authentik/website/docs/releases/v2022.12.md

---
title: Release 2022.12
slug: "2022.12"
---

## Breaking changes

-   Blueprints fetched via OCI require oci:// schema

    To better detect if a blueprint should be fetched locally or via OCI, all OCI sourced blueprints require an `oci://` protocol.

## New features

-   Bundled GeoIP City database

    authentik now comes with a bundled MaxMind GeoLite2 City database. This allows everyone to take advantage of the extra data provided by GeoIP. The default docker-compose file removes the GeoIP update container as it is no longer needed. See more [here](../core/geoip)

-   Improved UX for user & group management and stage/policy binding

    Users can now more easily be added to and removed from groups, both when viewing a single user and viewing a group.

    When creating new stages or policies, authentik will now automatically offer an option to bind them to the object in whose context they were created in.

    Select inputs were previously limited to showing a single page of items (default size of 100 items). These inputs have been replaced by dynamically loading inputs which support searching and better show the properties of the item.

-   Preview for OAuth2 and SAML providers

    OAuth2 and SAML providers can now preview what the currently selected property/scope mappings's outcome will look like. This helps with seeing what data is sent to the client and implementing and testing custom mappings.

-   Customisable Captcha stage

    The captcha stage now supports alternate compatible providers, like [hCaptcha](https://docs.hcaptcha.com/switch/) and [Turnstile](https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha/).

