Authentik's documentation is explicit that upgrades follow the sequence of major
releases and must not skip, so the path is 2026.2.3 to 2026.5.6 to 2026.8.0.
Both releases state they introduce no new requirements, and their one breaking
change each was checked against our state rather than assumed: the deprecated
Postgres connection options are not set, the removed WebAuthn option is not set,
and there are no outposts to keep in step.
Scanning all three images changes the shape of the plan. The intermediate
version carries the entire critical gain — five instead of twenty-seven — and
385 of the 456 high findings. The second step adds high findings only. That is
what makes splitting the two steps defensible rather than timid, and 2026.8.0 is
three days old, which is a poor age for the login path of the whole platform.
The rollback is a database restore, not a downgrade; the documentation says so
outright. The backup is nightly and was actually replayed during #0030, so the
fallback is proven rather than assumed — but sessions since the backup are lost
with it, and that belongs in the plan rather than in the surprise.
Thore Cimbal
80ee448e20