authentik: Release 2025.10.4

See See https://docs.goauthentik.io/docs/releases/2025.10#fixed-in-2025104 ## What's Changed * web/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18932 * website/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18965 * website/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18974 * web/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18986 * web/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/18988 * core: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19030 * internal: update TLS Suite (cherry-pick #19076 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19077 * website/docs: fix build (cherry-pick #19148 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19150 * web: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19172 * core: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19240 * web/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19292 * website/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19255 * website/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19321 * website/docs: Fix documentation example for `app_entitlements_attributes`. (cherry-pick #19316 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19325 * website/docs: update m2m doc (cherry-pick #18963 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19323 * website/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19344 * web/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19376 * outpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19374 * internal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19383 * website/docs: update gws provider docs (cherry-pick #18286 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19399 * website/docs: add import to discord policy (cherry-pick #19397 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19405 * website/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19401 * website/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19488 * providers/oauth2: add `logout+jwt` token type for oidc logout token. (cherry-pick #19554 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19674 * internal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19702 * core: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19709 * web/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19711 * web/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19764 * website/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19770 * root: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10) by @rissson in https://github.com/goauthentik/authentik/pull/19933 * recovery: consume token in transaction (cherry-pick #19967 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19981 * providers/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19982 * website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20022 * docs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20054 * core: bump django from v5.2.8 to 5.2.11 (version-2025.10) by @melizeche in https://github.com/goauthentik/authentik/pull/20020 * outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20058 * website/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20100 * outpost/proxyv2: reduce max number of postgres connections (cherry-pick #19211 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20139 * website/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20204 * website/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20201 * security: CVE-2026-25922 (2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20229 * security: CVE-2026-25748 (2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20228 * security: CVE-2026-25227 (2025.10) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20227 * web: updated package-lock.json to include missing tree-sitter references. by @kensternberg-authentik in https://github.com/goauthentik/authentik/pull/20247 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.10.3...version/2025.10.4