${{ inputs.working-directory }}package-lock.json"
+        registry-url: "https://registry.npmjs.org"
+    - name: Install Node deps
+      if: ${{ contains(inputs.dependencies, 'node') }}
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: npm ci
    - name: Setup go
      if: ${{ contains(inputs.dependencies, 'go') }}
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
@@ -89,7 +105,7 @@ runs:
      run: |
        export PSQL_TAG=${{ inputs.postgresql_version }}
        docker compose -f .github/actions/setup/compose.yml up -d --wait
-        corepack npm ci --prefix web
+        cd web && npm ci
    - name: Generate config
      if: ${{ contains(inputs.dependencies, 'python') }}
      shell: uv run python {0}
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -1,6 +1,3 @@
-codecov:
-  notify:
-    wait_for_ci: true
 coverage:
  status:
    project:
--- a/.github/workflows/_reusable-docker-build-single.yml
+++ b/.github/workflows/_reusable-docker-build-single.yml
@@ -67,16 +67,6 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: ./.github/actions/setup-node
-        with:
-          working-directory: web
-          dependencies: "monorepo"
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: "go.mod"
-      - name: Generate API Clients
-        run: |
-          make gen-client-ts
      - name: Build Docker Image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        id: push
--- a/.github/workflows/ci-api-docs.yml
+++ b/.github/workflows/ci-api-docs.yml
@@ -22,19 +22,25 @@ jobs:
          - prettier-check
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
-        with:
-          working-directory: website
+      - name: Install Dependencies
+        working-directory: website/
+        run: npm ci
      - name: Lint
-        run: corepack npm run ${{ matrix.command }} --prefix website
+        working-directory: website/
+        run: npm run ${{ matrix.command }}
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: website
+          node-version-file: website/package.json
+          cache: "npm"
+          cache-dependency-path: website/package-lock.json
+      - working-directory: website/
+        name: Install Dependencies
+        run: npm ci
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
        with:
          path: |
@@ -48,7 +54,7 @@ jobs:
        working-directory: website
        env:
          NODE_ENV: production
-        run: corepack npm run build -w api
+        run: npm run build -w api
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
        with:
          name: api-docs
@@ -65,9 +71,11 @@ jobs:
        with:
          name: api-docs
          path: website/api/build
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: website
+          node-version-file: website/package.json
+          cache: "npm"
+          cache-dependency-path: website/package-lock.json
      - name: Deploy Netlify (Production)
        working-directory: website/api
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
--- a/.github/workflows/ci-aws-cfn.yml
+++ b/.github/workflows/ci-aws-cfn.yml
@@ -24,9 +24,14 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
      - name: Setup authentik env
        uses: ./.github/actions/setup
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: lifecycle/aws
+          node-version-file: lifecycle/aws/package.json
+          cache: "npm"
+          cache-dependency-path: lifecycle/aws/package-lock.json
+      - working-directory: lifecycle/aws/
+        run: |
+          npm ci
      - name: Check changes have been applied
        run: |
          uv run make aws-cfn
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -24,34 +24,46 @@ jobs:
          - prettier-check
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
-        with:
-          working-directory: website
+      - name: Install dependencies
+        working-directory: website/
+        run: npm ci
      - name: Lint
-        run: corepack npm run ${{ matrix.command }} --prefix website
+        working-directory: website/
+        run: npm run ${{ matrix.command }}
  build-docs:
    runs-on: ubuntu-latest
    env:
      NODE_ENV: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
-        name: Setup Node.js
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: website
+          node-version-file: website/package.json
+          cache: "npm"
+          cache-dependency-path: website/package-lock.json
+      - working-directory: website/
+        name: Install Dependencies
+        run: npm ci
      - name: Build Documentation via Docusaurus
-        run: corepack npm run build --prefix website
+        working-directory: website/
+        run: npm run build
  build-integrations:
    runs-on: ubuntu-latest
    env:
      NODE_ENV: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: website
+          node-version-file: website/package.json
+          cache: "npm"
+          cache-dependency-path: website/package-lock.json
+      - working-directory: website/
+        name: Install Dependencies
+        run: npm ci
      - name: Build Integrations via Docusaurus
-        run: corepack npm run build -w integrations --prefix website
+        working-directory: website/
+        run: npm run build -w integrations
  build-container:
    runs-on: ubuntu-latest
    permissions:
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -109,13 +109,8 @@ jobs:
      - name: checkout stable
        run: |
          set -e -o pipefail
-
          cp -R .github ..
          cp -R scripts ..
-
-          mkdir -p ../packages
-          cp -R packages/logger-js ../packages/logger-js
-
          # Previous stable tag
          prev_stable=$(git tag --sort=version:refname | grep '^version/' | grep -vE -- '-rc[0-9]+$' | tail -n1)
          # Current version family based on
@@ -123,13 +118,10 @@ jobs:
          if [[ -n $current_version_family ]]; then
              prev_stable="version/${current_version_family}"
          fi
-
          echo "::notice::Checking out ${prev_stable} as stable version..."
          git checkout ${prev_stable}
-
-          rm -rf .github/ scripts/ packages/logger-js/
+          rm -rf .github/ scripts/
          mv ../.github ../scripts .
-          mv ../packages/logger-js ./packages/
      - name: Setup authentik env (stable)
        uses: ./.github/actions/setup
        with:
@@ -260,7 +252,6 @@ jobs:
          COMPOSE_PROFILES: ${{ matrix.job.profiles }}
        run: |
          docker compose -f tests/e2e/compose.yml up -d --quiet-pull
-      - uses: ./.github/actions/setup-node
      - id: cache-web
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
        if: contains(matrix.job.profiles, 'selenium')
@@ -270,12 +261,10 @@ jobs:
      - name: prepare web ui
        if: steps.cache-web.outputs.cache-hit != 'true' && contains(matrix.job.profiles, 'selenium')
        working-directory: web
-        env:
-          NODE_ENV: "production"
        run: |
-          corepack npm ci
-          corepack npm run build
-          corepack npm run build:sfe
+          npm ci
+          npm run build
+          npm run build:sfe
      - name: run e2e
        run: |
          uv run coverage run manage.py test ${{ matrix.job.glob }}
@@ -324,12 +313,11 @@ jobs:
          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/src/**', 'web/packages/sfe/src/**') }}-b
      - name: prepare web ui
        if: steps.cache-web.outputs.cache-hit != 'true'
-        env:
-          NODE_ENV: "production"
+        working-directory: web
        run: |
-          corepack npm ci --prefix web
-          corepack npm run build --prefix web
-          corepack npm run build:sfe --prefix web
+          npm ci
+          npm run build
+          npm run build:sfe
      - name: run conformance
        run: |
          uv run coverage run manage.py test ${{ matrix.job.glob }}
--- a/.github/workflows/ci-outpost.yml
+++ b/.github/workflows/ci-outpost.yml
@@ -145,11 +145,16 @@ jobs:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: "go.mod"
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: web/package.json
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
      - name: Build web
-        run: corepack npm run build-proxy --prefix web
+        working-directory: web/
+        run: |
+          npm ci
+          npm run build-proxy
      - name: Build outpost
        run: |
          set -x
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -15,34 +15,48 @@ on:
 jobs:
  lint:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        command:
+          - lint
+          - lint:lockfile
+          - tsc
+          - prettier-check
+        project:
+          - web
+        include:
+          - command: tsc
+            project: web
+          - command: lit-analyse
+            project: web
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: ${{ matrix.project }}/package.json
+          cache: "npm"
+          cache-dependency-path: ${{ matrix.project }}/package-lock.json
+      - working-directory: ${{ matrix.project }}/
+        run: |
+          npm ci
      - name: Lint
-        run: corepack npm run lint-check --prefix web
-      - name: Check types
-        run: corepack npm run tsc --prefix web
-      - name: Check formatting
-        run: corepack npm run prettier-check --prefix web
-      - name: Lit analyse
-        run: corepack npm run lit-analyse --prefix web
-
+        working-directory: ${{ matrix.project }}/
+        run: npm run ${{ matrix.command }}
  build:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: web/package.json
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+      - working-directory: web/
+        run: npm ci
      - name: build
-        env:
-          NODE_ENV: "production"
        working-directory: web/
-        run: corepack npm run build
+        run: npm run build
  ci-web-mark:
    if: always()
    needs:
@@ -57,12 +71,15 @@ jobs:
    needs:
      - ci-web-mark
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: web/package.json
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+      - working-directory: web/
+        run: npm ci
      - name: test
        working-directory: web/
-        run: corepack npm run test || exit 0
+        run: npm run test || exit 0
--- a/.github/workflows/packages-npm-publish.yml
+++ b/.github/workflows/packages-npm-publish.yml
@@ -35,19 +35,22 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
        with:
          fetch-depth: 2
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: ${{ matrix.package }}
+          node-version-file: ${{ matrix.package }}/package.json
+          registry-url: "https://registry.npmjs.org"
      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # 24d32ffd492484c1d75e0c0b894501ddb9d30d62
        with:
          files: |
            ${{ matrix.package }}/package.json
+      - name: Install Dependencies
+        run: npm ci
      - name: Publish package
        if: steps.changed-files.outputs.any_changed == 'true'
        working-directory: ${{ matrix.package }}
        run: |
-          corepack npm ci
-          corepack npm run build
-          corepack npm publish
+          npm ci
+          npm run build
+          npm publish
--- a/.github/workflows/qa-codeql.yml
+++ b/.github/workflows/qa-codeql.yml
@@ -28,10 +28,10 @@ jobs:
      - name: Setup authentik env
        uses: ./.github/actions/setup
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.35.4
+        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.35.4
+        uses: github/codeql-action/autobuild@v4
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.35.4
+        uses: github/codeql-action/analyze@v4
--- a/.github/workflows/release-branch-off.yml
+++ b/.github/workflows/release-branch-off.yml
@@ -5,7 +5,7 @@ on:
  workflow_dispatch:
    inputs:
      next_version:
-        description: Next version (for example, if you're currently releasing 2026.5, then enter 2026.8)
+        description: Next major version (for example, if releasing 2042.2, this is 2042.4)
        required: true
        type: string

