Update authelia/authelia Docker tag to v4.39.15

[renovate]

This PR contains the following updates:

Package	Update	Change
authelia/authelia (source)	minor	4.38.18 -> 4.39.15

---

Release Notes

authelia/authelia (authelia/authelia)

v4.39.15

Compare Source

Bug Fixes

• authentication: error determining ldap server health (#​10753) (b6e14c7)
• configuration: defaults not applied to server authz (#​10793) (73bee22)

Docker Container

• docker pull authelia/authelia:4.39.15
• docker pull ghcr.io/authelia/authelia:4.39.15

v4.39.14

Compare Source

Bug Fixes

• authentication: ldap pool deadlock (#​10527) (279c1be), closes #​9936 #​10392
• authentication: referrals not chased (#​10608) (5ddb457), closes #​10569
• authentication: remove singleflight debug logging (#​10628) (4c1c6ee)
• expression: shallow value resolution (#​10582) (bc0fb6c), closes #​10558

Docker Container

• docker pull authelia/authelia:4.39.14
• docker pull ghcr.io/authelia/authelia:4.39.14

v4.39.13

Compare Source

Bug Fixes

• authentication: basic auth cache multi-flight (#​10522) (e25b66c)
• regulation: pool deadline error incorrectly logged (#​10521) (4b45d48)

Docker Container

• docker pull authelia/authelia:4.39.13
• docker pull ghcr.io/authelia/authelia:4.39.13

v4.39.12

Compare Source

Bug Fixes

• storage: oauth2 device code constraints (#​10484) (26f3b89), closes #​10404

Docker Container

• docker pull authelia/authelia:4.39.12
• docker pull ghcr.io/authelia/authelia:4.39.12

v4.39.11

Compare Source

Bug Fixes

• handlers: webauthn experimental 2fa default redirection (#​10426) (8c76ea3)
• oidc: remember consent ignored (#​10384) (5cd17eb)
• web: consent remember ux (#​10347) (e9a4047)

Docker Container

• docker pull authelia/authelia:4.39.11
• docker pull ghcr.io/authelia/authelia:4.39.11

v4.39.10

Compare Source

Bug Fixes

• web: dynamically set html lang tag (#​10297) (a1f594d), closes #​8729

Docker Container

• docker pull authelia/authelia:4.39.10
• docker pull ghcr.io/authelia/authelia:4.39.10

v4.39.9

Compare Source

Bug Fixes

• authelia apt repository (#​10255) (e3573cd)
• goreleaser .deb postinstall script failure (#​10227) (b01d8bb)

Docker Container

• docker pull authelia/authelia:4.39.9
• docker pull ghcr.io/authelia/authelia:4.39.9

v4.39.8

Compare Source

Bug Fixes

• set config file type (#​10201) (d9af3c6), closes #​10198

Docker Container

• docker pull authelia/authelia:4.39.8
• docker pull ghcr.io/authelia/authelia:4.39.8

v4.39.7

Compare Source

Bug Fixes

• oidc: consent form not restored (#​10152) (73811c7)
• web: remove invalid fragment and use array (#​10093) (cbfdeaa)

Docker Container

• docker pull authelia/authelia:4.39.7
• docker pull ghcr.io/authelia/authelia:4.39.7

v4.39.6

Compare Source

Notable Changes

OpenID Connect 1.0 client registrations incorrectly allowed none as a authorization_signed_response_alg value, this is no longer the case and if you specified this value you'll have to either remove it or update it to the new correct default of RS256.

Bug Fixes

• commands: missing header list header (#​9956) (6a31393)
• configuration: healthchecks for unix are unhealthy (#​9988) (76e0702)
• oidc: alg none allowed for jarm (#​10045) (86e8c4b)
• regulation: ip not marked (#​9949) (b731a0c)

Docker Container

• docker pull authelia/authelia:4.39.6
• docker pull ghcr.io/authelia/authelia:4.39.6

v4.39.5

Compare Source

Bug Fixes

• configuration: allow claim name override (#​9714) (1ce7c5e), closes #​9687
• configuration: default pbkdf2 iterations (#​9694) (8173ba4)
• embed: unable to run services (#​9619) (e77c6bc)
• notifier: disable require tls ineffectual (#​9803) (6bddcc6)
• oidc: authorize request relies on session update (#​9678) (fcd2bba), closes #​9677
• storage: change key operator (#​9618) (b582afb)
• webauthn: allow relaxed cache policy (#​9696) (5e56d20)
• web: csp inline style error (#​9642) (46c49f1)

