Update ghcr.io/goauthentik/server Docker tag to v2025.12.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
ghcr.io/goauthentik/server (source)	minor	2025.6.4 → 2025.12.4

---

Release Notes

goauthentik/authentik (ghcr.io/goauthentik/server)

v2025.12.4: Release 2025.12.4

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025124

What's Changed

• website/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #​19949 to version-2025.12) by @​authentik-automation[bot] in #​19950
• web/admin: fix default binding order (cherry-pick #​19943 to version-2025.12) by @​authentik-automation[bot] in #​19945
• providers/oauth2: use compare_digest for client_secret comparison (cherry-pick #​19979 to version-2025.12) by @​authentik-automation[bot] in #​19987
• recovery: consume token in transaction (cherry-pick #​19967 to version-2025.12) by @​authentik-automation[bot] in #​19986
• core: bump django from 5.2.10 to 5.2.11 (cherry-pick #​19988 to version-2025.12) by @​authentik-automation[bot] in #​19992
• outposts: fix docker_tls created files permission (cherry-pick #​19978 to version-2025.12) by @​authentik-automation[bot] in #​19993
• website/docs: fix typos (cherry-pick #​20000 to version-2025.12) by @​authentik-automation[bot] in #​20010
• website/docs: endpoint devices: more updates (cherry-pick #​19971 to version-2025.12) by @​authentik-automation[bot] in #​20014
• website/docs: endpoint devices: specify name and slug (cherry-pick #​20016 to version-2025.12) by @​authentik-automation[bot] in #​20025
• website/docs: endpoint devices: fix non debian wording (cherry-pick #​20046 to version-2025.12) by @​authentik-automation[bot] in #​20048
• docs: add instructions for configuring rp-initiated single logout (cherry-pick #​20040 to version-2025.12) by @​authentik-automation[bot] in #​20055
• website: QL Search keyboard interactions docs, examples. (cherry-pick #​16259 to version-2025.12) by @​authentik-automation[bot] in #​20056
• website/docs: automated install: mention no file:// vars (cherry-pick #​20043 to version-2025.12) by @​authentik-automation[bot] in #​20062
• outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #​18063 to version-2025.12) by @​authentik-automation[bot] in #​20059
• website/docs: capturing outpost logs (cherry-pick #​20045 to version-2025.12) by @​authentik-automation[bot] in #​20053
• website/docs: endpoint devices: update device authentication location (cherry-pick #​20049 to version-2025.12) by @​authentik-automation[bot] in #​20051
• website/docs: generate CVE sidebar (cherry-pick #​20098 to version-2025.12) by @​authentik-automation[bot] in #​20101
• sources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #​20096 to version-2025.12) by @​authentik-automation[bot] in #​20122
• website/docs: add email verification scope doc (cherry-pick #​20141 to version-2025.12) by @​authentik-automation[bot] in #​20205
• website/docs: rac: fixes the property mapping formatting (cherry-pick #​20200 to version-2025.12) by @​authentik-automation[bot] in #​20202
• website/docs: ssf: update SSF documentation (cherry-pick #​20195 to version-2025.12) by @​authentik-automation[bot] in #​20210
• security: CVE-2026-25922 (2025.12) by @​authentik-automation[bot] in #​20232
• security: CVE-2026-25748 (2025.12) by @​authentik-automation[bot] in #​20231
• security: CVE-2026-25227 (2025.12) by @​authentik-automation[bot] in #​20230
• web: updated package-lock.json to include missing tree-sitter references (cherry-pick #​20244 to version-2025.12) by @​rissson in #​20245

Full Changelog: goauthentik/authentik@version/2025.12.3...version/2025.12.4

v2025.12.3: Release 2025.12.3

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025123

What's Changed

• 2025.12: Revert bulk revoke added by accident in release branch by @​dominic-r in #​19870
• web/admin: fix toggle-group for bindings now showing up (cherry-pick #​19820 to version-2025.12) by @​authentik-automation[bot] in #​19895
• website/docs: Remove stale 2024 version directives (cherry-pick #​19888 to version-2025.12) by @​authentik-automation[bot] in #​19899
• web: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #​19892 to version-2025.12) by @​authentik-automation[bot] in #​19900
• ci: always generate API clients (#​19906) by @​BeryJu in #​19932
• lifecycle/ak: make sure /data has the correct permissions (cherry-pick #​19935 to version-2025.12) by @​authentik-automation[bot] in #​19940
• lifecycle/aws: add /data volume (cherry-pick #​19936 to version-2025.12) by @​authentik-automation[bot] in #​19938
• website/docs: Update location of media storage and outdated references (cherry-pick #​19885 to version-2025.12) by @​authentik-automation[bot] in #​19937
• core: fix non-expiring service accounts and app passwords (cherry-pick #​19913 to version-2025.12) by @​authentik-automation[bot] in #​19941