@@ -74,8 +74,6 @@ jobs:
        run: make migrate
      - name: Bump version
        run: "make bump version=${{ inputs.next_version }}.0-rc1"
-      - name: Re-generate API Clients
-        run: make gen
      - name: Create pull request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
        with:
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -87,9 +87,11 @@ jobs:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: "go.mod"
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: web/package.json
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - name: Set up Docker Buildx
@@ -149,9 +151,15 @@ jobs:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: "go.mod"
-      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v5
        with:
-          working-directory: web
+          node-version-file: web/package.json
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+      - name: Install web dependencies
+        working-directory: web/
+        run: |
+          npm ci
      - name: Build web
        working-directory: web/
        run: |
@@ -183,7 +191,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-      - uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik"
          aws-region: ${{ env.AWS_REGION }}
--- a/.github/workflows/repo-stale.yml
+++ b/.github/workflows/repo-stale.yml
@@ -27,6 +27,8 @@ jobs:
          exempt-issue-labels: pinned,security,pr_wanted,enhancement,bug/confirmed,enhancement/confirmed,question,status/reviewing
          stale-issue-label: status/stale
          stale-issue-message: >
-            This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
+            This issue has been automatically marked as stale because it has not had
+            recent activity. It will be closed if no further activity occurs. Thank you
+            for your contributions.
          # Don't stale PRs, so only apply to PRs with a non-existent label
          only-pr-labels: foo
--- a/.gitignore
+++ b/.gitignore
@@ -14,8 +14,6 @@ media
 # Node

 node_modules
-corepack.tgz
-.corepack

 .cspellcache
 cspell-report.*
--- a/.npmrc
+++ b/.npmrc
@@ -1,20 +0,0 @@
-# Block lifecycle scripts (preinstall/install/postinstall/prepare) from dependencies.
-# This neutralizes the dominant npm supply-chain attack vector.
-#
-# Packages that legitimately need a build step (e.g. esbuild, chromedriver, tree-sitter)
-# must be rebuilt explicitly:
-#
-#   npm rebuild --foreground-scripts esbuild chromedriver tree-sitter tree-sitter-json
-ignore-scripts=true
-
-# Fail fast if the active Node/npm doesn't match the "engines" field.
-engine-strict=true
-
-# Pin exact versions so `npm install <pkg>` writes "1.2.3" not "^1.2.3".
-save-exact=true
-
-# Surface CVE warnings during install; doesn't block.
-audit=true
-
-# Suppress funding banners.
-fund=false
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -20,9 +20,6 @@
    },
    "todo-tree.tree.showCountsInTree": true,
    "todo-tree.tree.showBadges": true,
-    "yaml.format.printWidth": 200,
-    "yaml.format.singleQuote": true,
-    "yaml.format.bracketSpacing": false,
    "yaml.customTags": [
        "!Condition sequence",
        "!Context scalar",
--- a/1
+++ b/1
@@ -34,7 +34,6 @@ packages/django-channels-postgres       @goauthentik/backend
 packages/django-postgres-cache          @goauthentik/backend
 packages/django-dramatiq-postgres       @goauthentik/backend
 # Web packages
-.npmrc                                  @goauthentik/frontend
 tsconfig.json                           @goauthentik/frontend
 package.json                            @goauthentik/frontend
 package-lock.json                       @goauthentik/frontend
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -171,7 +171,7 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"

 [[package]]
 name = "authentik"
-version = "2026.8.0-rc1"
+version = "2026.5.0-rc2"
 dependencies = [
 "arc-swap",
 "argh",
@@ -196,7 +196,7 @@ dependencies = [

 [[package]]
 name = "authentik-axum"
-version = "2026.8.0-rc1"
+version = "2026.5.0-rc2"
 dependencies = [
 "authentik-common",
 "axum",
@@ -216,7 +216,7 @@ dependencies = [

 [[package]]
 name = "authentik-client"
-version = "2026.8.0-rc1"
+version = "2026.5.0-rc2"
 dependencies = [
 "aws-lc-rs",
 "reqwest",
@@ -232,7 +232,7 @@ dependencies = [

 [[package]]
 name = "authentik-common"
-version = "2026.8.0-rc1"
+version = "2026.5.0-rc2"
 dependencies = [
 "arc-swap",
 "authentik-client",
@@ -288,9 +288,9 @@ dependencies = [

 [[package]]
 name = "aws-lc-rs"
-version = "1.17.0"
+version = "1.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
 dependencies = [
 "aws-lc-fips-sys",
 "aws-lc-sys",
@@ -300,9 +300,9 @@ dependencies = [

 [[package]]
 name = "aws-lc-sys"
-version = "0.41.0"
+version = "0.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
 dependencies = [
 "cc",
 "cmake",
@@ -1744,6 +1744,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "iri-string"
+version = "0.7.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8e7418f59cc01c88316161279a7f665217ae316b388e58a0d10e29f54f1e5eb"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -3193,9 +3203,9 @@ checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"

 [[package]]
 name = "sentry"
-version = "0.48.1"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b93b3e19f45495ddd41d8222a152c48c84f6ba45abe9c69e2527e9cdea29bb5b"
+checksum = "e8ac94aab850a23d7507307cc505332ed2bafd36c65930dfc5c43610f9e9b477"
 dependencies = [
 "cfg_aliases",
 "httpdate",
@@ -3390,9 +3400,9 @@ dependencies = [

 [[package]]
 name = "serde_with"
-version = "3.19.0"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05839ce67618e14a09b286535c0d9c94e85ef25469b0e13cb4f844e5593eb19"
+checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
 dependencies = [
 "base64 0.22.1",
 "chrono",
@@ -4072,21 +4082,21 @@ dependencies = [

 [[package]]
 name = "tower-http"
-version = "0.6.10"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
 "bitflags 2.11.0",
 "bytes",
 "futures-util",
 "http",
 "http-body",
+ "iri-string",
 "pin-project-lite",
 "tokio",
 "tower",
 "tower-layer",
 "tower-service",
- "url",
 ]

 [[package]]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 resolver = "3"

