update: 2025.12.4 -> 2026.2.0

ChangeLog: https://docs.goauthentik.io/releases/2026.2/

components/docs.nix

@@ -13,7 +13,8 @@ buildNapalmPackage "${authentik-src}/website" {
     "cp -v ${authentik-src}/SECURITY.md ../SECURITY.md"
     "cp -vr ${authentik-src}/blueprints ../blueprints"
     "cp -v ${authentik-src}/schema.yml ../schema.yml"
-    "cp -v ${authentik-src}/docker-compose.yml ../docker-compose.yml"
+    "mkdir -p ../lifecycle/container"
+    "cp -v ${authentik-src}/lifecycle/container/compose.yml ../lifecycle/container/compose.yml"
     "npm config set loglevel verbose"
     "npm ci --workspaces --include-workspace-root --no-audit"
     "npm run build"

components/fix-lxml-libxml-2.15-build.patch

@@ -1,12 +0,0 @@
-diff --git a/src/lxml/etree.c b/src/lxml/etree.c
-index 9fbfe5a..74c83c7 100644
---- a/src/lxml/etree.c
-+++ b/src/lxml/etree.c
-@@ -35183,7 +35183,6 @@ static void __pyx_f_4lxml_5etree_fixThreadDictNamesForDtd(xmlDtd *__pyx_v_c_dtd,
-  *                 _fixThreadDictPtr(&c_attribute.name, c_src_dict, c_dict)
-  *                 _fixThreadDictPtr(&c_attribute.prefix, c_src_dict, c_dict)
- */
--        __pyx_f_4lxml_5etree__fixThreadDictPtr((&__pyx_v_c_attribute->defaultValue), __pyx_v_c_src_dict, __pyx_v_c_dict);
- 
-         /* "src/lxml/proxy.pxi":578
-  *             while c_attribute:

components/gopkgs.nix

@@ -69,7 +69,7 @@ buildGo125Module {
   ] ++ lib.optionals guacamoleAvailable [
     "cmd/rac"
   ];
-  vendorHash = "sha256-hdkd7/bqgTvYwlhVA9zEQny6yDowMaoRcC7TdRoXfJc=";
+  vendorHash = "sha256-0YKn6qScUjkLOq/hyUZp7e+dQ58POSgj4CgfDro+5J4=";
   nativeBuildInputs = [ makeWrapper ];
   doCheck = false;
   postInstall = ''

components/python-overrides.nix

@@ -8,6 +8,7 @@
   libtool,
   pkg-config,
   xmlsec,
+  python,
 }:
 
 let
@@ -44,6 +45,18 @@ let
 
   # Fixes for dependencies with C libraries.
   buildFixes = final: prev: {
+    django-tenants = prev.django-tenants.overrideAttrs {
+      /*
+        Resolves
+
+         > FileCollisionError: Two or more packages are trying to provide the same file with different contents
+         >
+         >         Files: /nix/store/snsw4gij9l7pllphdskxqmr3y5a951aq-django-tenants-3.10.0/lib/python3.14/site-packages/docs/Makefile /nix/store/dxy56wp46sm8nqjfhmfswb5k5rcwrj6y-pyrad-2.5.4/lib/python3.14/site-packages/docs/Makefile
+      */
+      postFixup = ''
+        rm -r $out/${python.sitePackages}/docs
+      '';
+    };
     gssapi = prev.gssapi.overrideAttrs (
       {
         buildInputs ? [ ],
@@ -77,7 +90,6 @@ let
     lxml = prev.lxml.overrideAttrs (
       {
         buildInputs ? [ ],
-        patches ? [ ],
         ...
       }:
       {
@@ -86,13 +98,6 @@ let
           libxml2
           zlib
         ];
-        patches = patches ++ [
-          # The upstream fix for this is
-          # https://github.com/lxml/lxml/commit/f7a813483c4482dd114e7ee8b42b54337e285503,
-          # however, this doesn't help us here because the `etree.c` file is already generated
-          # (we're using the wheel), so we have to patch the C file directly.
-          ./fix-lxml-libxml-2.15-build.patch
-        ];
       }
     );
     xmlsec = prev.xmlsec.overrideAttrs (

flake.lock

@@ -19,16 +19,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1770911230,
+        "lastModified": 1771963976,
-        "narHash": "sha256-alTyrMBbjZbw4jhEna8saabf93sqSrZCu+Z5xH3pZ7M=",
+        "narHash": "sha256-pVQ34cZYX3hlk6hF1aZ/n32xMqTF4Jmp0G0VGDU7iXc=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "19ad8d3ae3f266ec1096bc4461fdf6bcda1aa079",
+        "rev": "8af491630b70ff6bd089753e21bef511bfb3f557",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2025.12.4",
+        "ref": "version/2026.2.0",
         "repo": "authentik",
         "type": "github"
       }

flake.nix

@@ -42,7 +42,7 @@
     };
     authentik-src = {
       # change version string in outputs as well when updating
-      url = "github:goauthentik/authentik/version/2025.12.4";
+      url = "github:goauthentik/authentik/version/2026.2.0";
       flake = false;
     };
     authentik-go = {
@@ -72,7 +72,7 @@
         ...
       }:
       let
-        authentik-version = "2025.12.4"; # to pass to the drvs of some components
+        authentik-version = "2026.2.0"; # to pass to the drvs of some components
       in
       {
         systems = import inputs.systems;
@@ -114,7 +114,7 @@
               {
                 pkgs,
                 system ? pkgs.stdenv.hostPlatform.system,
-                python ? pkgs.python313,
+                python ? pkgs.python314,
                 authentik-version ? authentik-version',
                 buildNapalmPackage ? napalm.legacyPackages.${system}.buildPackage,
               }:

tests/minimal-vmtest.nix

@@ -9,7 +9,7 @@ pkgs.testers.runNixOSTest {
     authentik = {
       virtualisation = {
         cores = 3;
-        memorySize = 2048;
+        memorySize = 3072;
       };
       imports = [
         nixosModules.default

tests/override-scope.nix

@@ -48,7 +48,7 @@ pkgs.testers.runNixOSTest {
     authentik = {
       virtualisation = {
         cores = 3;
-        memorySize = 2048;
+        memorySize = 3072;
       };
       imports = [
         nixosModules.default