Full Changelog: goauthentik/authentik@version/2025.12.2...version/2025.12.3

v2025.12.2: Release 2025.12.2

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025122

What's Changed

• website/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #​19502 to version-2025.12) by @​authentik-automation[bot] in #​19503
• sources/kerberos: update to new python-kadmin-rs (cherry-pick #​19491 to version-2025.12) by @​authentik-automation[bot] in #​19523
• tests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #​18840 to version-2025.12) by @​authentik-automation[bot] in #​19532
• website/docs: endpoint devices: update device code flow instructions (cherry-pick #​19528 to version-2025.12) by @​authentik-automation[bot] in #​19534
• admin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #​19547 to version-2025.12) by @​authentik-automation[bot] in #​19553
• admin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #​19537 to version-2025.12) by @​authentik-automation[bot] in #​19575
• core: Update supported versions in SECURITY.md (cherry-pick #​19385 to version-2025.12) by @​authentik-automation[bot] in #​19578
• website/docs: add s3 perms (cherry-pick #​19579 to version-2025.12) by @​authentik-automation[bot] in #​19581
• web: update @​goauthentik/api (cherry-pick #​19542 to version-2025.12) by @​authentik-automation[bot] in #​19589
• web/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #​19561 to version-2025.12) by @​authentik-automation[bot] in #​19582
• endpoints: fix endpoints stage marked as enterprise (cherry-pick #​19607 to version-2025.12) by @​authentik-automation[bot] in #​19610
• policies: fix Providers authentication_flow not used when set (cherry-pick #​19609 to version-2025.12) by @​authentik-automation[bot] in #​19615
• providers/saml: fix structure of encrypted saml assertion (cherry-pick #​19592 to version-2025.12) by @​authentik-automation[bot] in #​19613
• providers/saml: allow encryption certificates without private keys (cherry-pick #​19526 to version-2025.12) by @​authentik-automation[bot] in #​19612
• sources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #​19593 to version-2025.12) by @​authentik-automation[bot] in #​19614
• tests: improve e2e/integration test reliability (cherry-pick #​19540 to version-2025.12) by @​authentik-automation[bot] in #​19611
• lib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #​18968 to version-2025.12) by @​authentik-automation[bot] in #​19617
• website/docs: endpoints devices: typo fix (cherry-pick #​19621 to version-2025.12) by @​authentik-automation[bot] in #​19622
• web/user: fix Firefox for Android infinite render loop in user library (cherry-pick #​19379 to version-2025.12) by @​authentik-automation[bot] in #​19626
• web/maintenance: fix missing custom web component imports (cherry-pick #​18942 to version-2025.12) by @​authentik-automation[bot] in #​19636
• website/docs: Update saml google workspace guide (cherry-pick #​19624 to version-2025.12) by @​authentik-automation[bot] in #​19642
• website/docs: update endpoint agent windows log location (cherry-pick #​19645 to version-2025.12) by @​authentik-automation[bot] in #​19646
• web/a11y: Locale selector select styles, contrast. (cherry-pick #​19634 to version-2025.12) by @​authentik-automation[bot] in #​19651
• website/docs: update LDAP search permission instructions (cherry-pick #​19676 to version-2025.12) by @​authentik-automation[bot] in #​19678
• web/maintenance: no unknown tag names (cherry-pick #​18944 to version-2025.12) by @​authentik-automation[bot] in #​19637
• providers/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #​19554 to version-2025.12) by @​authentik-automation[bot] in #​19675
• web/maintenance: no missing element type definitions (cherry-pick #​18950 to version-2025.12) by @​authentik-automation[bot] in #​19638
• web/maintenance/no unknown attributes (part 1) (cherry-pick #​18970 to version-2025.12) by @​authentik-automation[bot] in #​19639
• sources/saml: Set AuthnRequest ProtocolBinding to HTTP-POST instead of HTTP-Redirect (cherry-pick #​17378 to version-2025.12) by @​authentik-automation[bot] in #​19649
• web/forms: fix forms not resetting state when modal closes (cherry-pick #​19562 to version-2025.12) by @​authentik-automation[bot] in #​19635
• web/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #​19658 to version-2025.12) by @​authentik-automation[bot] in #​19682
• internal: fix incorrect metric calculation (cherry-pick #​19701 to version-2025.12) by @​authentik-automation[bot] in #​19703
• sources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #​19311 to version-2025.12) by @​authentik-automation[bot] in #​19704
• core: return bad request when user is authenticated and not active (cherry-pick #​19706 to version-2025.12) by @​authentik-automation[bot] in #​19710
• web/admin: fix impersonation form requesting data without being opened (cherry-pick #​19673 to version-2025.12) by @​authentik-automation[bot] in #​19712
• web/sfe: downgrade bootstrap, add access denied test (cherry-pick #​19763 to version-2025.12) by @​authentik-automation[bot] in #​19765
• root: update client-go generation (cherry-pick #​19762 to version-2025.12) by @​authentik-automation[bot] in #​19791
• web/elements: reduce spacing between collapsible form groups (cherry-pick #​19627 to version-2025.12) by @​authentik-automation[bot] in #​19640
• web/elements: stabilize dual-select status height (cherry-pick #​19734 to version-2025.12) by @​authentik-automation[bot] in #​19776
• website/docs: fix Transifex link in translation guide (cherry-pick #​19735 to version-2025.12) by @​authentik-automation[bot] in #​19771
• website/docs: endpoint devices: fix local device login (cherry-pick #​19698 to version-2025.12) by @​authentik-automation[bot] in #​19790
• website/docs: Fix authenticator sms docs (cherry-pick #​19797 to version-2025.12) by @​authentik-automation[bot] in #​19816
• providers/scim: fix email validation mismatch (cherry-pick #​19848 to version-2025.12) by @​authentik-automation[bot] in #​19853
• sources/saml: properly catch InvalidSignature exception (cherry-pick #​19641 to version-2025.12) by @​authentik-automation[bot] in #​19650
• sources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #​18973 to version-2025.12) by @​authentik-automation[bot] in #​19854
• website/docs: add more info to entra id scim doc (cherry-pick #​19849 to version-2025.12) by @​authentik-automation[bot] in #​19855
• website/docs: add tip for recovering from accidental main branch work (cherry-pick #​19865 to version-2025.12) by @​authentik-automation[bot] in #​19866
• admin/files: add centralized theme variable support for file URLs (cherry-pick #​19657 to version-2025.12) by @​authentik-automation[bot] in #​19793
• web/table: align row action icons and tooltip color (cherry-pick #​19736 to version-2025.12) by @​authentik-automation[bot] in #​19773
• web/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #​19548 to version-2025.12) by @​authentik-automation[bot] in #​19685
• web/admin: fix captcha stage provider selector not showing saved value (cherry-pick #​19555 to version-2025.12) by @​authentik-automation[bot] in #​19656
• web: Session UI Config Lifecycle (cherry-pick #​19788 to version-2025.12) by @​authentik-automation[bot] in #​19821
• website/docs: endpoint devices: add version command (cherry-pick #​19767 to version-2025.12) by @​authentik-automation[bot] in #​19877
• web: Enforce challenge nullish types. (cherry-pick #​19768 to version-2025.12) by @​authentik-automation[bot] in #​19777

