authentik: add updateScript

[LisaScheers]

Add an automatic update script for authentik.

This is split out from NixOS#523484 and stacked on the package-update branch. Once the version update lands, this can be retargeted to NixOS:master if needed.

What changed:

• move authentik source and dependency hashes into source.json
• add passthru.updateDeps for the source, cargo, Go vendor, website npm, and webui dependency outputs
• add passthru.updateScript backed by update.py
• support update.nix commit output for authentik,authentik-outposts

Based on the updateScript work from Fabian Möller in NixOS#534259.

Validation:

• ruff check pkgs/by-name/au/authentik/update.py
• ruff format --check pkgs/by-name/au/authentik/update.py
• nix-instantiate --eval --strict -A authentik.updateScript.supportedFeatures
• ./pkgs/by-name/au/authentik/update.py --authentik 2026.5.3 --generate
• nix-instantiate --eval --strict -A authentik.version

Automation disclosure: this PR was prepared with assistance from OpenAI Codex, with manual review before submission.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 94415ce8-c489-4911-b894-f8159361058e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch authentik-update-script

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}