Merge branch 'main' into multi-tenant-django-tenants

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.10.3
+current_version = 2023.10.4
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.github/actions/setup/action.yml

@@ -2,7 +2,7 @@ name: "Setup authentik testing environment"
 description: "Setup authentik testing environment"
 
 inputs:
-  postgresql_tag:
+  postgresql_version:
     description: "Optional postgresql image tag"
     default: "12"
 
@@ -33,9 +33,8 @@ runs:
     - name: Setup dependencies
       shell: bash
       run: |
-        export PSQL_TAG=${{ inputs.postgresql_tag }}
+        export PSQL_TAG=${{ inputs.postgresql_version }}
         docker-compose -f .github/actions/setup/docker-compose.yml up -d
-        poetry env use python3.11
         poetry install
         cd web && npm ci
     - name: Generate config

.github/workflows/ci-main.yml

@@ -48,25 +48,38 @@ jobs:
       - name: run migrations
         run: poetry run python -m lifecycle.migrate
   test-migrations-from-stable:
+    name: test-migrations-from-stable - PostgreSQL ${{ matrix.psql }}
     runs-on: ubuntu-latest
-    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        psql:
+          - 12-alpine
+          - 15-alpine
+          - 16-alpine
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Setup authentik env
         uses: ./.github/actions/setup
+        with:
+          postgresql_version: ${{ matrix.psql }}
       - name: checkout stable
         run: |
+          # Delete all poetry envs
+          rm -rf /home/runner/.cache/pypoetry
           # Copy current, latest config to local
           cp authentik/lib/default.yml local.env.yml
           cp -R .github ..
           cp -R scripts ..
-          git checkout $(git describe --tags $(git rev-list --tags --max-count=1))
+          git checkout version/$(python -c "from authentik import __version__; print(__version__)")
           rm -rf .github/ scripts/
           mv ../.github ../scripts .
       - name: Setup authentik env (ensure stable deps are installed)
         uses: ./.github/actions/setup
+        with:
+          postgresql_version: ${{ matrix.psql }}
       - name: run migrations to stable
         run: poetry run python -m lifecycle.migrate
       - name: checkout current code
@@ -76,9 +89,13 @@ jobs:
           git reset --hard HEAD
           git clean -d -fx .
           git checkout $GITHUB_SHA
+          # Delete previous poetry env
+          rm -rf $(poetry env info --path)
           poetry install
       - name: Setup authentik env (ensure latest deps are installed)
         uses: ./.github/actions/setup
+        with:
+          postgresql_version: ${{ matrix.psql }}
       - name: migrate to latest
         run: poetry run python -m lifecycle.migrate
   test-unittest:
@@ -97,7 +114,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
         with:
-          postgresql_tag: ${{ matrix.psql }}
+          postgresql_version: ${{ matrix.psql }}
       - name: run unittest
         run: |
           poetry run make test
@@ -117,7 +134,7 @@ jobs:
         uses: helm/kind-action@v1.8.0
       - name: run integration
         run: |
-          poetry run coverage run manage.py test --randomly-seed=2100196988 tests/integration
+          poetry run coverage run manage.py test tests/integration
           poetry run coverage xml
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3

.vscode/extensions.json

@@ -14,6 +14,7 @@
         "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
+        "ms-python.black-formatter",
         "redhat.vscode-yaml",
         "Tobermory.es6-string-html",
         "unifiedjs.vscode-mdx",

.vscode/settings.json

@@ -19,10 +19,8 @@
         "slo",
         "scim",
     ],
-    "python.linting.pylintEnabled": true,
     "todo-tree.tree.showCountsInTree": true,
     "todo-tree.tree.showBadges": true,
-    "python.formatting.provider": "black",
     "yaml.customTags": [
         "!Find sequence",
         "!KeyOf scalar",

Dockerfile

@@ -81,7 +81,7 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
 # Stage 5: Python dependencies
-FROM docker.io/python:3.11.5-bookworm AS python-deps
+FROM docker.io/python:3.12.0-slim-bookworm AS python-deps
 
 WORKDIR /ak-root/poetry
 
@@ -104,7 +104,7 @@ RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
     poetry install --only=main --no-ansi --no-interaction
 
 # Stage 6: Run
-FROM docker.io/python:3.11.5-slim-bookworm AS final-image
+FROM docker.io/python:3.12.0-slim-bookworm AS final-image
 
 ARG GIT_BUILD_HASH
 ARG VERSION

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.10.3"
+__version__ = "2023.10.4"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/core/models.py

@@ -517,7 +517,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def get_icon(self) -> Optional[str]:
+    def icon_url(self) -> Optional[str]:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:

authentik/events/models.py

@@ -217,6 +217,7 @@ class Event(SerializerModel, ExpiringModel):
                 "path": request.path,
                 "method": request.method,
                 "args": cleanse_dict(QueryDict(request.META.get("QUERY_STRING", ""))),
+                "user_agent": request.META.get("HTTP_USER_AGENT", ""),
             }
             # Special case for events created during flow execution
             # since they keep the http query within a wrapped query

authentik/events/tests/test_event.py

@@ -53,7 +53,15 @@ class TestEvents(TestCase):
         """Test plain from_http"""
         event = Event.new("unittest").from_http(self.factory.get("/"))
         self.assertEqual(
-            event.context, {"http_request": {"args": {}, "method": "GET", "path": "/"}}
+            event.context,
+            {
+                "http_request": {
+                    "args": {},
+                    "method": "GET",
+                    "path": "/",
+                    "user_agent": "",
+                }
+            },
         )
 
     def test_from_http_clean_querystring(self):
@@ -67,6 +75,7 @@ class TestEvents(TestCase):
                     "args": {"token": SafeExceptionReporterFilter.cleansed_substitute},
                     "method": "GET",
                     "path": "/",
+                    "user_agent": "",
                 }
             },
         )
@@ -83,6 +92,7 @@ class TestEvents(TestCase):
                     "args": {"token": SafeExceptionReporterFilter.cleansed_substitute},
                     "method": "GET",
                     "path": "/",
+                    "user_agent": "",
                 }
             },
         )

authentik/events/utils.py

@@ -5,12 +5,13 @@ from dataclasses import asdict, is_dataclass
 from datetime import date, datetime, time, timedelta
 from enum import Enum
 from pathlib import Path
-from types import GeneratorType
+from types import GeneratorType, NoneType
 from typing import Any, Optional
 from uuid import UUID
 
 from django.contrib.auth.models import AnonymousUser
 from django.core.handlers.wsgi import WSGIRequest
+from django.core.serializers.json import DjangoJSONEncoder
 from django.db import models
 from django.db.models.base import Model
 from django.http.request import HttpRequest
@@ -159,7 +160,14 @@ def sanitize_item(value: Any) -> Any:
             "name": value.__name__,
             "module": value.__module__,
         }
-    return value
+    # List taken from the stdlib's JSON encoder (_make_iterencode, encoder.py:415)
+    if isinstance(value, (bool, int, float, NoneType, list, tuple, dict)):
+        return value
+    try:
+        return DjangoJSONEncoder().default(value)
+    except TypeError:
+        return str(value)
+    return str(value)
 
 
 def sanitize_dict(source: dict[Any, Any]) -> dict[Any, Any]:

authentik/sources/oauth/models.py

@@ -74,7 +74,7 @@ class OAuthSource(Source):
     def ui_login_button(self, request: HttpRequest) -> UILoginButton:
         provider_type = self.source_type
         provider = provider_type()
-        icon = self.get_icon
+        icon = self.icon_url
         if not icon:
             icon = provider.icon_url()
         return UILoginButton(
@@ -85,7 +85,7 @@ class OAuthSource(Source):
 
     def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         provider_type = self.source_type
-        icon = self.get_icon
+        icon = self.icon_url
         if not icon:
             icon = provider_type().icon_url()
         return UserSettingSerializer(
@@ -232,7 +232,7 @@ class UserOAuthSourceConnection(UserSourceConnection):
     access_token = models.TextField(blank=True, null=True, default=None)
 