Full Changelog: goauthentik/authentik@version/2025.12.1...version/2025.12.2

v2025.12.1: Release 2025.12.1

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025121

What's Changed

• website/docs: remove "beta" tag from 2025.12 (cherry-pick #​19404 to version-2025.12) by @​authentik-automation[bot] in #​19407
• outposts/ldap: fix build by @​BeryJu in #​19403
• website/docs: add import to discord policy (cherry-pick #​19397 to version-2025.12) by @​authentik-automation[bot] in #​19406
• website/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #​19368 to version-2025.12) by @​authentik-automation[bot] in #​19402
• website/docs: update gws provider docs (cherry-pick #​18286 to version-2025.12) by @​authentik-automation[bot] in #​19400
• web/startup: deprecated theme names break theming (cherry-pick #​19431 to version-2025.12) by @​authentik-automation[bot] in #​19433
• ci: fix checkout stable (for 2025.12) (#​19448) by @​BeryJu in #​19481
• providers/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #​19226 to version-2025.12) by @​authentik-automation[bot] in #​19480
• core: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #​19257 to version-2025.12) by @​authentik-automation[bot] in #​19484
• endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #​19482 to version-2025.12) by @​authentik-automation[bot] in #​19486
• website/docs: limiting permissions of AD service account (cherry-pick #​19483 to version-2025.12) by @​authentik-automation[bot] in #​19489
• endpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #​19487 to version-2025.12) by @​authentik-automation[bot] in #​19490
• web: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #​19460 to version-2025.12) by @​authentik-automation[bot] in #​19492
• web/admin: fix switches (cherry-pick #​19493 to version-2025.12) by @​authentik-automation[bot] in #​19496