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.12 from [here](https://goauthentik.io/version/2022.12/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.12.0
```

## Minor changes/fixes

-   blueprints: add !Env tag
-   blueprints: add `!If` tag (#4264)
-   blueprints: add conditions to blueprint schema
-   blueprints: Added conditional entry application (#4167)
-   blueprints: better OCI support in UI (#4263)
-   blueprints: fixed bug causing filtering with an empty query (#4106)
-   blueprints: Support nested custom tags in `!Find` and `!Format` tags (#4127)
-   core: add endpoints to add/remove users from group atomically
-   core: bundle geoip (#4250)
-   events: fix incorrect EventAction being used
-   events: improve handling creation of events with non-pickleable objects
-   events: remove legacy logger declaration
-   events: save login event in session after login
-   flows: fix redirect from plan context "redirect" not being wrapped in flow response
-   flows: set stage name and verbose_name for in_memory stages
-   internal: dont error if environment config isn't found
-   internal: remove sentry proxy
-   internal: reuse http transport to prevent leaking connections (#3996)
-   lib: enable sentry profiles_sample_rate
-   lib: fix uploaded files not being saved correctly, add tests
-   lifecycle: don't set user/group in gunicorn
-   lifecycle: improve explanation for user: root and docket socket mount
-   policies: don't log context when policy returns None
-   policies: log correct cache state
-   policies: make name required
-   policies/password: Always add generic message to failing zxcvbn check (#4100)
-   providers: add preview for mappings (#4254)
-   providers/ldap: improve mapping of LDAP filters to authentik queries
-   providers/oauth2: optimise and cache signing key, prevent key being loaded multiple times
-   providers/oauth2: set amr values based on login event
-   providers/proxy: correctly set id_token_hint if possible
-   providers/saml: set AuthnContextClassRef based on login event
-   root: allow custom settings via python module
-   root: migrate to hosted sentry with rate-limited DSN
-   security: fix CVE 2022 23555 (#4274)
-   security: fix CVE 2022 46145 (#4140)
-   security: fix CVE 2022 46172 (#4275)
-   stages/authenticator_duo: fix imported duo devices not being confirmed
-   stages/authenticator_validate: fix validation to ensure configuration stage is set
-   stages/authenticator_validate: improve validation for not_configured_action
-   stages/authenticator_validate: log duo error
-   stages/authenticator_validate: save used mfa devices in login event
-   stages/captcha: customisable URLs (#3832)
-   stages/invitation: fix incorrect pk check for invitation's flow
-   stages/user_login: prevent double success message when logging in via source
-   stages/user_write: always ignore `component` field and prevent warning
-   web: fix authentication with Plex on iOS (#4095)
-   web: ignore d3 circular deps warning, treat unresolved import as error
-   web: use version family subdomain for in-app doc links
-   web/admin: better show metadata download for saml provider
-   web/admin: break all in code blocks in event info
-   web/admin: clarify phrasing that user ID is required
-   web/admin: fix action button order for blueprints
-   web/admin: fix alignment in tables with multiple elements in cell
-   web/admin: fix empty request being sent due to multiple forms in duo import modal
-   web/admin: improve i18n for documentation link in outpost form
-   web/admin: improve UI for removing users from groups and groups from users
-   web/admin: improve user/group UX for adding/removing users to and from groups
-   web/admin: more consistent label usage, use compact labels
-   web/admin: rework markdown, correctly render Admonitions, fix links
-   web/admin: show bound policies order first to match stages
-   web/admin: show policy binding form when creating policy in bound list
-   web/admin: show stage binding form when creating stage in bound list
-   web/elements: fix alignment for checkboxes in table
-   web/elements: fix alignment with checkbox in table
-   web/elements: fix log level for diagram
-   web/elements: fix table select-all checkbox being checked with no elements
-   web/elements: fix wizard form page changing state before being active
-   web/elements: unselect top checkbox in table when not all elements are selected
-   web/flows: fix display for long redirect URLs
-   web/flows: improve error messages for failed duo push
-   web/flows: update flow background
-   web/user: fix styling for clear all button in notification drawer

## API Changes

#### What's Changed

---

##### `GET` /stages/captcha/{stage_uuid}/

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    -   Added property `js_url` (string)

    -   Added property `api_url` (string)

    -   Changed property `public_key` (string)
        > Public key, acquired your captcha Provider.

##### `PUT` /stages/captcha/{stage_uuid}/

###### Request:

Changed content type : `application/json`

-   Added property `js_url` (string)

-   Added property `api_url` (string)

-   Changed property `public_key` (string)

    > Public key, acquired your captcha Provider.

-   Changed property `private_key` (string)
    > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    -   Added property `js_url` (string)

    -   Added property `api_url` (string)

    -   Changed property `public_key` (string)
        > Public key, acquired your captcha Provider.

##### `PATCH` /stages/captcha/{stage_uuid}/

###### Request:

Changed content type : `application/json`

-   Added property `js_url` (string)

-   Added property `api_url` (string)

-   Changed property `public_key` (string)

    > Public key, acquired your captcha Provider.

-   Changed property `private_key` (string)
    > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    -   Added property `js_url` (string)

    -   Added property `api_url` (string)

    -   Changed property `public_key` (string)
        > Public key, acquired your captcha Provider.

##### `GET` /flows/executor/{flow_slug}/

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    Updated `ak-stage-captcha` component:
    New required properties:

    -   `js_url`

    *   Added property `js_url` (string)

##### `POST` /flows/executor/{flow_slug}/

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    Updated `ak-stage-captcha` component:
    New required properties:

    -   `js_url`

    *   Added property `js_url` (string)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

-   Added property `js_url` (string)

-   Added property `api_url` (string)

-   Changed property `public_key` (string)

    > Public key, acquired your captcha Provider.

-   Changed property `private_key` (string)
    > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **201 Created**

-   Changed content type : `application/json`

    -   Added property `js_url` (string)

    -   Added property `api_url` (string)

    -   Changed property `public_key` (string)
        > Public key, acquired your captcha Provider.

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

-   Changed content type : `application/json`

    -   Changed property `results` (array)

        Changed items (object): > CaptchaStage Serializer

        -   Added property `js_url` (string)

        -   Added property `api_url` (string)

        -   Changed property `public_key` (string)
            > Public key, acquired your captcha Provider.