     @property
-    def serializer(self) -> Serializer:
+    def serializer(self) -> type[Serializer]:
         from authentik.sources.oauth.api.source_connection import (
             UserOAuthSourceConnectionSerializer,
         )

authentik/sources/plex/models.py

@@ -62,7 +62,7 @@ class PlexSource(Source):
         return PlexSourceSerializer
 
     def ui_login_button(self, request: HttpRequest) -> UILoginButton:
-        icon = self.get_icon
+        icon = self.icon_url
         if not icon:
             icon = static("authentik/sources/plex.svg")
         return UILoginButton(
@@ -79,7 +79,7 @@ class PlexSource(Source):
         )
 
     def ui_user_settings(self) -> Optional[UserSettingSerializer]:
-        icon = self.get_icon
+        icon = self.icon_url
         if not icon:
             icon = static("authentik/sources/plex.svg")
         return UserSettingSerializer(

authentik/sources/saml/models.py

@@ -200,11 +200,11 @@ class SAMLSource(Source):
                 }
             ),
             name=self.name,
-            icon_url=self.get_icon,
+            icon_url=self.icon_url,
         )
 
     def ui_user_settings(self) -> Optional[UserSettingSerializer]:
-        icon = self.get_icon
+        icon = self.icon_url
         if not icon:
             icon = static(f"authentik/sources/{self.slug}.svg")
         return UserSettingSerializer(

authentik/stages/authenticator_sms/stage.py

@@ -69,7 +69,6 @@ class AuthenticatorSMSStageView(ChallengeStageView):
         stage: AuthenticatorSMSStage = self.executor.current_stage
         hashed_number = hash_phone_number(phone_number)
         query = Q(phone_number=hashed_number) | Q(phone_number=phone_number)
-        print(SMSDevice.objects.filter(query, stage=stage.pk))
         if SMSDevice.objects.filter(query, stage=stage.pk).exists():
             raise ValidationError(_("Invalid phone number"))
         # No code yet, but we have a phone number, so send a verification message

authentik/stages/authenticator_sms/tests.py

@@ -199,11 +199,9 @@ class AuthenticatorSMSStageTests(FlowTestCase):
                 sms_send_mock,
             ),
         ):
-            print(self.client.session[SESSION_KEY_PLAN])
             response = self.client.get(
                 reverse("authentik_api:flow-executor", kwargs={"flow_slug": self.flow.slug}),
             )
-        print(response.content.decode())
         self.assertStageResponse(
             response,
             self.flow,

authentik/stages/authenticator_validate/tests/test_duo.py

@@ -184,6 +184,7 @@ class AuthenticatorValidateStageDuoTests(FlowTestCase):
                     "args": {},
                     "method": "GET",
                     "path": f"/api/v3/flows/executor/{flow.slug}/",
+                    "user_agent": "",
                 },
             },
         )

authentik/stages/email/stage.py

@@ -59,7 +59,6 @@ class EmailStageView(ChallengeStageView):
         query_params = QueryDict(self.request.GET.get(QS_QUERY), mutable=True)
         query_params.pop(QS_KEY_TOKEN, None)
         query_params.update(kwargs)
-        print(query_params)
         full_url = base_url
         if len(query_params) > 0:
             full_url = f"{full_url}?{query_params.urlencode()}"

docker-compose.yml

@@ -32,7 +32,7 @@ services:
     volumes:
       - redis:/data
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.4}
     restart: unless-stopped
     command: server
     environment:
@@ -53,7 +53,7 @@ services:
       - postgresql
       - redis
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.4}
     restart: unless-stopped
     command: worker
     environment:

go.mod

@@ -27,7 +27,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.8.4
-	goauthentik.io/api/v3 v3.2023103.4
+	goauthentik.io/api/v3 v3.2023104.1
 	golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab
 	golang.org/x/oauth2 v0.14.0
 	golang.org/x/sync v0.5.0

go.sum

@@ -358,8 +358,8 @@ go.opentelemetry.io/otel/trace v1.14.0 h1:wp2Mmvj41tDsyAJXiWDWpfNsOiIyd38fy85pyK
 go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
-goauthentik.io/api/v3 v3.2023103.4 h1:dysNzRSbZC2NYeIyk3x5o3kUSsz+Y2VhtfcnzRe8Wkk=
-goauthentik.io/api/v3 v3.2023103.4/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
+goauthentik.io/api/v3 v3.2023104.1 h1:cvAsgoKP/fmO4fzifx0OyICknauFeyN88C4Z1LdWXDs=
+goauthentik.io/api/v3 v3.2023104.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190422162423-af44ce270edf/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=

internal/constants/constants.go

@@ -29,4 +29,4 @@ func UserAgent() string {
 	return fmt.Sprintf("authentik@%s", FullVersion())
 }
 
-const VERSION = "2023.10.3"
+const VERSION = "2023.10.4"

pyproject.toml

@@ -12,7 +12,7 @@ reportOptionalSubscript = false
 # so we have to disable those for now
 reportGeneralTypeIssues = false
 verboseOutput = false
-pythonVersion = "3.11"
+pythonVersion = "3.12"
 pythonPlatform = "All"
 
 [tool.black]
@@ -97,7 +97,7 @@ const-rgx = "[a-zA-Z0-9_]{1,40}$"
 
 ignored-modules = ["binascii", "socket", "zlib"]
 generated-members = ["xmlsec.constants.*", "xmlsec.tree.*", "xmlsec.template.*"]
-ignore = "migrations"
+ignore = ["migrations", "tests"]
 max-attributes = 12
 max-branches = 20
 
@@ -113,7 +113,7 @@ filterwarnings = [
 
 [tool.poetry]
 name = "authentik"
-version = "2023.10.3"
+version = "2023.10.4"
 description = ""
 authors = ["authentik Team <hello@goauthentik.io>"]
 
@@ -157,7 +157,7 @@ pycryptodome = "*"
 pydantic = "*"
 pydantic-scim = "*"
 pyjwt = "*"
-python = "~3.11"
+python = "~3.12"
 pyyaml = "*"
 requests-oauthlib = "*"
 sentry-sdk = "*"

schema.yml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: authentik
-  version: 2023.10.3
+  version: 2023.10.4
   description: Making authentication simple.
   contact:
     email: hello@goauthentik.io

tests/e2e/test_provider_oauth2_github.py

@@ -36,8 +36,8 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             "auto_remove": True,
             "healthcheck": Healthcheck(
                 test=["CMD", "wget", "--spider", "http://localhost:3000"],
-                interval=5 * 100 * 1000000,
-                start_period=1 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=1 * 1_000 * 1_000_000,
             ),
             "environment": {
                 "GF_AUTH_GITHUB_ENABLED": "true",

tests/e2e/test_provider_oauth2_grafana.py

@@ -42,8 +42,8 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             "auto_remove": True,
             "healthcheck": Healthcheck(
                 test=["CMD", "wget", "--spider", "http://localhost:3000"],
-                interval=5 * 100 * 1000000,
-                start_period=1 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=1 * 1_000 * 1_000_000,
             ),
             "environment": {
                 "GF_AUTH_GENERIC_OAUTH_ENABLED": "true",

tests/e2e/test_source_oauth.py

@@ -113,8 +113,8 @@ class TestSourceOAuth2(SeleniumTestCase):
             "command": "dex serve /config.yml",
             "healthcheck": Healthcheck(
                 test=["CMD", "wget", "--spider", "http://localhost:5556/dex/healthz"],
-                interval=5 * 100 * 1000000,
-                start_period=1 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=1 * 1_000 * 1_000_000,
             ),
             "volumes": {str(Path(CONFIG_PATH).absolute()): {"bind": "/config.yml", "mode": "ro"}},
         }

tests/e2e/test_source_saml.py

@@ -83,8 +83,8 @@ class TestSourceSAML(SeleniumTestCase):
             "auto_remove": True,
             "healthcheck": Healthcheck(
                 test=["CMD", "curl", "http://localhost:8080"],
-                interval=5 * 100 * 1000000,
-                start_period=1 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=1 * 1_000 * 1_000_000,
             ),
             "environment": {
                 "SIMPLESAMLPHP_SP_ENTITY_ID": "entity-id",

tests/integration/test_outpost_docker.py

@@ -35,8 +35,8 @@ class OutpostDockerTests(DockerTestCase, ChannelsLiveServerTestCase):
             privileged=True,
             healthcheck=Healthcheck(
                 test=["CMD", "docker", "info"],
-                interval=5 * 100 * 1000000,
-                start_period=5 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=5 * 1_000 * 1_000_000,
             ),
             environment={"DOCKER_TLS_CERTDIR": "/ssl"},
             volumes={

tests/integration/test_proxy_docker.py

@@ -35,8 +35,8 @@ class TestProxyDocker(DockerTestCase, ChannelsLiveServerTestCase):
             privileged=True,
             healthcheck=Healthcheck(
                 test=["CMD", "docker", "info"],
-                interval=5 * 100 * 1000000,
-                start_period=5 * 100 * 1000000,
+                interval=5 * 1_000 * 1_000_000,
+                start_period=5 * 1_000 * 1_000_000,
             ),
             environment={"DOCKER_TLS_CERTDIR": "/ssl"},
             volumes={