 [workspace.package]
-version = "2026.8.0-rc1"
+version = "2026.5.0-rc2"
 authors = ["authentik Team <hello@goauthentik.io>"]
 description = "Making authentication simple."
 edition = "2024"
@@ -22,7 +22,7 @@ publish = false
 arc-swap = "= 1.9.1"
 argh = "= 0.1.19"
 axum-server = { version = "= 0.8.0", features = ["tls-rustls-no-provider"] }
-aws-lc-rs = { version = "= 1.17.0", features = ["fips"] }
+aws-lc-rs = { version = "= 1.16.3", features = ["fips"] }
 axum = { version = "= 0.8.9", features = ["http2", "macros", "ws"] }
 clap = { version = "= 4.6.1", features = ["derive", "env"] }
 client-ip = { version = "0.2.1", features = ["forwarded-header"] }
@@ -67,7 +67,7 @@ reqwest-middleware = { version = "= 0.5.1", features = [
  "rustls",
 ] }
 rustls = { version = "= 0.23.40", features = ["fips"] }
-sentry = { version = "= 0.48.1", default-features = false, features = [
+sentry = { version = "= 0.48.0", default-features = false, features = [
  "backtrace",
  "contexts",
  "debug-images",
@@ -80,7 +80,7 @@ sentry = { version = "= 0.48.1", default-features = false, features = [
 serde = { version = "= 1.0.228", features = ["derive"] }
 serde_json = "= 1.0.149"
 serde_repr = "= 0.1.20"
-serde_with = { version = "= 3.19.0", default-features = false, features = [
+serde_with = { version = "= 3.18.0", default-features = false, features = [
  "base64",
 ] }
 sqlx = { version = "= 0.8.6", default-features = false, features = [
@@ -102,7 +102,7 @@ tokio-retry2 = "= 0.9.1"
 tokio-rustls = "= 0.26.4"
 tokio-util = { version = "= 0.7.18", features = ["full"] }
 tower = "= 0.5.3"
-tower-http = { version = "= 0.6.10", features = ["timeout"] }
+tower-http = { version = "= 0.6.8", features = ["timeout"] }
 tracing = "= 0.1.44"
 tracing-error = "= 0.2.1"
 tracing-subscriber = { version = "= 0.3.23", features = [
@@ -115,9 +115,9 @@ url = "= 2.5.8"
 uuid = { version = "= 1.23.1", features = ["serde", "v4"] }
 which = "= 8.0.2"

-ak-axum = { package = "authentik-axum", version = "2026.8.0-rc1", path = "./packages/ak-axum" }
-ak-client = { package = "authentik-client", version = "2026.8.0-rc1", path = "./packages/client-rust" }
-ak-common = { package = "authentik-common", version = "2026.8.0-rc1", path = "./packages/ak-common", default-features = false }
+ak-axum = { package = "authentik-axum", version = "2026.5.0-rc2", path = "./packages/ak-axum" }
+ak-client = { package = "authentik-client", version = "2026.5.0-rc2", path = "./packages/client-rust" }
+ak-common = { package = "authentik-common", version = "2026.5.0-rc2", path = "./packages/ak-common", default-features = false }

 [workspace.lints.rust]
 ambiguous_negative_literals = "warn"
--- a/70
+++ b/70
@@ -106,9 +106,8 @@ migrate: ## Run the Authentik Django server's migrations

 i18n-extract: core-i18n-extract web-i18n-extract  ## Extract strings that require translation into files to send to a translation service

-aws-cfn: node-install
-	corepack npm install --prefix lifecycle/aws
-	$(UV) run corepack npm run aws-cfn --prefix lifecycle/aws
+aws-cfn:
+	cd lifecycle/aws && npm i && $(UV) run npm run aws-cfn

 run:  ## Run the main authentik server and worker processes
 	$(UV) run ak allinone
@@ -126,7 +125,7 @@ core-i18n-extract:
 		--ignore website \
 		-l en

-install: node-install web-install core-install  ## Install all requires dependencies for `node`, `web` and `core`
+install: node-install docs-install core-install  ## Install all requires dependencies for `node`, `docs` and `core`

 dev-drop-db:
 	$(eval pg_user := $(shell $(UV) run python -m authentik.lib.config postgresql.user 2>/dev/null))
@@ -229,55 +228,39 @@ gen-dev-config:  ## Generate a local development config file
 ## Node.js
 #########################

-# Packages whose install/postinstall scripts are required for correct
-# operation (binary downloads, native bindings). The root .npmrc sets
-# `ignore-scripts=true` to block dependency lifecycle scripts by default;
-# this list is rebuilt explicitly with scripts re-enabled. Audit any
-# additions: each entry runs arbitrary code at install time.
-TRUSTED_INSTALL_SCRIPTS := esbuild chromedriver tree-sitter tree-sitter-json
-
-node-preinstall: ## Install corepack and lint the runtime to ensure the correct Node.js version is being used before installing dependencies.
-	node ./scripts/node/setup-corepack.mjs
-	node ./scripts/node/lint-runtime.mjs
-
-node-install: node-preinstall ## Install the necessary libraries to build Node.js packages
-	corepack npm ci
+node-install:  ## Install the necessary libraries to build Node.js packages
+	npm ci
+	npm ci --prefix web

 #########################
 ## Web
 #########################

-web-install: ## Install the necessary libraries to build the Authentik UI
-	corepack npm ci --prefix web
-
-web-postinstall:  ## Trigger postinstall scripts for packages with native bindings or binary downloads, which are blocked by default for security reasons.
-	corepack npm rebuild --prefix web --ignore-scripts=false --foreground-scripts $(TRUSTED_INSTALL_SCRIPTS)
-
 web-build: node-install  ## Build the Authentik UI
-	corepack npm run --prefix web build
+	npm run --prefix web build

 web: web-lint-fix web-lint web-check-compile  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it

 web-test: ## Run tests for the Authentik UI
-	corepack npm run --prefix web test
+	npm run --prefix web test

 web-watch:  ## Build and watch the Authentik UI for changes, updating automatically
-	corepack npm run --prefix web watch
+	npm run --prefix web watch
 web-storybook-watch:  ## Build and run the storybook documentation server
-	corepack npm run --prefix web storybook
+	npm run --prefix web storybook

 web-lint-fix:
-	corepack npm run --prefix web prettier
+	npm run --prefix web prettier

 web-lint:
-	corepack npm run --prefix web lint
-	corepack npm run --prefix web lit-analyse
+	npm run --prefix web lint
+	npm run --prefix web lit-analyse

 web-check-compile:
-	corepack npm run --prefix web tsc
+	npm run --prefix web tsc

 web-i18n-extract:
-	corepack npm run --prefix web extract-locales
+	npm run --prefix web extract-locales

 #########################
 ## Docs
@@ -285,36 +268,35 @@ web-i18n-extract:

 docs: docs-lint-fix docs-build  ## Automatically fix formatting issues in the Authentik docs source code, lint the code, and compile it

-docs-install: node-install  ## Install the necessary libraries to build the Authentik documentation
-	corepack npm ci --prefix website
+docs-install:
+	npm ci --prefix website

 docs-lint-fix: lint-spellcheck
-	corepack npm run --prefix website prettier
+	npm run --prefix website prettier

 docs-build:
-	node ./scripts/node/lint-runtime.mjs website
-	corepack npm run --prefix website build
+	npm run --prefix website build

 docs-watch:  ## Build and watch the topics documentation
-	corepack npm run --prefix website start
+	npm run --prefix website start

 integrations: docs-lint-fix integrations-build ## Fix formatting issues in the integrations source code, lint the code, and compile it

 integrations-build:
-	corepack npm run --prefix website -w integrations build
+	npm run --prefix website -w integrations build

 integrations-watch:  ## Build and watch the Integrations documentation
-	corepack npm run --prefix website -w integrations start
+	npm run --prefix website -w integrations start

 docs-api-build:
-	corepack npm run --prefix website -w api build
+	npm run --prefix website -w api build

 docs-api-watch:  ## Build and watch the API documentation
-	corepack npm run --prefix website -w api generate
-	corepack npm run --prefix website -w api start
+	npm run --prefix website -w api generate
+	npm run --prefix website -w api start

 docs-api-clean: ## Clean generated API documentation
-	corepack npm run --prefix website -w api build:api:clean
+	npm run --prefix website -w api build:api:clean

 #########################
 ## Docker
--- a/authentik/init.py
+++ b/authentik/init.py
@@ -3,7 +3,7 @@
 from functools import lru_cache
 from os import environ

-VERSION = "2026.8.0-rc1"
+VERSION = "2026.5.0-rc2"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"


--- a/authentik/stages/captcha/api.py
+++ b/authentik/stages/captcha/api.py
@@ -17,7 +17,6 @@ class CaptchaStageSerializer(StageSerializer):
            "private_key",
            "js_url",
            "api_url",
-            "request_content_type",
            "interactive",
            "score_min_threshold",
            "score_max_threshold",
--- a/authentik/stages/captcha/migrations/0005_captchastage_request_content_type.py
+++ b/authentik/stages/captcha/migrations/0005_captchastage_request_content_type.py
@@ -1,24 +0,0 @@
-# Generated by Django 5.2.14 on 2026-05-14 23:58
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_stages_captcha", "0004_captchastage_interactive"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="captchastage",
-            name="request_content_type",
-            field=models.TextField(
-                choices=[
-                    ("application/x-www-form-urlencoded", "Form encoded"),
-                    ("application/json", "JSON"),
-                ],
-                default="application/x-www-form-urlencoded",
-            ),
-        ),
-    ]
--- a/authentik/stages/captcha/models.py
+++ b/authentik/stages/captcha/models.py
@@ -8,13 +8,6 @@ from rest_framework.serializers import BaseSerializer
 from authentik.flows.models import Stage


-class CaptchaRequestContentType(models.TextChoices):
-    """Supported request content types for CAPTCHA verification."""
-
-    FORM = "application/x-www-form-urlencoded", _("Form encoded")
-    JSON = "application/json", _("JSON")
-
-
 class CaptchaStage(Stage):
    """Verify the user is human using Google's reCaptcha/other compatible CAPTCHA solutions."""

