authentik: 2025.12.6 -> 2026.5.3

[LisaScheers]

Update authentik to 2026.5.3.

Changelog: https://docs.goauthentik.io/releases/2026.5
GitHub release: https://github.com/goauthentik/authentik/releases/tag/version%2F2026.5.3

Notable packaging changes:

• switch authentik to Python 3.14, matching upstream's requirement
• build the new Rust authentik worker/all-in-one binary and include it in the ak wrapper runtime path
• build the Go server as authentik-server, matching upstream's lifecycle/ak lookup, while keeping an authentik -> authentik-server compatibility symlink in the proxy output
• use a clang stdenv for the Rust worker because aws-lc-fips-sys fails its FIPS delocation step with the default GCC stdenv
• use the generated Go client from the authentik monorepo under packages/client-go
• update the generated Go and TypeScript clients and hashes
• remove the obsolete client-go patch now included upstream
• remove local Python dependency overrides; nixpkgs now has the required djangorestframework, twilio, and dramatiq versions
• add a release note for the upstream breaking listen-address default change

Automation disclosure: this PR was prepared with assistance from OpenAI Codex, with manual review and validation before submission.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.

Notes:

• Previously built .#authentik and .#authentik.outposts.{ldap,proxy,radius} on both x86_64-linux and aarch64-linux.
• Previously ran nixpkgs-review pr 523484 --package authentik --package authentik.outposts.ldap --package authentik.outposts.proxy --package authentik.outposts.radius on x86_64-linux and aarch64-linux; 4 packages built on each platform.
• After the Rust worker and server-wrapper changes, built authentik.worker, authentik.proxy, and authentik with NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 nix-build ... --system x86_64-linux --max-jobs 0.
• Checked the generated ak wrapper includes the worker path before the proxy path, so ak worker resolves the Rust authentik binary while direct users of authentik.proxy/bin/authentik keep working.
• Verified that plain rustPlatform.buildRustPackage with the default GCC stdenv fails in aws-lc-fips-sys; the clang stdenv override builds successfully.
• Ran git diff --check.
• Evaluated pkgs.authentik.version as 2026.5.3.
• Evaluated dependency versions from nixpkgs: djangorestframework 3.17.1, twilio 9.10.9, dramatiq 2.1.0.
• Built authentik.proxy.goModules with NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 nix-build -A authentik.proxy.goModules --no-out-link.
• I did not find an existing authentik NixOS test in nixos/tests.
• ak --help starts the wrapper, but authentik bootstrap requires runtime configuration/PostgreSQL, so I am not marking binary functionality as fully tested.

[dotlambda]

Let's first update to 2025.12.5 in #523691 because that fixes CVE-2026-40165 and is backportable.

[LisaScheers]

noted and ongoing. sorry first time contributing so still figuring out the way to go.

[jvanbruegge]

You can rebase onto the current master, @dotlambda did the update to 2025.12.5

[LisaScheers]

• python3Packages.twilio: fix tests on Python 3.14 #524031
• python3Packages.dramatiq: 2.0.1 -> 2.1.0 #524033
• python3Packages.djangorestframework: 3.16.1 -> 3.17.1 #523937

[dotlambda]

Please update the commit message.

[nixpkgs-review-gha]

❌ nixpkgs-review result

Generated using nixpkgs-review-gha (620301f)

Command: nixpkgs-review pr 523484
Commit: 3abd74a64615306d7f9e31e1a606c92535ff4852 (subsequent changes)
Merge: fcbac864c29080c01381110972109d6b523f4fe5

Triggered by @LisaScheers (34404302)
Logs: https://github.com/LisaScheers/nixpkgs-review-gha/actions/runs/28064743962/attempts/1

---

x86_64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

❌ 1 package failed to build:

• authentik

✅ 3 packages built:

• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

---

aarch64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

❌ 1 package failed to build:

• authentik

✅ 3 packages built:

• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

[nixpkgs-review-gha]

❌ nixpkgs-review result

Generated using nixpkgs-review-gha (620301f)

Command: nixpkgs-review pr 523484
Commit: 4efa9ee325ecd00a99cdc269ab0c0acffd912e3f (subsequent changes)
Merge: 96f4bca813267f93ba7a513589a08439fe2c3cca

Triggered by @LisaScheers (34404302)
Logs: https://github.com/LisaScheers/nixpkgs-review-gha/actions/runs/28094227995/attempts/1

---

x86_64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

❌ 1 package failed to build:

• authentik

✅ 3 packages built:

• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

---

aarch64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

❌ 1 package failed to build:

• authentik

✅ 3 packages built:

• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

[nixpkgs-review-gha]

✅ nixpkgs-review result

Generated using nixpkgs-review-gha (620301f)

Command: nixpkgs-review pr 523484
Commit: db98a87d60e0d56ca54e69f206442cccef5cfa92 (subsequent changes)
Merge: c31e30c686e8eeae654752624271570f11cbe4a4

Triggered by @LisaScheers (34404302)
Logs: https://github.com/LisaScheers/nixpkgs-review-gha/actions/runs/28095689793/attempts/1

---

x86_64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 4 packages built:

• authentik
• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

---

aarch64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 4 packages built:

• authentik
• authentik-outposts.ldap
• authentik-outposts.proxy
• authentik-outposts.radius

[dotlambda]

I didn't look at the update script. Would you mind leaving that for a separate PR?

[LisaScheers]

I didn't look at the update script. Would you mind leaving that for a separate PR?

on it

[jvanbruegge]

I tried updating my personal setup, but encounter an error:

error: build of '/nix/store/spvnnkd8iwywaqalsql9251ni7n4iy2d-authentik-webui-deps-2026.5.3.drv^*' failed: hash mismatch in fixed-output derivation '/nix/store/spvnnkd8iwywaqalsql9251ni7n4iy2d-authentik-webui-deps-2026.5.3.drv':
         specified: sha256-FpfOl6wNCgXLg86+vbjnYkcOnpaOZBCNxJiFDRT5W3s=
            got:    sha256-p6xjAinU2Isl/uYgoJuacqHN7jBnbWam40J6AQudbtQ=

[B4dM4n]

Sadly, this seems currently to be unavoidable, unless we pin the deps folder name to the nodejs version: #492436 (comment)

The update from nodejs-24.15.0 to nodejs-24.16.0 changed the list of installed packages:

old -> /nix/store/phjj6m5sc2j42sfszsydaviqnwjz17z2-authentik-webui-deps-2026.5.3
new -> /nix/store/dqhdhv5gp03sx7fb85i9c333bs4cgy6s-authentik-webui-deps-2026.5.3

# LC_ALL=C.utf-8 diff -ru old/ new/
Only in old/node_modules: @emnapi
diff: old/node_modules/@goauthentik/api: No such file or directory
Only in old/node_modules/@napi-rs: wasm-runtime
Only in old/node_modules: @tybys
diff: old/node_modules/formdata-polyfill: No such file or directory
diff: old/node_modules/lex: No such file or directory
diff: old/node_modules/node-domexception: No such file or directory

(No such file or directory is the result of a broken symlink to the packages folder)