tests/wdio/package-lock.json

@@ -9,10 +9,10 @@
                 "@trivago/prettier-plugin-sort-imports": "^4.3.0",
                 "@typescript-eslint/eslint-plugin": "^6.12.0",
                 "@typescript-eslint/parser": "^6.12.0",
-                "@wdio/cli": "^8.23.3",
-                "@wdio/local-runner": "^8.23.3",
-                "@wdio/mocha-framework": "^8.23.1",
-                "@wdio/spec-reporter": "^8.23.1",
+                "@wdio/cli": "^8.24.1",
+                "@wdio/local-runner": "^8.24.1",
+                "@wdio/mocha-framework": "^8.24.0",
+                "@wdio/spec-reporter": "^8.24.0",
                 "eslint": "^8.54.0",
                 "eslint-config-google": "^0.14.0",
                 "eslint-plugin-sonarjs": "^0.23.0",
@@ -1141,18 +1141,18 @@
             "dev": true
         },
         "node_modules/@wdio/cli": {
-            "version": "8.23.3",
-            "resolved": "https://registry.npmjs.org/@wdio/cli/-/cli-8.23.3.tgz",
-            "integrity": "sha512-iD4s8994u/nR1hZBcVY6yWBKqcyfVbwOtbjEcPoti4KcH5hs2u0ec0CpAh841NDx24fimDuPSh1znOsbrzvELw==",
+            "version": "8.24.1",
+            "resolved": "https://registry.npmjs.org/@wdio/cli/-/cli-8.24.1.tgz",
+            "integrity": "sha512-3NB5LwPN5f1C8LPumlOHFfoCFfE7OmM0h7vN0/gzjcIlCXMrJ9igePyDQ6Af7u/jqfPk3SloBsG9DnxZBCcAxQ==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.1",
-                "@wdio/config": "8.23.1",
-                "@wdio/globals": "8.23.3",
+                "@wdio/config": "8.24.0",
+                "@wdio/globals": "8.24.1",
                 "@wdio/logger": "8.16.17",
                 "@wdio/protocols": "8.23.0",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "async-exit-hook": "^2.0.1",
                 "chalk": "^5.2.0",
                 "chokidar": "^3.5.3",
@@ -1168,7 +1168,7 @@
                 "lodash.union": "^4.6.0",
                 "read-pkg-up": "^10.0.0",
                 "recursive-readdir": "^2.2.3",
-                "webdriverio": "8.23.3",
+                "webdriverio": "8.24.1",
                 "yargs": "^17.7.2"
             },
             "bin": {
@@ -1191,14 +1191,14 @@
             }
         },
         "node_modules/@wdio/config": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/config/-/config-8.23.1.tgz",
-            "integrity": "sha512-MljMBvMr+QYoy4/FytFHWorFE3CrBdEWuroOaGzC/0gkVOcHRO4nOy2rKahdcPXJAuxFwJNqqHhBPj+4tWiz9w==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/config/-/config-8.24.0.tgz",
+            "integrity": "sha512-n92MPtRCLH763ssS6f/r7uWhnFkIg072nqZK+YnXTlTVIED9SdlMXlyjp9e/1sRmXUc7LbVPwvEVa35lsO0S8w==",
             "dev": true,
             "dependencies": {
                 "@wdio/logger": "8.16.17",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "decamelize": "^6.0.0",
                 "deepmerge-ts": "^5.0.0",
                 "glob": "^10.2.2",
@@ -1209,29 +1209,29 @@
             }
         },
         "node_modules/@wdio/globals": {
-            "version": "8.23.3",
-            "resolved": "https://registry.npmjs.org/@wdio/globals/-/globals-8.23.3.tgz",
-            "integrity": "sha512-pmsR82CvbQu2zonwsIblsvNv+wOL0hCm4eJmCzLEMQ9WBB36kO28im8B/itsh/XKzqvQ1aidhCUdSSHFwFwZsQ==",
+            "version": "8.24.1",
+            "resolved": "https://registry.npmjs.org/@wdio/globals/-/globals-8.24.1.tgz",
+            "integrity": "sha512-r5JmeAZd9BiVwUesj8vTRPHybyEMAN/gkscVaawCXEWAm/+7pzLARv6e8PMrAayO4MkeviGBDYCm6d4+nYFOUQ==",
             "dev": true,
             "engines": {
                 "node": "^16.13 || >=18"
             },
             "optionalDependencies": {
-                "expect-webdriverio": "^4.5.1",
-                "webdriverio": "8.23.3"
+                "expect-webdriverio": "^4.6.1",
+                "webdriverio": "8.24.1"
             }
         },
         "node_modules/@wdio/local-runner": {
-            "version": "8.23.3",
-            "resolved": "https://registry.npmjs.org/@wdio/local-runner/-/local-runner-8.23.3.tgz",
-            "integrity": "sha512-ELiD+zWR7PxvV+kIjnlIh2pUZ2dWSld7c6XeKff/e+YLnhc3AG7+/b3ml+JhLrtQqFt6X43V9IV9lfbNRiHWoQ==",
+            "version": "8.24.1",
+            "resolved": "https://registry.npmjs.org/@wdio/local-runner/-/local-runner-8.24.1.tgz",
+            "integrity": "sha512-/KdUVZn7aY5l1SBWd+xiTKhuO/eSAoFgNDLOArbL98ED2TYDzCZ3QCTlebbMckHA4J4ZZW/Rvox75a9Ne6yRzw==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0",
                 "@wdio/logger": "8.16.17",
                 "@wdio/repl": "8.23.1",
-                "@wdio/runner": "8.23.3",
-                "@wdio/types": "8.23.1",
+                "@wdio/runner": "8.24.1",
+                "@wdio/types": "8.24.0",
                 "async-exit-hook": "^2.0.1",
                 "split2": "^4.1.0",
                 "stream-buffers": "^3.0.2"
@@ -1268,16 +1268,16 @@
             }
         },
         "node_modules/@wdio/mocha-framework": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/mocha-framework/-/mocha-framework-8.23.1.tgz",
-            "integrity": "sha512-6PbALck8MuLnKhW5JGjCQrtfBivlX1fKqdin6clppVEI6LTqOxj5w8wmLhBbDV5oy68MzaSgc6hP141caWptuQ==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/mocha-framework/-/mocha-framework-8.24.0.tgz",
+            "integrity": "sha512-UqmvE5Z+KsD+u4mGuV5Y4GUDwrfmX1qIzD07idaLwidU/rHRy+Csn5mzyN38VIrIAuyMYdMGRyxEEieeu6a/4w==",
             "dev": true,
             "dependencies": {
                 "@types/mocha": "^10.0.0",
                 "@types/node": "^20.1.0",
                 "@wdio/logger": "8.16.17",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "mocha": "^10.0.0"
             },
             "engines": {
@@ -1303,14 +1303,14 @@
             }
         },
         "node_modules/@wdio/reporter": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/reporter/-/reporter-8.23.1.tgz",
-            "integrity": "sha512-MQKImrjRZdiJC1n0mw+OjgroX7SZdFApJTPijAT3mJ0KLeIf5PA+jnW3TZueMcWvG1NB7ZTAzL8BTWInOoZtgA==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/reporter/-/reporter-8.24.0.tgz",
+            "integrity": "sha512-yQhUwV5W1oDnVzr1pPBaOOCDwAE0Iyri9sAzIHb4pF1ezdUNTVe8ZfoWZSD4i7oC3riK8MlH8hXfGNCfrFrWlg==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0",
                 "@wdio/logger": "8.16.17",
-                "@wdio/types": "8.23.1",
+                "@wdio/types": "8.24.0",
                 "diff": "^5.0.0",
                 "object-inspect": "^1.12.0"
             },
@@ -1319,35 +1319,35 @@
             }
         },
         "node_modules/@wdio/runner": {
-            "version": "8.23.3",
-            "resolved": "https://registry.npmjs.org/@wdio/runner/-/runner-8.23.3.tgz",
-            "integrity": "sha512-vbSNfEvgMcDdWgBoRSo2GRiV8ccsh5QJYP8b5FfRoHBAvC4OZV6ZVx9Xzh7QsEfSaXXA9G/vaUGX0PPrS0gmgQ==",
+            "version": "8.24.1",