@@ -37,10 +30,6 @@ class CaptchaStage(Stage):

    js_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api.js")
    api_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api/siteverify")
-    request_content_type = models.TextField(
-        choices=CaptchaRequestContentType.choices,
-        default=CaptchaRequestContentType.FORM,
-    )

    @property
    def serializer(self) -> type[BaseSerializer]:
--- a/authentik/stages/captcha/stage.py
+++ b/authentik/stages/captcha/stage.py
@@ -15,7 +15,7 @@ from authentik.flows.challenge import (
 from authentik.flows.stage import ChallengeStageView
 from authentik.lib.utils.http import get_http_session
 from authentik.root.middleware import ClientIPMiddleware
-from authentik.stages.captcha.models import CaptchaRequestContentType, CaptchaStage
+from authentik.stages.captcha.models import CaptchaStage

 LOGGER = get_logger()
 PLAN_CONTEXT_CAPTCHA = "captcha"
@@ -35,23 +35,17 @@ class CaptchaChallenge(WithUserInfoChallenge):

 def verify_captcha_token(stage: CaptchaStage, token: str, remote_ip: str, key: str | None = None):
    """Validate captcha token"""
-    payload = {
-        "secret": key or stage.private_key,
-        "response": token,
-        "remoteip": remote_ip,
-    }
-    body_kwargs = (
-        {"json": payload}
-        if stage.request_content_type == CaptchaRequestContentType.JSON
-        else {"data": payload}
-    )
    try:
        response = get_http_session().post(
            stage.api_url,
            headers={
-                "Content-Type": stage.request_content_type,
+                "Content-type": "application/x-www-form-urlencoded",
+            },
+            data={
+                "secret": key or stage.private_key,
+                "response": token,
+                "remoteip": remote_ip,
            },
-            **body_kwargs,
        )
        response.raise_for_status()
        data = response.json()
--- a/authentik/stages/captcha/tests.py
+++ b/authentik/stages/captcha/tests.py
@@ -10,7 +10,7 @@ from authentik.flows.planner import FlowPlan
 from authentik.flows.tests import FlowTestCase
 from authentik.flows.views.executor import SESSION_KEY_PLAN
 from authentik.lib.generators import generate_id
-from authentik.stages.captcha.models import CaptchaRequestContentType, CaptchaStage
+from authentik.stages.captcha.models import CaptchaStage
 from authentik.stages.captcha.stage import (
    PLAN_CONTEXT_CAPTCHA_PRIVATE_KEY,
    PLAN_CONTEXT_CAPTCHA_SITE_KEY,
@@ -56,39 +56,6 @@ class TestCaptchaStage(FlowTestCase):
        )
        self.assertEqual(response.status_code, 200)
        self.assertStageRedirects(response, reverse("authentik_core:root-redirect"))
-        self.assertEqual(
-            mock.request_history[0].headers["Content-Type"],
-            CaptchaRequestContentType.FORM,
-        )
-        self.assertIn("response=PASSED", mock.request_history[0].text)
-
-    @Mocker()
-    def test_valid_json_content_type(self, mock: Mocker):
-        """Test valid captcha with JSON verification request"""
-        self.stage.request_content_type = CaptchaRequestContentType.JSON
-        self.stage.save()
-        mock.post(
-            "https://www.recaptcha.net/recaptcha/api/siteverify",
-            json={
-                "success": True,
-                "score": 0.5,
-            },
-        )
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, bindings=[self.binding], markers=[StageMarker()])
-        session = self.client.session
-        session[SESSION_KEY_PLAN] = plan
-        session.save()
-        response = self.client.post(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": self.flow.slug}),
-            {"token": "PASSED"},
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageRedirects(response, reverse("authentik_core:root-redirect"))
-        self.assertEqual(
-            mock.request_history[0].headers["Content-Type"],
-            CaptchaRequestContentType.JSON,
-        )
-        self.assertEqual(mock.request_history[0].json()["response"], "PASSED")

    @Mocker()
    def test_valid_override(self, mock: Mocker):
--- a/authentik/stages/email/utils.py
+++ b/authentik/stages/email/utils.py
@@ -4,7 +4,6 @@ from email.mime.image import MIMEImage
 from functools import lru_cache
 from pathlib import Path

