From a252ac0f0960de47934cc1f993ddfbe6b9ff7fe2 Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Fri, 21 Aug 2026 12:00:00 +0000 Subject: [PATCH] authentik: 2026.2.3 -> 2026.5.6, the mandatory intermediate step (#0051) Authentik's documentation forbids skipping major releases and requires the latest minor of each before moving on, so 2026.5.6 comes before 2026.8.0 rather than being an optional stop. It is also where the benefit is. Measured on the images rather than assumed: 2026.2.3 carries 27 critical and 477 high findings, 2026.5.6 carries 5 and 92. This one step removes every critical finding that can be removed here; what remains is perl-base and libxml2, neither of which has a fix. The second step adds high findings only. Both breaking changes of this release were checked against our state and do not apply: the deprecated Postgres connection options are not set anywhere, and there are no outposts whose version would have to match. A manual backup was taken immediately before this, because the nightly one is hours old and the way back is a database restore rather than a version rollback. --- apps/authentik/authentik.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/authentik/authentik.yaml b/apps/authentik/authentik.yaml index 3475f17..5e9476c 100644 --- a/apps/authentik/authentik.yaml +++ b/apps/authentik/authentik.yaml @@ -8,7 +8,15 @@ spec: chart: spec: chart: authentik - version: "2026.2.3" + # 2026.5.6 ist die LETZTE 2026.5 - Authentik verlangt "always upgrade to the + # latest minor version before upgrading to the next major version", und + # Fassungsreihen duerfen nicht uebersprungen werden. Naechster Schritt nach + # gruener Pruefung: 2026.8.0 (management #0051, Gate 2). + # + # Am Zielimage gemessen, nicht geschaetzt: 2026.2.3 traegt 27 CRITICAL und + # 477 HIGH, 2026.5.6 nur noch 5 und 92. Die Zwischenstufe bringt damit den + # gesamten CRITICAL-Gewinn; 2026.8.0 liefert danach nur noch HIGH. + version: "2026.5.6" sourceRef: kind: HelmRepository name: goauthentik