+            "resolved": "https://registry.npmjs.org/@wdio/runner/-/runner-8.24.1.tgz",
+            "integrity": "sha512-IfbLFUM+/cZoEJCLPjesekQ9FjuH/+OnJPzDIcxEv4RLShZX8mQKmiUw/HNMlQlcOkeAzfTObzaT+f8Tt2ZYlQ==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0",
-                "@wdio/config": "8.23.1",
-                "@wdio/globals": "8.23.3",
+                "@wdio/config": "8.24.0",
+                "@wdio/globals": "8.24.1",
                 "@wdio/logger": "8.16.17",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "deepmerge-ts": "^5.0.0",
-                "expect-webdriverio": "^4.5.1",
+                "expect-webdriverio": "^4.6.1",
                 "gaze": "^1.1.2",
-                "webdriver": "8.23.1",
-                "webdriverio": "8.23.3"
+                "webdriver": "8.24.0",
+                "webdriverio": "8.24.1"
             },
             "engines": {
                 "node": "^16.13 || >=18"
             }
         },
         "node_modules/@wdio/spec-reporter": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/spec-reporter/-/spec-reporter-8.23.1.tgz",
-            "integrity": "sha512-Igc/vsa58xbklwz8vJ1He3tyuxeEP9TQvlT23HizG1QziBvvU1b6V5qnM9BPiDvTg+n3SByJI0Ce0jyn4J2wYQ==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/spec-reporter/-/spec-reporter-8.24.0.tgz",
+            "integrity": "sha512-L65ua0+lGkmiiElHWE1zD3EnzZzyJli5tLmwYcahh4LwJ3hEOL7ut/GOZ8LTMih87T1q+KttQiJVmgnOEjMH5w==",
             "dev": true,
             "dependencies": {
-                "@wdio/reporter": "8.23.1",
-                "@wdio/types": "8.23.1",
+                "@wdio/reporter": "8.24.0",
+                "@wdio/types": "8.24.0",
                 "chalk": "^5.1.2",
                 "easy-table": "^1.2.0",
                 "pretty-ms": "^7.0.0"
@@ -1369,9 +1369,9 @@
             }
         },
         "node_modules/@wdio/types": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/types/-/types-8.23.1.tgz",
-            "integrity": "sha512-ym3tWSUGvmKwQ9vNPQfcKvJwGNK/Fh3e5WloNj3zoaUTKgD0aJeFQ0+Dz6KGlNowA0j5VkcqTTXo+UZ3l4Cx9A==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/types/-/types-8.24.0.tgz",
+            "integrity": "sha512-FXbJnQCS1b39RKqBlW9HTNEP4vukxjFc+GiwvPS+XPtY+3Vn7eOyBv3X3CiH1K7C+tzelqlio/HgP68pV5cXsQ==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0"
@@ -1381,14 +1381,14 @@
             }
         },
         "node_modules/@wdio/utils": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/@wdio/utils/-/utils-8.23.1.tgz",
-            "integrity": "sha512-VA47MOpt+7svHj3W9r+DUl3t73tJbjF7+ZXL0Lk7QLe79xevd+mPk+YmuTEepn+0MljJWAuqRCEKFG/HK77RNw==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/@wdio/utils/-/utils-8.24.0.tgz",
+            "integrity": "sha512-m0qsWx2U5ZBTS0vzg1gTBp9mTrcLQlDrOBVR28LJ93a/e0bj+4aQ4c5U2y9gUzV+lKH0wUJSZTLnhebQwapURQ==",
             "dev": true,
             "dependencies": {
                 "@puppeteer/browsers": "^1.6.0",
                 "@wdio/logger": "8.16.17",
-                "@wdio/types": "8.23.1",
+                "@wdio/types": "8.24.0",
                 "decamelize": "^6.0.0",
                 "deepmerge-ts": "^5.1.0",
                 "edgedriver": "^5.3.5",
@@ -3278,9 +3278,9 @@
             }
         },
         "node_modules/expect-webdriverio": {
-            "version": "4.5.1",
-            "resolved": "https://registry.npmjs.org/expect-webdriverio/-/expect-webdriverio-4.5.1.tgz",
-            "integrity": "sha512-fwcMpPV/+e0bS+F7+bC1UoQsZYjJTcbA1XhU4VVB2pEZDhNmeuaPrCanA0tLVP8nDya75oegXK7LgPzP3zZR9w==",
+            "version": "4.6.1",
+            "resolved": "https://registry.npmjs.org/expect-webdriverio/-/expect-webdriverio-4.6.1.tgz",
+            "integrity": "sha512-w6ee91kN3BoxNGVKQheAqFpRGMehdDg7kDiErEk/oM7tbd/WUT4R4v9KYOUtjiaUFHWWCRW2FtcOOjcd0+1pvQ==",
             "dev": true,
             "dependencies": {
                 "expect": "^29.7.0",
@@ -3291,8 +3291,9 @@
                 "node": ">=16 || >=18 || >=20"
             },
             "optionalDependencies": {
-                "@wdio/globals": "^8.22.1",
-                "webdriverio": "^8.22.1"
+                "@wdio/globals": "^8.23.1",
+                "@wdio/logger": "^8.16.17",
+                "webdriverio": "^8.23.1"
             }
         },
         "node_modules/external-editor": {
@@ -8615,18 +8616,18 @@
             }
         },
         "node_modules/webdriver": {
-            "version": "8.23.1",
-            "resolved": "https://registry.npmjs.org/webdriver/-/webdriver-8.23.1.tgz",
-            "integrity": "sha512-0PLN6cqP5cSorZBU2OBk2XKhxKpWWKzvClHBiGCqZIuofZ3kPTq7uYFapej0c4xFmKXHEiLIN7Qkt4H3gWTs8g==",
+            "version": "8.24.0",
+            "resolved": "https://registry.npmjs.org/webdriver/-/webdriver-8.24.0.tgz",
+            "integrity": "sha512-zI1zw4lbP2cg1NPikIaUBHQU3+xdvEEBi0Jrydhtp3VVeIEqJWwUFxG/P9LwJpiQ0PYMb/5cxoQrSRhrEXyXHQ==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0",
                 "@types/ws": "^8.5.3",
-                "@wdio/config": "8.23.1",
+                "@wdio/config": "8.24.0",
                 "@wdio/logger": "8.16.17",
                 "@wdio/protocols": "8.23.0",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "deepmerge-ts": "^5.1.0",
                 "got": "^ 12.6.1",
                 "ky": "^0.33.0",
@@ -8674,18 +8675,18 @@
             }
         },
         "node_modules/webdriverio": {
-            "version": "8.23.3",
-            "resolved": "https://registry.npmjs.org/webdriverio/-/webdriverio-8.23.3.tgz",
-            "integrity": "sha512-kH+GAQrC6GfrF0LDX5odqn3CVvVrdIeTAYsQtji9tmb2YTJMIx57GNL1NIXhV4MFtalcEc9UjhZCwekLMemEOg==",
+            "version": "8.24.1",
+            "resolved": "https://registry.npmjs.org/webdriverio/-/webdriverio-8.24.1.tgz",
+            "integrity": "sha512-NMu5Y0EFjx7GK4K8uDDi14q8IdHdSQiqzJoyGjuzGy8mj5c04Ta1hoLG5KPag5LzIQNOtJmqwbTFL5PLqragOg==",
             "dev": true,
             "dependencies": {
                 "@types/node": "^20.1.0",
-                "@wdio/config": "8.23.1",
+                "@wdio/config": "8.24.0",
                 "@wdio/logger": "8.16.17",
                 "@wdio/protocols": "8.23.0",
                 "@wdio/repl": "8.23.1",
-                "@wdio/types": "8.23.1",
-                "@wdio/utils": "8.23.1",
+                "@wdio/types": "8.24.0",
+                "@wdio/utils": "8.24.0",
                 "archiver": "^6.0.0",
                 "aria-query": "^5.0.0",
                 "css-shorthand-properties": "^1.1.1",
@@ -8702,7 +8703,7 @@
                 "resq": "^1.9.1",
                 "rgb2hex": "0.2.5",
                 "serialize-error": "^11.0.1",
-                "webdriver": "8.23.1"
+                "webdriver": "8.24.0"
             },
             "engines": {
                 "node": "^16.13 || >=18"