Full Changelog: goauthentik/authentik@version/2025.12.0...version/2025.12.1

v2025.12.0: Release 2025.12.0

See https://docs.goauthentik.io/docs/releases/2025.12

What's Changed

• endpoints: include license status in agent config (cherry-pick #​19227 to version-2025.12) by @​authentik-automation[bot] in #​19228
• website/docs: revisit endpoint docs the nth (cherry-pick #​19116 to version-2025.12) by @​authentik-automation[bot] in #​19223
• website/glossary: improve (cherry-pick #​18969 to version-2025.12) by @​authentik-automation[bot] in #​19238
• core: fix read replica routing during transactions (cherry-pick #​19086 to version-2025.12) by @​authentik-automation[bot] in #​19241
• stages/authenticator_static: set max token length to 100 chars (cherry-pick #​19162 to version-2025.12) by @​authentik-automation[bot] in #​19231
• website: Fix typos. (cherry-pick #​19243 to version-2025.12) by @​authentik-automation[bot] in #​19248
• stages/prompt: optimize API endpoints (cherry-pick #​19251 to version-2025.12) by @​authentik-automation[bot] in #​19254
• stages/password: replace session-based retries with reputation (cherry-pick #​18643 to version-2025.12) by @​authentik-automation[bot] in #​19289
• web/admin: add banner to flow import form (cherry-pick #​19288 to version-2025.12) by @​authentik-automation[bot] in #​19293
• core: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #​19287 to version-2025.12) by @​authentik-automation[bot] in #​19296
• core: bump django from v5.2.9 to 5.2.10 (cherry-pick #​19290 to version-2025.12) by @​authentik-automation[bot] in #​19294
• website/docs: update entra id provider docs (cherry-pick #​18366 to version-2025.12) by @​authentik-automation[bot] in #​19256
• website/docs: deprecate GCDT auth stage (cherry-pick #​19306 to version-2025.12) by @​authentik-automation[bot] in #​19319
• website/docs: update m2m doc (cherry-pick #​18963 to version-2025.12) by @​authentik-automation[bot] in #​19324
• website/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #​19316 to version-2025.12) by @​authentik-automation[bot] in #​19326
• website/docs: add flow import warnings (cherry-pick #​19307 to version-2025.12) by @​authentik-automation[bot] in #​19327
• website/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #​18936 to version-2025.12) by @​authentik-automation[bot] in #​19322
• web: Fix flow inspector advancement event. (cherry-pick #​19309 to version-2025.12) by @​authentik-automation[bot] in #​19310
• website/docs: update github social login script example (cherry-pick #​19246 to version-2025.12) by @​authentik-automation[bot] in #​19250
• website/docs: update unique email policy (cherry-pick #​19305 to version-2025.12) by @​authentik-automation[bot] in #​19339
• web: Images styles, theming (cherry-pick #​19233 to version-2025.12) by @​authentik-automation[bot] in #​19342
• website/docs: update LDAP provider docs (cherry-pick #​18272 to version-2025.12) by @​authentik-automation[bot] in #​19345
• packages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #​19340 to version-2025.12) by @​authentik-automation[bot] in #​19356
• web/admin: always retrieve selected provider when editing the application (cherry-pick #​19341 to version-2025.12) by @​authentik-automation[bot] in #​19370
• web/elements: hidden secrets not propagating (cherry-pick #​19029 to version-2025.12) by @​authentik-automation[bot] in #​19377
• outpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #​19026 to version-2025.12) by @​authentik-automation[bot] in #​19375
• website/docs: update location for logs on windows (cherry-pick #​19371 to version-2025.12) by @​authentik-automation[bot] in #​19373
• internal/outpost: improve PostgreSQL connection options parsing (cherry-pick #​19118 to version-2025.12) by @​authentik-automation[bot] in #​19372
• web: Flow info, localization, back button. (cherry-pick #​19234 to version-2025.12) by @​authentik-automation[bot] in #​19346
• stages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #​19378 to version-2025.12) by @​authentik-automation[bot] in #​19381
• internal: rework liveness probe and proxy (cherry-pick #​19312 to version-2025.12) by @​authentik-automation[bot] in #​19382
• web: UI Locale Fixes (cherry-pick #​19235 to version-2025.12) by @​authentik-automation[bot] in #​19384