Docker Container

• docker pull authelia/authelia:4.39.5
• docker pull ghcr.io/authelia/authelia:4.39.5

v4.39.4

Compare Source

Bug Fixes

• configuration: oidc enc generated kid invalid chars (#​9493) (15f2a1a)
• oidc: explicit consent flow failure (#​9562) (a3f62b3)
• web: add missing translations (#​9496) (9d8fd85)
• web: adjust contrast for iv buttons and text input (#​9570) (f040e41)

Docker Container

• docker pull authelia/authelia:4.39.4
• docker pull ghcr.io/authelia/authelia:4.39.4

v4.39.3

Compare Source

Important Note: The v4.39.2 release inadvertently removed the legacy OpenID Connect 1.0 endpoints which have not been documented at least in the last 3 years either at the discovery document or on the website. While these changes were technically unintentional right at this moment they were going to be hard removed at some point before we graduated OpenID Connect 1.0 out of a experimental/beta state and users had previously been notified of this change, as such we're going to leave them as is. Users should refer to our documentation as well as their instances discovery endpoints to obtain the correct URLs. The URLs that potentially may need updating are as follows: the URL /api/oidc/jwks previously handled requests for the JSON Web Key Set Endpoint, the URL /api/oidc/authorize previously also handled requests for the Authorization Endpoint, the URL /api/oidc/introspect previously also handled requests for the Introspection Endpoint, and the URL /api/oidc/revoke previously also handled requests for the Revocation Endpoint.

Bug Fixes

• oidc: rfc9068 jwt strategy not configured (#​9479) (785eab9), closes #​9478
• web: fetch webauthn when disabled (#​9482) (bc318fa)
• web: no redirection to completion view (#​9480) (0a4c2f2)

Docker Container

• docker pull authelia/authelia:4.39.3
• docker pull ghcr.io/authelia/authelia:4.39.3

v4.39.2

Compare Source

Important Note: The v4.39.2 release inadvertently removed the legacy OpenID Connect 1.0 endpoints which have not been documented in the last 3 years either at the discovery document or on the website. While these changes were technically unintentional right at this moment they were going to be hard removed at some point before we graduated OpenID Connect 1.0 out of a experimental/beta state, as such we're going to leave them as is. Users should refer to our documentation as well as their instances discovery endpoints to obtain the correct URLs.

Bug Fixes

• commands: incorrect flag mapping (#​9292) (6b358ef)
• configuration: missing oidc alg validations (#​9267) (694cf9e)
• configuration: yescrypt not configurable (#​9241) (0f6c1dc)
• oidc: consent semantics not enforced (#​9331) (04c27fe)
• oidc: consent subject binding too early (#​9302) (3ebed86)
• oidc: device authorization flow (#​9429) (f6001ff)
• oidc: ensure stateful userinfo token use (#​9385) (9b2de99), closes #​9382
• oidc: include missing id token claims in implicit flow (#​9238) (1313776)
• oidc: missing device code handlers (#​9265) (b0cf8c5)
• oidc: missing grant handlers (#​9272) (25f79d0)
• webauthn: metadata errors too vague (#​9012) (1eaf858)
• webauthn: passkey compliance workaround (#​9278) (0a3e633), closes #​9094
• web: differing password ux (#​9243) (aef2966)
• web: display name is mislabeled as username (#​9108) (b05026c)
• web: unified peek button for password fields (#​9311) (ec34a3f)

Performance Improvements

• configuration: decode hooks improvements (#​9338) (8dbdfdc)