tests/wdio/package.json

@@ -6,10 +6,10 @@
         "@trivago/prettier-plugin-sort-imports": "^4.3.0",
         "@typescript-eslint/eslint-plugin": "^6.12.0",
         "@typescript-eslint/parser": "^6.12.0",
-        "@wdio/cli": "^8.23.3",
-        "@wdio/local-runner": "^8.23.3",
-        "@wdio/mocha-framework": "^8.23.1",
-        "@wdio/spec-reporter": "^8.23.1",
+        "@wdio/cli": "^8.24.1",
+        "@wdio/local-runner": "^8.24.1",
+        "@wdio/mocha-framework": "^8.24.0",
+        "@wdio/spec-reporter": "^8.24.0",
         "eslint": "^8.54.0",
         "eslint-config-google": "^0.14.0",
         "eslint-plugin-sonarjs": "^0.23.0",

web/package-lock.json

@@ -15,18 +15,17 @@
                 "@codemirror/lang-xml": "^6.0.2",
                 "@codemirror/legacy-modes": "^6.3.3",
                 "@codemirror/theme-one-dark": "^6.1.2",
-                "@esbuild/linux-arm64": "^0.19.7",
                 "@formatjs/intl-listformat": "^7.5.3",
                 "@fortawesome/fontawesome-free": "^6.4.2",
-                "@goauthentik/api": "^2023.10.3-1700268969",
+                "@goauthentik/api": "^2023.10.4-1700591367",
                 "@lit-labs/context": "^0.4.0",
                 "@lit-labs/task": "^3.1.0",
                 "@lit/localize": "^0.11.4",
                 "@open-wc/lit-helpers": "^0.6.0",
                 "@patternfly/elements": "^2.4.0",
                 "@patternfly/patternfly": "^4.224.2",
-                "@sentry/browser": "^7.81.0",
-                "@sentry/tracing": "^7.81.0",
+                "@sentry/browser": "^7.81.1",
+                "@sentry/tracing": "^7.81.1",
                 "@webcomponents/webcomponentsjs": "^2.8.0",
                 "base64-js": "^1.5.1",
                 "chart.js": "^4.4.0",
@@ -69,7 +68,7 @@
                 "@storybook/web-components-vite": "^7.5.3",
                 "@trivago/prettier-plugin-sort-imports": "^4.3.0",
                 "@types/chart.js": "^2.9.41",
-                "@types/codemirror": "5.60.14",
+                "@types/codemirror": "5.60.15",
                 "@types/grecaptcha": "^3.0.7",
                 "@typescript-eslint/eslint-plugin": "^6.12.0",
                 "@typescript-eslint/parser": "^6.12.0",
@@ -86,10 +85,10 @@
                 "npm-run-all": "^4.1.5",
                 "prettier": "^3.1.0",
                 "pseudolocale": "^2.0.0",
-                "pyright": "^1.1.336",
+                "pyright": "^1.1.337",
                 "react": "^18.2.0",
                 "react-dom": "^18.2.0",
-                "rollup": "^4.5.0",
+                "rollup": "^4.5.1",
                 "rollup-plugin-copy": "^3.5.0",
                 "rollup-plugin-cssimport": "^1.0.3",
                 "rollup-plugin-postcss-lit": "^2.1.0",
@@ -2924,9 +2923,9 @@
             }
         },
         "node_modules/@goauthentik/api": {
-            "version": "2023.10.3-1700268969",
-            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2023.10.3-1700268969.tgz",
-            "integrity": "sha512-EwkNfFL8sgPzDRHQ+IlkYyFxlN9U79x3OaRgVR1GuEyKF2XXNm+ftdpqSmTSYeIrObEdOgvKItqKBGw5EYZXsg=="
+            "version": "2023.10.4-1700591367",
+            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2023.10.4-1700591367.tgz",
+            "integrity": "sha512-ljC/SHH6ZgGC2qjvuA3gley8sRz9wVzr5FgRGKeqd1mi6G6TfnFYeA7tuuqgQc6WGN2MVMG17FnBraTI77Rl/A=="
         },
         "node_modules/@hcaptcha/types": {
             "version": "1.0.3",
@@ -4593,9 +4592,9 @@
             }
         },
         "node_modules/@rollup/rollup-android-arm-eabi": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.5.0.tgz",
-            "integrity": "sha512-OINaBGY+Wc++U0rdr7BLuFClxcoWaVW3vQYqmQq6B3bqQ/2olkaoz+K8+af/Mmka/C2yN5j+L9scBkv4BtKsDA==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.5.1.tgz",
+            "integrity": "sha512-YaN43wTyEBaMqLDYeze+gQ4ZrW5RbTEGtT5o1GVDkhpdNcsLTnLRcLccvwy3E9wiDKWg9RIhuoy3JQKDRBfaZA==",
             "cpu": [
                 "arm"
             ],
@@ -4606,9 +4605,9 @@
             ]
         },
         "node_modules/@rollup/rollup-android-arm64": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.5.0.tgz",
-            "integrity": "sha512-UdMf1pOQc4ZmUA/NTmKhgJTBimbSKnhPS2zJqucqFyBRFPnPDtwA8MzrGNTjDeQbIAWfpJVAlxejw+/lQyBK/w==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.5.1.tgz",
+            "integrity": "sha512-n1bX+LCGlQVuPlCofO0zOKe1b2XkFozAVRoczT+yxWZPGnkEAKTTYVOGZz8N4sKuBnKMxDbfhUsB1uwYdup/sw==",
             "cpu": [
                 "arm64"
             ],
@@ -4619,9 +4618,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-arm64": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.5.0.tgz",
-            "integrity": "sha512-L0/CA5p/idVKI+c9PcAPGorH6CwXn6+J0Ys7Gg1axCbTPgI8MeMlhA6fLM9fK+ssFhqogMHFC8HDvZuetOii7w==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.5.1.tgz",
+            "integrity": "sha512-QqJBumdvfBqBBmyGHlKxje+iowZwrHna7pokj/Go3dV1PJekSKfmjKrjKQ/e6ESTGhkfPNLq3VXdYLAc+UtAQw==",
             "cpu": [
                 "arm64"
             ],
@@ -4632,9 +4631,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-x64": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.5.0.tgz",
-            "integrity": "sha512-QZCbVqU26mNlLn8zi/XDDquNmvcr4ON5FYAHQQsyhrHx8q+sQi/6xduoznYXwk/KmKIXG5dLfR0CvY+NAWpFYQ==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.5.1.tgz",
+            "integrity": "sha512-RrkDNkR/P5AEQSPkxQPmd2ri8WTjSl0RYmuFOiEABkEY/FSg0a4riihWQGKDJ4LnV9gigWZlTMx2DtFGzUrYQw==",
             "cpu": [
                 "x64"
             ],
@@ -4645,9 +4644,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.5.0.tgz",
-            "integrity": "sha512-VpSQ+xm93AeV33QbYslgf44wc5eJGYfYitlQzAi3OObu9iwrGXEnmu5S3ilkqE3Pr/FkgOiJKV/2p0ewf4Hrtg==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.5.1.tgz",
+            "integrity": "sha512-ZFPxvUZmE+fkB/8D9y/SWl/XaDzNSaxd1TJUSE27XAKlRpQ2VNce/86bGd9mEUgL3qrvjJ9XTGwoX0BrJkYK/A==",
             "cpu": [
                 "arm"
             ],
@@ -4658,9 +4657,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-gnu": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.5.0.tgz",
-            "integrity": "sha512-OrEyIfpxSsMal44JpEVx9AEcGpdBQG1ZuWISAanaQTSMeStBW+oHWwOkoqR54bw3x8heP8gBOyoJiGg+fLY8qQ==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.5.1.tgz",
+            "integrity": "sha512-FEuAjzVIld5WVhu+M2OewLmjmbXWd3q7Zcx+Rwy4QObQCqfblriDMMS7p7+pwgjZoo9BLkP3wa9uglQXzsB9ww==",
             "cpu": [
                 "arm64"
             ],
@@ -4671,9 +4670,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-musl": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.5.0.tgz",
-            "integrity": "sha512-1H7wBbQuE6igQdxMSTjtFfD+DGAudcYWhp106z/9zBA8OQhsJRnemO4XGavdzHpGhRtRxbgmUGdO3YQgrWf2RA==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.5.1.tgz",
+            "integrity": "sha512-f5Gs8WQixqGRtI0Iq/cMqvFYmgFzMinuJO24KRfnv7Ohi/HQclwrBCYkzQu1XfLEEt3DZyvveq9HWo4bLJf1Lw==",
             "cpu": [
                 "arm64"
             ],
@@ -4684,9 +4683,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-gnu": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.5.0.tgz",
-            "integrity": "sha512-FVyFI13tXw5aE65sZdBpNjPVIi4Q5mARnL/39UIkxvSgRAIqCo5sCpCELk0JtXHGee2owZz5aNLbWNfBHzr71Q==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.5.1.tgz",
+            "integrity": "sha512-CWPkPGrFfN2vj3mw+S7A/4ZaU3rTV7AkXUr08W9lNP+UzOvKLVf34tWCqrKrfwQ0NTk5GFqUr2XGpeR2p6R4gw==",
             "cpu": [
                 "x64"
             ],
@@ -4697,9 +4696,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-musl": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.5.0.tgz",
-            "integrity": "sha512-eBPYl2sLpH/o8qbSz6vPwWlDyThnQjJfcDOGFbNjmjb44XKC1F5dQfakOsADRVrXCNzM6ZsSIPDG5dc6HHLNFg==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.5.1.tgz",
+            "integrity": "sha512-ZRETMFA0uVukUC9u31Ed1nx++29073goCxZtmZARwk5aF/ltuENaeTtRVsSQzFlzdd4J6L3qUm+EW8cbGt0CKQ==",
             "cpu": [
                 "x64"
             ],
@@ -4710,9 +4709,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-arm64-msvc": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.5.0.tgz",
-            "integrity": "sha512-xaOHIfLOZypoQ5U2I6rEaugS4IYtTgP030xzvrBf5js7p9WI9wik07iHmsKaej8Z83ZDxN5GyypfoyKV5O5TJA==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.5.1.tgz",
+            "integrity": "sha512-ihqfNJNb2XtoZMSCPeoo0cYMgU04ksyFIoOw5S0JUVbOhafLot+KD82vpKXOurE2+9o/awrqIxku9MRR9hozHQ==",
             "cpu": [
                 "arm64"
             ],
@@ -4723,9 +4722,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-ia32-msvc": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.5.0.tgz",
-            "integrity": "sha512-Al6quztQUrHwcOoU2TuFblUQ5L+/AmPBXFR6dUvyo4nRj2yQRK0WIUaGMF/uwKulvRcXkpHe3k9A8Vf93VDktA==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.5.1.tgz",
+            "integrity": "sha512-zK9MRpC8946lQ9ypFn4gLpdwr5a01aQ/odiIJeL9EbgZDMgbZjjT/XzTqJvDfTmnE1kHdbG20sAeNlpc91/wbg==",
             "cpu": [
                 "ia32"
             ],