Full Changelog: goauthentik/authentik@version/2025.12.0-rc3...version/2025.12.0

v2025.10.4: Release 2025.10.4

See See https://docs.goauthentik.io/docs/releases/2025.10#fixed-in-2025104

What's Changed

• web/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #​18727 to version-2025.10) by @​authentik-automation[bot] in #​18932
• website/docs: add note to active directory source doc (cherry-pick #​18787 to version-2025.10) by @​authentik-automation[bot] in #​18965
• website/docs: Backport version picker updates. (cherry-pick #​18964 to version-2025.10) by @​authentik-automation[bot] in #​18974
• web/admin: fix dark theme on map (cherry-pick #​18985 to version-2025.10) by @​authentik-automation[bot] in #​18986
• web/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #​18984 to version-2025.10) by @​authentik-automation[bot] in #​18988
• core: use chunked_queryset for expired message deletion (cherry-pick #​19028 to version-2025.10) by @​authentik-automation[bot] in #​19030
• internal: update TLS Suite (cherry-pick #​19076 to version-2025.10) by @​authentik-automation[bot] in #​19077
• website/docs: fix build (cherry-pick #​19148 to version-2025.10) by @​authentik-automation[bot] in #​19150
• web: fix slug auto-updating when editing existing applications (cherry-pick #​19169 to version-2025.10) by @​authentik-automation[bot] in #​19172
• core: fix read replica routing during transactions (cherry-pick #​19086 to version-2025.10) by @​authentik-automation[bot] in #​19240
• web/admin: add banner to flow import form (cherry-pick #​19288 to version-2025.10) by @​authentik-automation[bot] in #​19292
• website/docs: update entra id provider docs (cherry-pick #​18366 to version-2025.10) by @​authentik-automation[bot] in #​19255
• website/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #​18936 to version-2025.10) by @​authentik-automation[bot] in #​19321
• website/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #​19316 to version-2025.10) by @​authentik-automation[bot] in #​19325
• website/docs: update m2m doc (cherry-pick #​18963 to version-2025.10) by @​authentik-automation[bot] in #​19323
• website/docs: update LDAP provider docs (cherry-pick #​18272 to version-2025.10) by @​authentik-automation[bot] in #​19344
• web/elements: hidden secrets not propagating (cherry-pick #​19029 to version-2025.10) by @​authentik-automation[bot] in #​19376
• outpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #​19026 to version-2025.10) by @​authentik-automation[bot] in #​19374
• internal: rework liveness probe and proxy (cherry-pick #​19312 to version-2025.10) by @​authentik-automation[bot] in #​19383
• website/docs: update gws provider docs (cherry-pick #​18286 to version-2025.10) by @​authentik-automation[bot] in #​19399
• website/docs: add import to discord policy (cherry-pick #​19397 to version-2025.10) by @​authentik-automation[bot] in #​19405
• website/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #​19368 to version-2025.10) by @​authentik-automation[bot] in #​19401
• website/docs: limiting permissions of AD service account (cherry-pick #​19483 to version-2025.10) by @​authentik-automation[bot] in #​19488
• providers/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #​19554 to version-2025.10) by @​authentik-automation[bot] in #​19674
• internal: fix incorrect metric calculation (cherry-pick #​19701 to version-2025.10) by @​authentik-automation[bot] in #​19702
• core: return bad request when user is authenticated and not active (cherry-pick #​19706 to version-2025.10) by @​authentik-automation[bot] in #​19709
• web/admin: fix impersonation form requesting data without being opened (cherry-pick #​19673 to version-2025.10) by @​authentik-automation[bot] in #​19711
• web/sfe: downgrade bootstrap, add access denied test (cherry-pick #​19763 to version-2025.10) by @​authentik-automation[bot] in #​19764
• website/docs: fix Transifex link in translation guide (cherry-pick #​19735 to version-2025.10) by @​authentik-automation[bot] in #​19770
• root: update client-go generation (cherry-pick #​19762 and #​19906 to version-2025.10) by @​rissson in #​19933
• recovery: consume token in transaction (cherry-pick [#

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.