-from django.conf import settings
 from django.core.mail import EmailMultiAlternatives
 from django.core.mail.message import sanitize_address
 from django.template.exceptions import TemplateDoesNotExist
@@ -15,10 +14,9 @@ from django.utils import translation
@lru_cache
 def logo_data() -> MIMEImage:
    """Get logo as MIME Image for emails"""
-    path = Path("web/dist/assets/icons/icon_left_brand.png")
-    # When running tests, assets might not exist, so fallback to a different icon
-    if settings.TEST:
-        path = Path("web/authentik/sources/saml.png")
+    path = Path("web/icons/icon_left_brand.png")
+    if not path.exists():
+        path = Path("web/dist/assets/icons/icon_left_brand.png")
    with open(path, "rb") as _logo_file:
        logo = MIMEImage(_logo_file.read())
    logo.add_header("Content-ID", "<logo>")
--- a/blueprints/schema.json
+++ b/blueprints/schema.json
@@ -2,7 +2,7 @@
    "$schema": "http://json-schema.org/draft-07/schema",
    "$id": "https://goauthentik.io/blueprints/schema.json",
    "type": "object",
-    "title": "authentik 2026.8.0-rc1 Blueprint schema",
+    "title": "authentik 2026.5.0-rc2 Blueprint schema",
    "required": [
        "version",
        "entries"
@@ -15160,14 +15160,6 @@
                    "minLength": 1,
                    "title": "Api url"
                },
-                "request_content_type": {
-                    "type": "string",
-                    "enum": [
-                        "application/x-www-form-urlencoded",
-                        "application/json"
-                    ],
-                    "title": "Request content type"
-                },
                "interactive": {
                    "type": "boolean",
                    "title": "Interactive"
--- a/go.mod
+++ b/go.mod
@@ -7,10 +7,10 @@ require (
 	beryju.io/radius-eap v0.1.0
 	github.com/avast/retry-go/v4 v4.7.0
 	github.com/coreos/go-oidc/v3 v3.18.0
-	github.com/getsentry/sentry-go v0.46.2
+	github.com/getsentry/sentry-go v0.46.1
 	github.com/go-http-utils/etag v0.0.0-20161124023236-513ea8f21eb1
 	github.com/go-ldap/ldap/v3 v3.4.13
-	github.com/go-openapi/runtime v0.29.5
+	github.com/go-openapi/runtime v0.29.4
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/handlers v1.5.2
@@ -18,7 +18,7 @@ require (
 	github.com/gorilla/securecookie v1.1.2
 	github.com/gorilla/sessions v1.4.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/grafana/pyroscope-go v1.3.0
+	github.com/grafana/pyroscope-go v1.2.8
 	github.com/jackc/pgx/v5 v5.9.2
 	github.com/jellydator/ttlcache/v3 v3.4.0
 	github.com/mitchellh/mapstructure v1.5.0
@@ -57,7 +57,7 @@ require (
 	github.com/go-openapi/jsonreference v0.21.5 // indirect
 	github.com/go-openapi/loads v0.23.3 // indirect
 	github.com/go-openapi/spec v0.22.4 // indirect
-	github.com/go-openapi/strfmt v0.26.2 // indirect
+	github.com/go-openapi/strfmt v0.26.1 // indirect
 	github.com/go-openapi/swag/conv v0.26.0 // indirect
 	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
 	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
@@ -69,14 +69,14 @@ require (
 	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
 	github.com/go-openapi/validate v0.25.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/grafana/pyroscope-go/godeltaprof v0.1.10 // indirect
+	github.com/grafana/pyroscope-go/godeltaprof v0.1.9 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -90,10 +90,10 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -20,8 +20,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/getsentry/sentry-go v0.46.2 h1:1jhYwrKGa3sIpo/y5iDNXS5wDoT7I1KNzMHrnK6ojns=
-github.com/getsentry/sentry-go v0.46.2/go.mod h1:evVbw2qotNUdYG8KxXbAdjOQWWvWIwKxpjdZZIvcIPw=
+github.com/getsentry/sentry-go v0.46.1 h1:mZyQFaQYkPxAdDG4HR8gDg6j4CnKYVWt4TF92N7i3XY=
+github.com/getsentry/sentry-go v0.46.1/go.mod h1:evVbw2qotNUdYG8KxXbAdjOQWWvWIwKxpjdZZIvcIPw=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
@@ -51,12 +51,12 @@ github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe
 github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
 github.com/go-openapi/loads v0.23.3 h1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ=
 github.com/go-openapi/loads v0.23.3/go.mod h1:NOH07zLajXo8y55hom0omlHWDVVvCwBM/S+csCK8LqA=
-github.com/go-openapi/runtime v0.29.5 h1:uc5+/TtqLIfDBTUxnF3uppoGMt+9DzonwUWsviINlrY=
-github.com/go-openapi/runtime v0.29.5/go.mod h1:D9IUbWccdYv+km8QwmAm90FZvDcQk47vP2Y7y5as/D8=
+github.com/go-openapi/runtime v0.29.4 h1:k2lDxrGoSAJRdhFG2tONKMpkizY/4X1cciSdtzk4Jjo=
+github.com/go-openapi/runtime v0.29.4/go.mod h1:K0k/2raY6oqXJnZAgWJB2i/12QKrhUKpZcH4PfV9P18=
 github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=
 github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ=
-github.com/go-openapi/strfmt v0.26.2 h1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM=
-github.com/go-openapi/strfmt v0.26.2/go.mod h1:fXh1e449cyUn2NYuz+wb3wARBUdMl7qPEZwX00nqivY=
+github.com/go-openapi/strfmt v0.26.1 h1:7zGCHji7zSYDC2tCXIusoxYQz/48jAf2q+sF6wXTG+c=
+github.com/go-openapi/strfmt v0.26.1/go.mod h1:Zslk5VZPOISLwmWTMBIS7oiVFem1o1EI6zULY8Uer7Y=
 github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
 github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
 github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU=
@@ -77,10 +77,10 @@ github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFu
 github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
 github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=
 github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.0 h1:3hZD1fwydvCx/cc1R2uYNQirHqf2s6lqpKV3FcNTURA=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.0/go.mod h1:TvDZKBH7ZbMaF3EqH2AwTvNQCmzyZq8K1agRjf1B+Nk=
-github.com/go-openapi/testify/v2 v2.5.0 h1:UOCr63aAsMIDydZbZGqo5Ev01D4eydItRbekDuZMJLw=
-github.com/go-openapi/testify/v2 v2.5.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE=
+github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4=
+github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-openapi/validate v0.25.2 h1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0=
 github.com/go-openapi/validate v0.25.2/go.mod h1:Pgl1LpPPGFnZ+ys4/hTlDiRYQdI1ocKypgE+8Q8BLfY=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
@@ -105,10 +105,10 @@ github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2e
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grafana/pyroscope-go v1.3.0 h1:t3Jehad8vvqN4oRAB0LdmfQ5ZSUXQw3asoft+K4GAT8=
-github.com/grafana/pyroscope-go v1.3.0/go.mod h1:XA7I3usNx+UdjOZfQnl1WV8y924vsJo9KIVrKB+9jx4=
-github.com/grafana/pyroscope-go/godeltaprof v0.1.10 h1:dvhndEbyavTb59vFCd6PsrAG5qi69/qZZtegh/TJKSY=
-github.com/grafana/pyroscope-go/godeltaprof v0.1.10/go.mod h1:XnWRGg2XO5uxZdiz1rfeJH6w1eZ+YICCBVXNWOfH86g=
+github.com/grafana/pyroscope-go v1.2.8 h1:UvCwIhlx9DeV7F6TW/z8q1Mi4PIm3vuUJ2ZlCEvmA4M=
+github.com/grafana/pyroscope-go v1.2.8/go.mod h1:SSi59eQ1/zmKoY/BKwa5rSFsJaq+242Bcrr4wPix1g8=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.9 h1:c1Us8i6eSmkW+Ez05d3co8kasnuOY813tbMN8i/a3Og=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.9/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -139,8 +139,8 @@ github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -216,8 +216,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab h1:628ME69lBm9C6JY2wXhAph/yjN3jezx1z7BIDLUwxjo=
 golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -227,8 +227,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -245,8 +245,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -258,8 +258,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
--- a/internal/constants/VERSION
+++ b/internal/constants/VERSION
@@ -1 +1 @@
-2026.8.0-rc1
+2026.5.0-rc2
--- a/lifecycle/aws/package-lock.json
+++ b/lifecycle/aws/package-lock.json
@@ -9,12 +9,12 @@
            "version": "0.0.0",
            "license": "MIT",
            "devDependencies": {
-                "aws-cdk": "^2.1121.0",
+                "aws-cdk": "^2.1120.0",
                "cross-env": "^10.1.0"
            },
            "engines": {
-                "node": ">=24",
-                "npm": ">=11.14.1"
+                "node": ">=20",
+                "npm": ">=11.6.2"
            }
        },
        "node_modules/@epic-web/invariant": {
@@ -25,9 +25,9 @@
            "license": "MIT"
        },
        "node_modules/aws-cdk": {
-            "version": "2.1121.0",
-            "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1121.0.tgz",
-            "integrity": "sha512-cG7CHt/SytYTfwrK+BUNQpqmS1dwhjt8z6ExKL6GK4n+8/6ZCwFzxlZWA/jUd2+Y9xPc+Q8cLKfMqGmgxEXbkg==",
+            "version": "2.1120.0",
+            "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1120.0.tgz",
+            "integrity": "sha512-vDVa0IX0FhizARdY/GLSParFglKbdHCIhM8IDmynrAv9w8uLLljzWMeLUOhC1XpMErDZ/npYEihAOjfKxTaMIw==",
            "dev": true,
            "license": "Apache-2.0",
            "bin": {
--- a/lifecycle/aws/package.json
+++ b/lifecycle/aws/package.json
@@ -7,24 +7,11 @@
        "aws-cfn": "cross-env CI=false cdk synth --version-reporting=false > template.yaml"
    },
    "devDependencies": {
-        "aws-cdk": "^2.1121.0",
+        "aws-cdk": "^2.1120.0",
        "cross-env": "^10.1.0"
    },
    "engines": {
-        "node": ">=24",
-        "npm": ">=11.14.1"
-    },
-    "devEngines": {
-        "runtime": {
-            "name": "node",
-            "onFail": "warn",
-            "version": ">=24"
-        },
-        "packageManager": {
-            "name": "npm",
-            "version": ">=11.14.1",
-            "onFail": "warn"
-        }
-    },
-    "packageManager": "npm@11.14.1+sha512.6a8a4d67478497a2dbc6815cad72e64c43f33413717e242756047d466241ab39bee61e691683a64658e94496ec5f1a1c05e4a5ec62dcc773280dfd949443a367"
+        "node": ">=20",
+        "npm": ">=11.6.2"
+    }
 }
--- a/lifecycle/aws/template.yaml
+++ b/lifecycle/aws/template.yaml
@@ -18,7 +18,7 @@ Parameters:
    Description: authentik Docker image
  AuthentikVersion:
    Type: String
-    Default: 2026.8.0-rc1
+    Default: 2026.5.0-rc2
    Description: authentik Docker image tag
  AuthentikServerCPU:
    Type: Number
--- a/lifecycle/container/Dockerfile
+++ b/lifecycle/container/Dockerfile
@@ -1,23 +1,12 @@
 # syntax=docker/dockerfile:1