@@ -4736,9 +4735,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-x64-msvc": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.5.0.tgz",
-            "integrity": "sha512-8kdW+brNhI/NzJ4fxDufuJUjepzINqJKLGHuxyAtpPG9bMbn8P5mtaCcbOm0EzLJ+atg+kF9dwg8jpclkVqx5w==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.5.1.tgz",
+            "integrity": "sha512-5I3Nz4Sb9TYOtkRwlH0ow+BhMH2vnh38tZ4J4mggE48M/YyJyp/0sPSxhw1UeS1+oBgQ8q7maFtSeKpeRJu41Q==",
             "cpu": [
                 "x64"
             ],
@@ -4749,84 +4748,84 @@
             ]
         },
         "node_modules/@sentry-internal/tracing": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry-internal/tracing/-/tracing-7.81.0.tgz",
-            "integrity": "sha512-mc3tdOEvAE6kaCvT3BpMwCgfTT2yfXjWpC7g+3N8U/yuQEmQSCDZA/ut7EkzU0DyhG3t8HzT0c+CAG3HtilEAQ==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry-internal/tracing/-/tracing-7.81.1.tgz",
+            "integrity": "sha512-E5xm27xrLXL10knH2EWDQsQYh5nb4SxxZzJ3sJwDGG9XGKzBdlp20UUhKqx00wixooVX9uCj3e4Jg8SvNB1hKg==",
             "dependencies": {
-                "@sentry/core": "7.81.0",
-                "@sentry/types": "7.81.0",
-                "@sentry/utils": "7.81.0"
+                "@sentry/core": "7.81.1",
+                "@sentry/types": "7.81.1",
+                "@sentry/utils": "7.81.1"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/browser": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-7.81.0.tgz",
-            "integrity": "sha512-/6xsdSeZspq7+LARg6Gt0KMUQRf6nZcuA20X9Y28uJqyZFYoXBnxG3+JJcxycxleEJRci20gjBwOtM157anUJA==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-7.81.1.tgz",
+            "integrity": "sha512-DNtS7bZEnFPKVoGazKs5wHoWC0FwsOFOOMNeDvEfouUqKKbjO7+RDHbr7H6Bo83zX4qmZWRBf8V+3n3YPIiJFw==",
             "dependencies": {
-                "@sentry-internal/tracing": "7.81.0",
-                "@sentry/core": "7.81.0",
-                "@sentry/replay": "7.81.0",
-                "@sentry/types": "7.81.0",
-                "@sentry/utils": "7.81.0"
+                "@sentry-internal/tracing": "7.81.1",
+                "@sentry/core": "7.81.1",
+                "@sentry/replay": "7.81.1",
+                "@sentry/types": "7.81.1",
+                "@sentry/utils": "7.81.1"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/core": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-7.81.0.tgz",
-            "integrity": "sha512-FCAKlqo9Z6fku69bkahw1AN+eBfAgRgOL1RpBLZgyG7YBW12vtSkHb5SDvZZTkm541Fo3hhepUTLtX0qmpA4yw==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-7.81.1.tgz",
+            "integrity": "sha512-tU37yAmckOGCw/moWKSwekSCWWJP15O6luIq+u7wal22hE88F3Vc5Avo8SeF3upnPR+4ejaOFH+BJTr6bgrs6Q==",
             "dependencies": {
-                "@sentry/types": "7.81.0",
-                "@sentry/utils": "7.81.0"
+                "@sentry/types": "7.81.1",
+                "@sentry/utils": "7.81.1"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/replay": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-7.81.0.tgz",
-            "integrity": "sha512-kJRWjEzby1015Ds5TTNNVe9EkzfwPfPcM06ycba+DIXPJ2LiaSXvH3OU0s2HEJ9Vo/+jcpFMlODXFF/wrYIn9w==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-7.81.1.tgz",
+            "integrity": "sha512-4ueT0C4bYjngN/9p0fEYH10dTMLovHyk9HxJ6zSTgePvGVexhg+cSEHXisoBDwHeRZVnbIvsVM0NA7rmEDXJJw==",
             "dependencies": {
-                "@sentry-internal/tracing": "7.81.0",
-                "@sentry/core": "7.81.0",
-                "@sentry/types": "7.81.0",
-                "@sentry/utils": "7.81.0"
+                "@sentry-internal/tracing": "7.81.1",
+                "@sentry/core": "7.81.1",
+                "@sentry/types": "7.81.1",
+                "@sentry/utils": "7.81.1"
             },
             "engines": {
                 "node": ">=12"
             }
         },
         "node_modules/@sentry/tracing": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-7.81.0.tgz",
-            "integrity": "sha512-3QRusk7AZzbNWuPalqSCQCPAEJ9L167txYUkL5x3Y+YK4gZt3/bNovoVNDaQ06XmIYL9ENXVw1hbdk0DIgirpw==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-7.81.1.tgz",
+            "integrity": "sha512-of9WMu0XgEBl9onTEk8SMaxj4BUadaUvHH96T1OpRMjdyuCM/3u2mjCkh3ekINr3Fu/uT2kJ/kO3goUxfcdXIQ==",
             "dependencies": {
-                "@sentry-internal/tracing": "7.81.0"
+                "@sentry-internal/tracing": "7.81.1"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/types": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-7.81.0.tgz",
-            "integrity": "sha512-rbYNYSSrrnwNndC7S+eVT84GRLEyCZNh9oXUQqzgSD6ngXCZ0xFJW6si75uv/XQBWIw4rkj9xfRcy8DU0Tj4fg==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-7.81.1.tgz",
+            "integrity": "sha512-dvJvGyctiaPMIQqa46k56Re5IODWMDxiHJ1UjBs/WYDLrmWFPGrEbyJ8w8CYLhYA+7qqrCyIZmHbWSTRIxstHw==",
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/utils": {
-            "version": "7.81.0",
-            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-7.81.0.tgz",
-            "integrity": "sha512-yC9IvfeVbG4dygi4b+iUUMHp9xeHJfCn6XLbqjJVfq3xjAzBGHgfrpw6fYPNyTljXKb6CTiSXSqaNaQJE4CkPA==",
+            "version": "7.81.1",
+            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-7.81.1.tgz",
+            "integrity": "sha512-gq+MDXIirHKxNZ+c9/lVvCXd6y2zaZANujwlFggRH2u9SRiPaIXVilLpvMm4uJqmqBMEcY81ArujExtHvkbCqg==",
             "dependencies": {
-                "@sentry/types": "7.81.0"
+                "@sentry/types": "7.81.1"
             },
             "engines": {
                 "node": ">=8"
@@ -10130,9 +10129,9 @@
             }
         },
         "node_modules/@types/codemirror": {
-            "version": "5.60.14",
-            "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-5.60.14.tgz",
-            "integrity": "sha512-Gs+9yVSe7ceqhY7SJ6YUpU20aVnj/E2wjYHPWyntSD2ayr204xgPtVWyEp+8ARZjteEYVLJ/rVnHtdSCPbfYFQ==",
+            "version": "5.60.15",
+            "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-5.60.15.tgz",
+            "integrity": "sha512-dTOvwEQ+ouKJ/rE9LT1Ue2hmP6H1mZv5+CCnNWu2qtiOe2LQa9lCprEY20HxiDmV/Bxh+dXjywmy5aKvoGjULA==",
             "dev": true,
             "dependencies": {
                 "@types/tern": "*"
@@ -18469,9 +18468,9 @@
             }
         },
         "node_modules/pyright": {
-            "version": "1.1.336",
-            "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.336.tgz",
-            "integrity": "sha512-PE/ArjnfS5dKon05zAX2eMzSQmu4ftCITzLqKgFKuwLIRnKJ+l4QGwkCKtYvWoXKm1fWr+TjqYpdRejrYkolyg==",
+            "version": "1.1.337",
+            "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.337.tgz",
+            "integrity": "sha512-iZcID/OX5rjiToKCb3DShygOC21Zx8GvSwei+ApyTfK2C2xdRWyV+yJCrUUF75/qVkTZy8ZCDwQc4aYDqD8Scg==",
             "dev": true,
             "bin": {
                 "pyright": "index.js",
@@ -19171,9 +19170,9 @@
             "integrity": "sha512-IXgzBWvWQwE6PrDI05OvmXUIruQTcoMDzRsOd5CDvHCVLcLHMTSYvOK5Cm46kWqlV3yAbuSpBZdJ5oP5OUoStg=="
         },
         "node_modules/rollup": {
-            "version": "4.5.0",
-            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.5.0.tgz",
-            "integrity": "sha512-41xsWhzxqjMDASCxH5ibw1mXk+3c4TNI2UjKbLxe6iEzrSQnqOzmmK8/3mufCPbzHNJ2e04Fc1ddI35hHy+8zg==",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.5.1.tgz",
+            "integrity": "sha512-0EQribZoPKpb5z1NW/QYm3XSR//Xr8BeEXU49Lc/mQmpmVVG5jPUVrpc2iptup/0WMrY9mzas0fxH+TjYvG2CA==",
             "dev": true,
             "bin": {
                 "rollup": "dist/bin/rollup"
@@ -19183,18 +19182,18 @@
                 "npm": ">=8.0.0"
             },
             "optionalDependencies": {
-                "@rollup/rollup-android-arm-eabi": "4.5.0",
-                "@rollup/rollup-android-arm64": "4.5.0",
-                "@rollup/rollup-darwin-arm64": "4.5.0",
-                "@rollup/rollup-darwin-x64": "4.5.0",
-                "@rollup/rollup-linux-arm-gnueabihf": "4.5.0",
-                "@rollup/rollup-linux-arm64-gnu": "4.5.0",
-                "@rollup/rollup-linux-arm64-musl": "4.5.0",
-                "@rollup/rollup-linux-x64-gnu": "4.5.0",
-                "@rollup/rollup-linux-x64-musl": "4.5.0",
-                "@rollup/rollup-win32-arm64-msvc": "4.5.0",
-                "@rollup/rollup-win32-ia32-msvc": "4.5.0",
-                "@rollup/rollup-win32-x64-msvc": "4.5.0",
+                "@rollup/rollup-android-arm-eabi": "4.5.1",
+                "@rollup/rollup-android-arm64": "4.5.1",
+                "@rollup/rollup-darwin-arm64": "4.5.1",
+                "@rollup/rollup-darwin-x64": "4.5.1",
+                "@rollup/rollup-linux-arm-gnueabihf": "4.5.1",
+                "@rollup/rollup-linux-arm64-gnu": "4.5.1",
+                "@rollup/rollup-linux-arm64-musl": "4.5.1",
+                "@rollup/rollup-linux-x64-gnu": "4.5.1",
+                "@rollup/rollup-linux-x64-musl": "4.5.1",
+                "@rollup/rollup-win32-arm64-msvc": "4.5.1",
+                "@rollup/rollup-win32-ia32-msvc": "4.5.1",
+                "@rollup/rollup-win32-x64-msvc": "4.5.1",
                 "fsevents": "~2.3.2"
             }
         },