Docker Container

• docker pull authelia/authelia:4.39.2
• docker pull ghcr.io/authelia/authelia:4.39.2

v4.39.1

Compare Source

Bug Fixes

• configuration: cache lifespan scheme case (#​8983) (16a447b), closes #​8981
• notifier startup check ignored (#​8977) (212b1b5), closes #​8975
• oidc: claims nil value not checked (#​8982) (6cc1909), closes #​8979
• oidc: multiple subject matching regression (#​8998) (377ddd1)
• session retrieval failure with in-built memory provider (#​9004) (7a750da)
• storage: cached_data table value size (#​8984) (3f5e747)
• suites: sambaldap certs with negative serial numbers (#​9007) (0558ad2)
• web: appbar layout (#​8987) (c661154)
• web: broken horizontal margin (#​8988) (3f2aa0d)
• web: duo sign in failure (#​8986) (d514f8a)

Docker Container

• docker pull authelia/authelia:4.39.1
• docker pull ghcr.io/authelia/authelia:4.39.1

v4.39.0

Compare Source

Summary

Please see the Authelia Blog: 4.39 Release Notes for human readable summaries of the changes. It's important to note some critical changes have occurred in this release that warrant some user attention.

Specific critical changes which are detailed in the Authelia Blog: 4.39 Release Notes to watch out for:

1. Changes that will require manual intervention in some scenarios:
   • The default claims for ID Tokens minted by the Authelia OpenID Connect 1.0 Identity Provider have changed.
2. Changes that shouldn't require manual intervention but are significant enough to cause issues in some edge cases:
   • The official Authelia container has been heavily changed.
   • The official Systemd Units which are packaged in AUR packages, DEB packages, and the GitHub artifacts archives have been heavily changed.

Detailed Changes

Bug Fixes

• i18n: lack of privacy policy message consistency (#​8845) (a091374)
• web: radio group spacing on mobile and uncentered icons (#​8843) (ff88332)
• web: workflow id missing from passkey first factor (#​8951) (f948399), closes #​8950

Features

• authentication: additional and custom attributes (#​8078) (34932a8)
• authentication: ldap connection pooling (#​7217) (0af038e)
• authentication: permit empty base dn (#​8112) (4b50771)
• build from authelia/base base image (#​8884) (7d1adff)
• configuration: listen on file descriptor (#​5973) (df67550)
• configuration: reusable definitions (#​8077) (a9d1986)
• configuration: support abstract unix socket (#​7662) (3fc0378)
• docker: implement shellcheck recommendations (#​7474) (c7a8e58)
• embed: make authelia embedable (#​8841) (9241731), closes #​5803
• handlers: basic authz caching (#​8320) (05fa254), closes #​5006
• logging: reopen on sighup (#​7140) (16e44cb), closes #​4964
• metrics: record passkey logins separately (#​8866) (6759988)
• middlewares: tokenized bucket rate limit (#​8321) (ef5051b), closes #​7353 #​1947
• oidc: authorization policy network criteria (#​8079) (f67097c)
• oidc: claims parameter support (#​8081) (111344e), closes #​2868
• oidc: merged id token claims (#​8851) (eadf0ba), closes #​8619
• oidc: prompt parameter support (#​8080) (9c718b3), closes #​2596
• oidc: rfc7516 jwt encryption (#​8083) (684c8e2)
• oidc: rfc8628 oauth 2.0 device code grant (#​8082) (e7d387e)
• regulation: ip bans and unbanning (#​7230) (5e40d97)
• storage: allow peer authentication (#​8161) (4b8d2ce)
• storage: allow postgres failover (#​7775) (2934c16)
• use dedicated system user for systemd unit (#​4982) (e33d729), closes #​3736
• web: add new oled theme (#​8838) (e02a2db)
• webauthn: passkeys (#​7942) (197b455), closes #​2827 #​2761
• web: change password (#​7676) (f4abcb3), closes #​3548
• web: language picker (#​6716) (2f1afa1)

Docker Container

• docker pull authelia/authelia:4.39.0
• docker pull ghcr.io/authelia/authelia:4.39.0

v4.38.19

Compare Source

Bug Fixes

• configuration: authz endpoint errors with forward slash (#​8654) (d382bb0)
• configuration: unregisterable domains not accepted (#​8663) (5811888)
• handlers: regulation flow (#​8683) (d4a5418)
• notifier: smtp log fails to serialize (#​8570) (ba3a877), closes #​8569

Docker Container

• docker pull authelia/authelia:4.38.19
• docker pull ghcr.io/authelia/authelia:4.38.19

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.