 # Stage: Build webui
-FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-trixie-slim@sha256:4f2b45e32dc7d2caf66b6dbd59fac50e32f8077769efe0ef4d4c3f114672537d AS node-builder
+FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-trixie-slim@sha256:735dd688da64d22ebd9dd374b3e7e5a874635668fd2a6ec20ca1f99264294086 AS node-builder

 ARG GIT_BUILD_HASH
 ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 ENV NODE_ENV=production

-WORKDIR /work
-
-RUN --mount=type=bind,target=/work/package.json,src=./package.json \
-    --mount=type=bind,target=/work/package-lock.json,src=./package-lock.json \
-    --mount=type=bind,target=/work/web/package.json,src=./web/package.json \
-    --mount=type=bind,target=/work/web/package-lock.json,src=./web/package-lock.json \
-    --mount=type=bind,target=/work/scripts/node/,src=./scripts/node/ \
-    --mount=type=bind,target=/work/packages/logger-js/,src=./packages/logger-js/ \
-    node ./scripts/node/setup-corepack.mjs --force && \
-    node ./scripts/node/lint-runtime.mjs ./web
-
 WORKDIR /work/web

 # These files need to be copied and cannot be mounted as `npm ci` will build the client's typescript
@@ -29,7 +18,7 @@ RUN --mount=type=bind,target=/work/web/package.json,src=./web/package.json \
    --mount=type=bind,target=/work/web/packages/sfe/package.json,src=./web/packages/sfe/package.json \
    --mount=type=bind,target=/work/web/scripts,src=./web/scripts \
    --mount=type=cache,id=npm-ak,sharing=shared,target=/root/.npm \
-    corepack npm ci
+    npm ci

 COPY ./package.json /work
 COPY ./web /work/web/
--- a/lifecycle/container/compose.yml
+++ b/lifecycle/container/compose.yml
@@ -31,7 +31,7 @@ services:
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.0-rc1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.0-rc2}
    ports:
    - ${COMPOSE_PORT_HTTP:-9000}:9000
    - ${COMPOSE_PORT_HTTPS:-9443}:9443
@@ -53,7 +53,7 @@ services:
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.0-rc1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.0-rc2}
    restart: unless-stopped
    shm_size: 512mb
    user: root
--- a/lifecycle/container/proxy.Dockerfile
+++ b/lifecycle/container/proxy.Dockerfile
@@ -10,22 +10,12 @@ WORKDIR /static
 COPY ./packages /packages
 COPY ./web/packages /static/packages

-RUN --mount=type=bind,target=/static/package.json,src=./package.json \
-    --mount=type=bind,target=/static/package-lock.json,src=./package-lock.json \
-    --mount=type=bind,target=/static/web/package.json,src=./web/package.json \
-    --mount=type=bind,target=/static/web/package-lock.json,src=./web/package-lock.json \
-    --mount=type=bind,target=/static/scripts/node/,src=./scripts/node/ \
-    --mount=type=bind,target=/static/packages/logger-js/,src=./packages/logger-js/ \
-    node ./scripts/node/setup-corepack.mjs --force && \
-    node ./scripts/node/lint-runtime.mjs ./web
-
 COPY package.json /
-
 RUN --mount=type=bind,target=/static/package.json,src=./web/package.json \
    --mount=type=bind,target=/static/package-lock.json,src=./web/package-lock.json \
    --mount=type=bind,target=/static/scripts,src=./web/scripts \
    --mount=type=cache,target=/root/.npm \
-    corepack npm ci
+    npm ci

 COPY web .
 RUN npm run build-proxy
--- a/locale/de_DE/LC_MESSAGES/django.mo
+++ b/locale/de_DE/LC_MESSAGES/django.mo
--- a/locale/en/LC_MESSAGES/django.po
+++ b/locale/en/LC_MESSAGES/django.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-14 00:33+0000\n"
+"POT-Creation-Date: 2026-05-06 00:27+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -226,10 +226,6 @@ msgstr ""
 msgid "The slug '{slug}' is reserved and cannot be used for applications."
 msgstr ""

-#: authentik/core/api/groups.py
-msgid "User does not have permission to add members to this group."
-msgstr ""
-
 #: authentik/core/api/providers.py
 msgid ""
 "When not set all providers are returned. When set to true, only backchannel "
@@ -260,14 +256,6 @@ msgstr ""
 msgid "Setting a user to internal service account is not allowed."
 msgstr ""

-#: authentik/core/api/users.py
-msgid "User does not have permission to add members to a superuser group."
-msgstr ""
-
-#: authentik/core/api/users.py
-msgid "User does not have permission to assign roles."
-msgstr ""
-
 #: authentik/core/api/users.py
 msgid "Can't modify internal service account users"
 msgstr ""
@@ -2801,11 +2789,7 @@ msgid "SAML Sessions"
 msgstr ""

 #: authentik/providers/scim/models.py
-msgid "OAuth (Silent)"
-msgstr ""
-
-#: authentik/providers/scim/models.py
-msgid "OAuth (interactive)"
+msgid "OAuth"
 msgstr ""

 #: authentik/providers/scim/models.py
--- a/locale/no_NO/LC_MESSAGES/django.mo
+++ b/locale/no_NO/LC_MESSAGES/django.mo
--- a/locale/pt_BR/LC_MESSAGES/django.mo
+++ b/locale/pt_BR/LC_MESSAGES/django.mo
--- a/locale/pt_PT/LC_MESSAGES/django.mo
+++ b/locale/pt_PT/LC_MESSAGES/django.mo
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,11 +1,11 @@
 {
    "name": "@goauthentik/authentik",
-    "version": "2026.8.0-rc1",
+    "version": "2026.5.0-rc2",
    "private": true,
    "scripts": {
-        "lint": "run-s lint:runtime lint:spellcheck lint:lockfile",
-        "lint:lockfile": "node ./scripts/node/lint-lockfile.mjs",
-        "lint:runtime": "node ./scripts/node/lint-runtime.mjs",
+        "lint": "run-s lint:spellcheck lint:lockfile",
+        "lint:lockfile": "echo 'Skipping lockfile linting'",
+        "lint:node": "echo 'Skipping node linting'",
        "lint:spellcheck": "cspell . --config cspell.config.jsonc"
    },
    "type": "module",
@@ -14,7 +14,6 @@
    },
    "dependencies": {
        "@eslint/js": "^9.39.3",
-        "@goauthentik/docusaurus-config": "./packages/docusaurus-config",
        "@goauthentik/eslint-config": "./packages/eslint-config",
        "@goauthentik/logger-js": "./packages/logger-js",
        "@goauthentik/prettier-config": "./packages/prettier-config",
@@ -24,15 +23,15 @@
        "npm-run-all": "^4.1.5",
        "pino": "^10.3.1",
        "pino-pretty": "^13.1.2",
-        "prettier": "^3.8.3",
+        "prettier": "^3.8.1",
        "prettier-plugin-packagejson": "^3.0.0",
-        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.59.3"
+        "typescript": "^6.0.2",
+        "typescript-eslint": "^8.57.2"
    },
    "workspaces": [],
    "engines": {
        "node": ">=24",
-        "npm": ">=11.14.1"
+        "npm": ">=11.10.1"
    },
    "devEngines": {
        "runtime": {
@@ -42,11 +41,11 @@
        },
        "packageManager": {
            "name": "npm",
-            "version": ">=11.14.1",
+            "version": ">=11.10.1",
            "onFail": "warn"
        }
    },
-    "packageManager": "npm@11.14.1+sha512.6a8a4d67478497a2dbc6815cad72e64c43f33413717e242756047d466241ab39bee61e691683a64658e94496ec5f1a1c05e4a5ec62dcc773280dfd949443a367",
+    "packageManager": "npm@11.11.0+sha512.f36811c4aae1fde639527368ae44c571d050006a608d67a191f195a801a52637a312d259186254aa3a3799b05335b7390539cf28656d18f0591a1125ba35f973",
    "prettier": "@goauthentik/prettier-config",
    "overrides": {
        "@typescript-eslint/eslint-plugin": {
--- a/packages/client-go/api_core.go
+++ b/packages/client-go/api_core.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/api_crypto.go
+++ b/packages/client-go/api_crypto.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/api_events.go
+++ b/packages/client-go/api_events.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/api_flows.go
+++ b/packages/client-go/api_flows.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/api_outposts.go
+++ b/packages/client-go/api_outposts.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/api_root.go
+++ b/packages/client-go/api_root.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/client.go
+++ b/packages/client-go/client.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