web/package.json

@@ -38,15 +38,15 @@
         "@codemirror/theme-one-dark": "^6.1.2",
         "@formatjs/intl-listformat": "^7.5.3",
         "@fortawesome/fontawesome-free": "^6.4.2",
-        "@goauthentik/api": "^2023.10.3-1700268969",
+        "@goauthentik/api": "^2023.10.4-1700591367",
         "@lit-labs/context": "^0.4.0",
         "@lit-labs/task": "^3.1.0",
         "@lit/localize": "^0.11.4",
         "@open-wc/lit-helpers": "^0.6.0",
         "@patternfly/elements": "^2.4.0",
         "@patternfly/patternfly": "^4.224.2",
-        "@sentry/browser": "^7.81.0",
-        "@sentry/tracing": "^7.81.0",
+        "@sentry/browser": "^7.81.1",
+        "@sentry/tracing": "^7.81.1",
         "@webcomponents/webcomponentsjs": "^2.8.0",
         "base64-js": "^1.5.1",
         "chart.js": "^4.4.0",
@@ -89,7 +89,7 @@
         "@storybook/web-components-vite": "^7.5.3",
         "@trivago/prettier-plugin-sort-imports": "^4.3.0",
         "@types/chart.js": "^2.9.41",
-        "@types/codemirror": "5.60.14",
+        "@types/codemirror": "5.60.15",
         "@types/grecaptcha": "^3.0.7",
         "@typescript-eslint/eslint-plugin": "^6.12.0",
         "@typescript-eslint/parser": "^6.12.0",
@@ -106,10 +106,10 @@
         "npm-run-all": "^4.1.5",
         "prettier": "^3.1.0",
         "pseudolocale": "^2.0.0",
-        "pyright": "^1.1.336",
+        "pyright": "^1.1.337",
         "react": "^18.2.0",
         "react-dom": "^18.2.0",
-        "rollup": "^4.5.0",
+        "rollup": "^4.5.1",
         "rollup-plugin-copy": "^3.5.0",
         "rollup-plugin-cssimport": "^1.0.3",
         "rollup-plugin-postcss-lit": "^2.1.0",

web/src/admin/groups/GroupViewPage.ts

@@ -118,7 +118,7 @@ export class GroupViewPage extends AKElement {
                                         <div class="pf-c-description-list__text">
                                             <ak-status-label
                                                 type="warning"
-                                                ?good${this.group.isSuperuser}
+                                                ?good=${this.group.isSuperuser}
                                             ></ak-status-label>
                                         </div>
                                     </dd>

web/src/common/constants.ts

@@ -3,7 +3,7 @@ export const SUCCESS_CLASS = "pf-m-success";
 export const ERROR_CLASS = "pf-m-danger";
 export const PROGRESS_CLASS = "pf-m-in-progress";
 export const CURRENT_CLASS = "pf-m-current";
-export const VERSION = "2023.10.3";
+export const VERSION = "2023.10.4";
 export const TITLE_DEFAULT = "authentik";
 export const ROUTE_SEPARATOR = ";";
 

web/xliff/fr.xlf

@@ -7953,30 +7953,39 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 </trans-unit>
 <trans-unit id="sd94e99af8b41ff54">
   <source>0: Too guessable: risky password. (guesses &amp;lt; 10^3)</source>
+  <target>0: Trop prévisible: mot de passe risqué. (essais &amp;lt; 10^3)</target>
 </trans-unit>
 <trans-unit id="sc926385d1a624c3a">
   <source>1: Very guessable: protection from throttled online attacks. (guesses &amp;lt; 10^6)</source>
+  <target>1: Très prévisible: protection contre les attaques en ligne limitées. (essais &amp;lt; 10^6)</target>
 </trans-unit>
 <trans-unit id="s8aae61c41319602c">
   <source>2: Somewhat guessable: protection from unthrottled online attacks. (guesses &amp;lt; 10^8)</source>
+  <target>2: Quelque peu prévisible: protection contre les attaques en ligne non limitées. (essais &amp;lt; 10^8)</target>
 </trans-unit>
 <trans-unit id="sc1f4b57e722a89d6">
   <source>3: Safely unguessable: moderate protection from offline slow-hash scenario. (guesses &amp;lt; 10^10)</source>
+  <target>3: Sûrement imprévisible: protection modérée contre les attaques de hash-lent hors ligne. (essais &amp;lt; 10^10)</target>
 </trans-unit>
 <trans-unit id="sd47f3d3c9741343d">
   <source>4: Very unguessable: strong protection from offline slow-hash scenario. (guesses &amp;gt;= 10^10)</source>
+  <target>4: Très imprévisible: forte protection control les attaques de hash-lent hors ligne. (essais &amp;gt;= 10^10)</target>
 </trans-unit>
 <trans-unit id="s3d2a8b86a4f5a810">
   <source>Successfully created user and added to group <x id="0" equiv-text="${this.group.name}"/></source>
+  <target>Utilisateur créé et ajouté au groupe <x id="0" equiv-text="${this.group.name}"/> avec succès</target>
 </trans-unit>
 <trans-unit id="s824e0943a7104668">
   <source>This user will be added to the group "<x id="0" equiv-text="${this.targetGroup.name}"/>".</source>
+  <target>Cet utilisateur sera ajouté au groupe &amp;quot;<x id="0" equiv-text="${this.targetGroup.name}"/>&amp;quot;.</target>
 </trans-unit>
 <trans-unit id="s62e7f6ed7d9cb3ca">
   <source>Pretend user exists</source>
+  <target>Faire comme si l'utilisateur existe</target>
 </trans-unit>
 <trans-unit id="s52bdc80690a9a8dc">
   <source>When enabled, the stage will always accept the given user identifier and continue.</source>
+  <target>Lorsqu'activé, l'étape acceptera toujours l'identifiant utilisateur donné et continuera.</target>
 </trans-unit>
     </body>
   </file>

