authentik: Release 2026.2.3

See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202623 ## What's Changed * core: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21526 * endpoints: fix tasks failing (cherry-pick #20904 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21538 * website/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21542 * lib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21581 * packages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21599 * providers/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21598 * blueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21616 * website/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21619 * website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21629 * web/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21627 * providers/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21748 * providers/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21750 * ci: fix postgres path for postgres 18 tests (2026.2) (#21767) by @BeryJu in https://github.com/goauthentik/authentik/pull/21789 * website/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21786 * providers/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21799 * website/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21818 * providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21828 * web/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21850 * core: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21988 * rbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22033 * root: update django to 5.2.14 (cherry-pick #22064 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22066 * packages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22127 * tenants/settings: present unset flags as `False` (cherry-pick #22162 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22164 * events: fix `destination_group_obj` not being nullable (cherry-pick #22161 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22165 * internal: fix lint by @gergosimonyi in https://github.com/goauthentik/authentik/pull/22263 * internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22289 * internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22287 * internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22286 * internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22285 * internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22284 * internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22283 * internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22282 * internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22288 * website/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22312 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2026.2.3-rc1...version/2026.2.3