@@ -41,7 +41,7 @@ var (
 	queryDescape    = strings.NewReplacer("%5B", "[", "%5D", "]")
 )

-// APIClient manages communication with the authentik API v2026.8.0-rc1
+// APIClient manages communication with the authentik API v2026.5.0-rc2
 // In most cases there should be only one, shared, APIClient.
 type APIClient struct {
 	cfg    *Configuration
--- a/packages/client-go/configuration.go
+++ b/packages/client-go/configuration.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_access_denied_challenge.go
+++ b/packages/client-go/model_access_denied_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_apple_challenge_response_request.go
+++ b/packages/client-go/model_apple_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_apple_login_challenge.go
+++ b/packages/client-go/model_apple_login_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_duo_challenge.go
+++ b/packages/client-go/model_authenticator_duo_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_duo_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_duo_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_email_challenge.go
+++ b/packages/client-go/model_authenticator_email_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_email_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_email_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_sms_challenge.go
+++ b/packages/client-go/model_authenticator_sms_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_sms_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_sms_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_static_challenge.go
+++ b/packages/client-go/model_authenticator_static_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_static_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_static_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_totp_challenge.go
+++ b/packages/client-go/model_authenticator_totp_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_totp_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_totp_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_validation_challenge.go
+++ b/packages/client-go/model_authenticator_validation_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_validation_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_validation_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_web_authn_challenge.go
+++ b/packages/client-go/model_authenticator_web_authn_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_authenticator_web_authn_challenge_response_request.go
+++ b/packages/client-go/model_authenticator_web_authn_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_auto_submit_challenge_response_request.go
+++ b/packages/client-go/model_auto_submit_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_autosubmit_challenge.go
+++ b/packages/client-go/model_autosubmit_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_brand.go
+++ b/packages/client-go/model_brand.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_capabilities_enum.go
+++ b/packages/client-go/model_capabilities_enum.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_captcha_challenge.go
+++ b/packages/client-go/model_captcha_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_captcha_challenge_response_request.go
+++ b/packages/client-go/model_captcha_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_certificate_data.go
+++ b/packages/client-go/model_certificate_data.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_certificate_key_pair.go
+++ b/packages/client-go/model_certificate_key_pair.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_certificate_key_pair_key_type_enum.go
+++ b/packages/client-go/model_certificate_key_pair_key_type_enum.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_challenge_types.go
+++ b/packages/client-go/model_challenge_types.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_config.go
+++ b/packages/client-go/model_config.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_consent_challenge.go
+++ b/packages/client-go/model_consent_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_consent_challenge_response_request.go
+++ b/packages/client-go/model_consent_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_consent_permission.go
+++ b/packages/client-go/model_consent_permission.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_contextual_flow_info.go
+++ b/packages/client-go/model_contextual_flow_info.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_contextual_flow_info_layout_enum.go
+++ b/packages/client-go/model_contextual_flow_info_layout_enum.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_device_challenge.go
+++ b/packages/client-go/model_device_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_device_challenge_request.go
+++ b/packages/client-go/model_device_challenge_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_device_classes_enum.go
+++ b/packages/client-go/model_device_classes_enum.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_dummy_challenge.go
+++ b/packages/client-go/model_dummy_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_dummy_challenge_response_request.go
+++ b/packages/client-go/model_dummy_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_email_challenge.go
+++ b/packages/client-go/model_email_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_email_challenge_response_request.go
+++ b/packages/client-go/model_email_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_endpoint_agent_challenge.go
+++ b/packages/client-go/model_endpoint_agent_challenge.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_endpoint_agent_challenge_response_request.go
+++ b/packages/client-go/model_endpoint_agent_challenge_response_request.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_error_detail.go
+++ b/packages/client-go/model_error_detail.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_error_reporting_config.go
+++ b/packages/client-go/model_error_reporting_config.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_event.go
+++ b/packages/client-go/model_event.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/packages/client-go/model_event_actions.go
+++ b/packages/client-go/model_event_actions.go
@@ -3,7 +3,7 @@ authentik

 Making authentication simple.

-API version: 2026.8.0-rc1
+API version: 2026.5.0-rc2
 Contact: hello@goauthentik.io
 */

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
authentik-automation[bot]	80d9577173	flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) (#22371 ) flows: remove link to overview for non-internal user (#22362) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-15 01:20:59 +02:00
authentik-automation[bot]	a745f0331e	providers/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5) (#22368 ) providers/saml: Add sls to saml overview (#22183) * providers/saml: clean up provider overview page * clean up logout option rendering Co-authored-by: Connor Peshek <connor@connorpeshek.me>	2026-05-14 11:54:21 -05:00
authentik-automation[bot]	5f754d1fda	website/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5) (#22347 ) website/docs, integrations: SAML docs endpoint updates (#22197) * docs/integrations: Update docs for new unified saml endpoint * Update zabbix cert generation wording --------- Signed-off-by: Connor Peshek <connor@connorpeshek.me> Co-authored-by: Connor Peshek <connor@connorpeshek.me> Co-authored-by: Dominic R <dominic@goauthentik.io>	2026-05-14 16:21:41 +00:00
authentik-automation[bot]	ddcde9596d	website/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5) (#22316 ) website/docs: Add invitation wizard docs (#22069) * Add invitation wizard docs * Apply suggestions from code review * Apply suggestion from @dominic-r * Add title to info box * Apply suggestion from @dominic-r * Apply suggestions from code review --------- Signed-off-by: Marcelo Elizeche Landó <marce@melizeche.com> Signed-off-by: Dominic R <dominic@goauthentik.io> Co-authored-by: Marcelo Elizeche Landó <marcelo@goauthentik.io> Co-authored-by: Dewi Roberts <dewi@goauthentik.io> Co-authored-by: Dominic R <dominic@sdko.org>	2026-05-14 17:53:30 +02:00
authentik-automation[bot]	6211162a12	web: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5) (#22364 ) web: Fix issue where default user path is not preferred. (#22139) Co-authored-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>	2026-05-14 16:34:45 +02:00
authentik-automation[bot]	f95eec1d05	website/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5) (#22309 ) website/docs: 2026.5 release notes: fix performance improvements wording (#22307) Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>	2026-05-14 15:05:20 +02:00
authentik-automation[bot]	9f847da62b	website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) (#22348 ) website/integrations: remove sp binding field (#22200) docs/integrations: remove sp binding field Co-authored-by: Connor Peshek <connor@connorpeshek.me>	2026-05-14 00:21:20 -05:00
authentik-automation[bot]	833918ba74	website/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5) (#22346 ) website/integrations: Update all guides to match auto generated issuer (#22180) * docs/integrations: Update all guides to match auto generated issuer * clean up audience mismatches * clean up more * update saml providers page * fix url breaking build * clean up pipeline errors * Apply suggestion from @dominic-r --------- Signed-off-by: Dominic R <dominic@goauthentik.io> Signed-off-by: Connor Peshek <connor@connorpeshek.me> Co-authored-by: Connor Peshek <connor@connorpeshek.me> Co-authored-by: Dominic R <dominic@goauthentik.io>	2026-05-14 03:09:55 +00:00
authentik-automation[bot]	bd59bf4678	website/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5) (#22189 ) * Cherry-pick #22141 to version-2026.5 (with conflicts) This cherry-pick has conflicts that need manual resolution. Original PR: #22141 Original commit: `2c452306cf` * website/docs: resolve SonarQube cherry-pick conflict --------- Co-authored-by: Dominic R <dominic@goauthentik.io>	2026-05-14 02:37:47 +00:00
authentik-automation[bot]	5ee261ee23	enterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5) (#22337 ) enterprise/providers/scim: add support for interactive OAuth2 (#22072) * enterprise/providers/scim: add support for interactive OAuth2 * prep different oauth mode * implement it * add data to API * update ui * fixes * cleanup * start adding tests * add more tests * remove not-needed migration * fixup * fix last_updated not being updated --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-13 22:36:03 +02:00
authentik-automation[bot]	e9b3951c66	website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) (#22334 ) website/docs: fix email link in CVE-2026-40166 (#22331) Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>	2026-05-13 16:59:52 +02:00
authentik-automation[bot]	d627de304a	website/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5) (#22324 ) website/docs: release notes 2026.5: add section about package reduction (#22308) * Add section about package reduction * Suggestion from marc --------- Signed-off-by: Dewi Roberts <dewi@goauthentik.io> Co-authored-by: Dewi Roberts <dewi@goauthentik.io>	2026-05-13 14:38:27 +02:00
authentik-automation[bot]	5b7f58deec	endpoints: remove `print` line (cherry-pick #22325 to version-2026.5) (#22327 ) endpoints: remove `print` line (#22325) Co-authored-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>	2026-05-13 13:50:46 +02:00
authentik-automation[bot]	66c4874590	release: 2026.5.0-rc2	2026-05-13 08:40:16 +00:00
authentik-automation[bot]	a83db7a533	stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (cherry-pick #22322 to version-2026.5) (#22323 ) stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#22322) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-13 10:00:08 +02:00
authentik-automation[bot]	24b6e86eb2	website/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.5) (#22313 ) website/docs: release notes for 2025.12.5 and 2026.2.3 (#22310) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-12 21:11:49 +02:00
authentik-automation[bot]	06f4b47271	internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.5 (#22291 ) * Automated internal backport of patch CVE-2026-40166.sec.patch to authentik-2026.5 * gen Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>	2026-05-12 20:23:36 +02:00
authentik-automation[bot]	fb2634aafb	internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.5 (#22293 ) * Automated internal backport of patch CVE-2026-41569.sec.patch to authentik-2026.5 * fix spell Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>	2026-05-12 20:23:24 +02:00
authentik-automation[bot]	80c8c9004c	internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.5 (#22295 ) * Automated internal backport of patch CVE-2026-42849.sec.patch to authentik-2026.5 * fix spellcheck Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>	2026-05-12 20:23:10 +02:00
authentik-automation[bot]	f5cad68c5b	internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.5 (#22297 ) * Automated internal backport of patch GHSA-973w-j457-rp2m.sec.patch to authentik-2026.5 * gen Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>	2026-05-12 20:22:57 +02:00
authentik-automation[bot]	c8a6665a8f	internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.5 (#22296 ) Automated internal backport of patch GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.5 Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-12 19:37:21 +02:00
authentik-automation[bot]	dfa639365f	internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.5 (#22290 ) Automated internal backport of patch CVE-2026-40165.sec.patch to authentik-2026.5 Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-12 19:34:44 +02:00
authentik-automation[bot]	5674bac6f0	internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.5 (#22292 ) Automated internal backport of patch CVE-2026-40172.sec.patch to authentik-2026.5 Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-12 19:34:37 +02:00
authentik-automation[bot]	1852e97b0e	internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.5 (#22294 ) Automated internal backport of patch CVE-2026-41577.sec.patch to authentik-2026.5 Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-12 19:34:31 +02:00
authentik-automation[bot]	b896eea0c3	enterprise: fix account lockdown target handling (cherry-pick #22246 to version-2026.5) (#22252 ) enterprise: fix account lockdown target handling (#22246) - Use the pending lockdown target in the example blueprint warning and avoid repeating the username when email/name is not distinct. - Hide the admin Account Lockdown action for internal service accounts. Co-authored-by: Dominic R <dominic@goauthentik.io>	2026-05-12 16:03:05 +02:00
authentik-automation[bot]	4023d38b06	core: bump tokio from 1.52.2 to 1.52.3 (cherry-pick #22262 to version-2026.5) (#22268 ) core: bump tokio from 1.52.2 to 1.52.3 (#22262) Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.52.2 to 1.52.3. - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.52.2...tokio-1.52.3) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.52.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 15:17:49 +02:00
authentik-automation[bot]	1cd80616b7	core: bump tokio from 1.52.1 to 1.52.2 (cherry-pick #22160 to version-2026.5) (#22267 ) core: bump tokio from 1.52.1 to 1.52.2 (#22160) Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.52.1 to 1.52.2. - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.52.1...tokio-1.52.2) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.52.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 15:16:15 +02:00
authentik-automation[bot]	eda847061b	root: refreshed icon (cherry-pick #22265 to version-2026.5) (#22266 ) root: refreshed icon (#22265) * root: refresh icon * update pride * update * Optimised images with calibre/image-actions * Optimised images with calibre/image-actions --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io> Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>	2026-05-12 15:15:11 +02:00
authentik-automation[bot]	6d871022e7	web/admin: fix user wizard close button (cherry-pick #22222 to version-2026.5) (#22243 ) web/admin: fix user wizard close button (#22222) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-12 02:43:31 +02:00
authentik-automation[bot]	c8e2d8b3c9	web/admin: User wizard label adjust and deactivate navigation when wizard is finished (cherry-pick #22133 to version-2026.5) (#22191 ) web/admin: User wizard label adjust and deactivate navigation when wizard is finished (#22133) * elements/wizard: deactivate side nav buttons if wizard is done * adjust labels for service account * Fix wizards to use consistent height. * remove justify --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io> Co-authored-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>	2026-05-12 01:50:25 +02:00
authentik-automation[bot]	1775ef4476	core: bump python-kadmin-rs from 0.7.1 to 0.7.2 (cherry-pick #22234 to version-2026.5) (#22238 ) core: bump python-kadmin-rs from 0.7.1 to 0.7.2 (#22234) Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>	2026-05-11 17:49:23 +00:00
authentik-automation[bot]	a638558133	release: 2026.5.0-rc1	2026-05-11 15:23:50 +00:00
Marc 'risson' Schmitt	c60537bc28	ci: fix make gen in release workflows (cherry-pick #22235 to version-2026.5) (#22236 ) ci: fix make gen in release workflows Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>	2026-05-11 16:26:12 +02:00
Marc 'risson' Schmitt	8c89f65ad7	ci: run make gen when tagging a new release (cherry-pick #22229 to version-2026.5) (#22231 ) ci: run make gen when tagging a new release Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>	2026-05-11 14:53:40 +02:00
authentik-automation[bot]	cb07c148f6	core: bump python-kadmin-rs from 0.7.0 to 0.7.1 (cherry-pick #22205 to version-2026.5) (#22227 ) core: bump python-kadmin-rs from 0.7.0 to 0.7.1 (#22205) Bumps [python-kadmin-rs](https://github.com/authentik-community/kadmin-rs) from 0.7.0 to 0.7.1. - [Release notes](https://github.com/authentik-community/kadmin-rs/releases) - [Commits](https://github.com/authentik-community/kadmin-rs/compare/kadmin/version/0.7.0...kadmin/version/0.7.1) --- updated-dependencies: - dependency-name: python-kadmin-rs dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-11 14:47:01 +02:00
authentik-automation[bot]	b22ce29f8f	lifecycle/ak: Add manage support (cherry-pick #22176 to version-2026.5) (#22221 ) lifecycle/ak: Add manage support (#22176) Co-authored-by: Connor Peshek <connor@connorpeshek.me>	2026-05-11 13:10:18 +02:00
authentik-automation[bot]	fd6bf9fd05	providers/saml: make unified saml endpoint (cherry-pick #20026 to version-2026.5) (#22187 ) providers/saml: make unified saml endpoint (#20026) * providers/saml: make unified saml endpoint Co-authored-by: Connor Peshek <connor@connorpeshek.me>	2026-05-09 10:48:50 -05:00
authentik-automation[bot]	5e0448b541	providers/saml: make issuer url metadata url (cherry-pick #22178 to version-2026.5) (#22184 ) providers/saml: make issuer url metadata url (#22178) Co-authored-by: Connor Peshek <connor@connorpeshek.me>	2026-05-09 15:36:26 +02:00
authentik-automation[bot]	52c37992bd	tenants: fix system flags removeable (cherry-pick #22163 to version-2026.5) (#22182 ) tenants: fix system flags removeable (#22163) * tenants: fix system flags removeable * lint and fix test --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-09 15:14:01 +02:00
authentik-automation[bot]	45b78f78b8	web/admin: legacy modal fixes and fix log viewer in form layout (cherry-pick #22168 to version-2026.5) (#22173 ) web/admin: legacy modal fixes and fix log viewer in form layout (#22168) * web/admin: fix log-viewer layout again I thought I only recently fixed this...? * switch closeAfterSuccessfulSubmit -> keepOpenAfterSubmit with correct attribute name and false as default --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>	2026-05-09 00:24:15 +02:00
authentik-automation[bot]	7900399a97	blueprints: fix mismatched API schema and implementation (cherry-pick #22087 to version-2026.5) (#22171 ) blueprints: fix mismatched API schema and implementation (#22087) align blueprint import schema with 200 result response Co-authored-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>	2026-05-08 20:58:06 +02:00