website/blog/2023-11-22-building-an-oss-security-stack/item.md

@@ -0,0 +1,152 @@
+---
+title: Building an OSS security stack with Loki, Wazuh, and CodeQL to save $100k
+description: “You don’t have to spend a lot developing a good security posture from the beginning. Here’s how we built Authentik Security’s stack with mostly free and open source tools.”
+slug: 2023-11-22-how-we-saved-over-100k
+authors:
+    - name: authentik Security Team
+      url: https://goauthentik.io
+      image_url: ./icon.png
+tags:
+    - authentik
+    - FOSS
+    - security budget
+    - security stack
+    - Red Team
+    - Blue Team
+    - SBOM
+    - hardening
+    - penetration testing
+    - monitoring
+    - SSO
+    - insider threats
+    - certifications
+    - security
+    - identity provider
+    - authentication
+hide_table_of_contents: false
+---
+
+> **_authentik is an open source Identity Provider that unifies your identity needs into a single platform, replacing Okta, Active Directory, and auth0. Authentik Security is a [public benefit company](https://github.com/OpenCoreVentures/ocv-public-benefit-company/blob/main/ocv-public-benefit-company-charter.md) building on top of the open source project._**
+
+---
+
+There was an article recently about nearly 20 well-known startups’ first 10 hires—security engineers didn’t feature at all. Our third hire at Authentik Security was a security engineer so we might be biased, but even startups without the resources for a full-time security hire should have someone on your founding team wearing the security hat, so you get started on the right foot.
+
+As security departments are cost centers (not revenue generators) it’s not unusual for startups to take a tightwad mentality with security. The good news is that you don’t need a big budget to have a good security posture. There are plenty of free and open source tools at your disposal, and a lot of what makes good security is actually organizational practices—many of which don’t cost a thing to implement.
+
+> We estimate that using mostly non-commercial security tools saves us approximately $100,000 annually, and the end-result is a robust stack of security tools and processes.
+
+Here’s how we built out our security stack and processes using mostly free and open source software (FOSS).
+
+<!--truncate-->
+
+## Blue Team efforts
+
+Security efforts can mostly be grouped into two categories: Blue Team and Red Team. Your Blue Team is defensive, meaning guarding against potential attacks. The Red Team is offensive, actively seeking for weaknesses and potential vulnerabilities. Startups with scant resources should focus on Blue activities first.
+
+### Visibility: Do you know what is happening in your environment?
+
+The first step is to get eyes into your environment through SIEM (Security Information Event Monitoring). A security person’s worst nightmare is things happening without them knowing about it. You can’t react to an attack that you don’t know is happening! You need a tool that monitors your team’s device logs and flags suspicious activity.
+
+We’re an all-remote and globally distributed team, which makes monitoring both harder and more important; team members can log in from anywhere, at any time, and we don’t have a central headquarters to house a secure server for backups, for example. We needed something that’s available worldwide and compatible with our endpoint device architectures, cloud infrastructure, and SaaS solutions.
+
+We settled on [Wazuh](https://wazuh.com/platform/siem/), which has been around for a long time, is open source and well supported. We’ll acknowledge that it is a bit harder to deploy than some other, proprietary solutions. This can often be the case with FOSS, and it’s a tradeoff you have to accept when you’re not paying for something.
+
+If you don’t want to use something that’s tricky to stand up, you can of course pay for a tool with which you’ll get customer support and all those good things. Your first priority should be picking something that fits your company’s needs.
+
+We also use Grafana’s [Loki](https://grafana.com/oss/loki/) (which is free for self-hosted environments) for certain types of log aggregation. Logging is still a staple for security awareness, so do your research for the best logging and analysis solution.
+
+The general idea behind having good visibility is to gather as many data points as possible while minimizing ongoing maintenance overhead. Make no mistake, this step is not only crucial, but never-ending. Companies are always standing up and tearing down infrastructure, on- and off-boarding employees, etc. Without visibility and monitoring of these activities, it’s easy to leave something exposed to opportunistic attackers.
+
+### Understand your dependencies: SBOMs for the win
+
+If you’re a small, early-stage startup, you’re more likely to get caught in a large-scale, net-casting campaign than in any sophisticated, targeted attacks. That means it’s critical to have awareness of your dependencies, so you can quickly understand if a critical vulnerability affects any part of your software supply chain. When the [Log4Shell vulnerability](https://theconversation.com/what-is-log4j-a-cybersecurity-expert-explains-the-latest-internet-vulnerability-how-bad-it-is-and-whats-at-stake-173896) surfaced in December 2021, the companies that were aware of their dependencies were able to mitigate quickly and close the attack window.
+
+This is where a Software Bill of Materials (SBOM) comes in handy. Your SBOM isn’t just a checkbox exercise for auditing and compliance requirements. We use OWASP’s [Dependency Track](https://dependencytrack.org/) (also free and open source) to ingest our SBOM and help identify parts of the codebase that may be at risk from new vulnerabilities. We also use [Semgrep](https://semgrep.dev/) for code scanning with pattern-based recognition. It’s open source and free to run locally.
+
+It’s also worth mentioning that if your company’s product is open source, or you have an open core model (a proprietary product built on open source), you may qualify for access to free tooling from GitHub for your open source project: we use [Dependabot](https://github.com/dependabot) for automated dependency updates and [CodeQL](https://codeql.github.com/) for code analysis to identify vulnerable code.
+
+### Hardening
+
+Now that you’ve got visibility into your environment, your next step is hardening: reducing or eliminating potential threats. We can group these efforts into two categories: _organizational security_ and _product security_.
+
+#### Organizational security
+
+Raise your hand if you’ve worked at a small startup and have seen the following:
+
+-   Shared credentials
+-   Spreadsheets for IT/People teams to create all logins for new employees on the day they join
+-   Team members introducing new software/tooling at whim
+
+It can be a free-for-all at small companies, and while the risk is low at that scale, it can be much harder to introduce more rigorous processes later. The team will be resistant because you’ve added friction where there wasn’t before.
+
+Ideally, you want to introduce secure-by-default practices into your team and company early on:
+
+-   Multi-factor authentication
+-   Single sign on
+-   Just-in-time permissions
+-   Evaluation of new tooling
+
+In the case of open source software, you can inspect the code to check how data is being handled, how secure the databases are, what exact kind of data is being transferred, saved, etc. Another team best practice is around vetting the tools and dependencies that the team uses; even if you don’t have time or resources to do a full vet of every new piece of software your coworkers want to use, at least check for certifications.
+
+Here at Authentik Security, we tackle a lot of risk factors with one shot: [authentik](https://goauthentik.io/). By using SSO, we can ensure every new employee has the correct credentials for accessing the appropriate workplace apps, and that every departing employee immediately has access revoked with one click. We can also quarantine suspect users, essentially cutting off access to all systems quickly. Ironically, one of the most common initial access points is ex-employee credentials.
+
+These all contribute to ‘defense in depth’—adding layers of security and complications to make it as hard or annoying as possible for attackers to get around. These practices typically cost $0 to implement and will set you up for good security posture as you grow.
+
+#### Product security
+
+This layer is really anything to do with securing the actual product you’re building (not your company). This typically means getting third-party penetration testing (if you don’t have a dedicated Red Team—more on this below) and remediating vulnerabilities you’ve surfaced through your monitoring and dependency tracking efforts.
+
+## Red Team efforts
+
+As we mentioned above, the Red Team is offensive, meaning they attack the company (physically or remotely) to poke holes in your own defenses before the real bad actors can.
+
+### Internal penetration testing
+
+Now that we have implemented monitoring, and hardened a few things, it’s time to test how well we did. This is where we take the attacker’s point of view to try to break in and test our own controls over our systems, to expose weaknesses. Just recently we discovered that Authentik had a bunch of domains that we’d left open, unmonitored. It’s a constant, iterative loop of unearthing holes via your internal penetration testing (also called pentesting or white box testing) and finding ways to plug them.
+
+There are a lot of tools to choose from here (everyone likes breaking into things!). You’re never done choosing your stack—the threat landscape evolves constantly and so does the tooling to keep up with it. You’ll want to pay attention to new developments by keeping an eye on discussions on Twitter, Reddit, Hacker News, etc. When a new way to attack something develops (and it always will), someone will go create the special automation tooling to address that threat. (Then your attackers are going to go grab that tool and see if they can hack their way in. It’s a constant wheel.)
+
+At Authentik we use the [Kali Linux](https://www.kali.org/) distribution, which has a host of hacking tools on it, for penetration testing. It’s well known within the security world and is open source and free to use.
+
+Testing can be a tough one for small startups, because you likely won’t have a dedicated Red Team and commercial pentesting doesn’t come cheap. If you can save on your tooling though, that can help to free up resources for contracting out this type of work. The main goal you’re after is trying to identify the low-hanging fruit that inexperienced actors may exploit.
+
+### A note on insider threats
+
+[Okta has been in the news](https://goauthentik.io/blog/2023-10-23-another-okta-breach) (again!) after its second major breach in two years. A team member [unknowingly uploaded a file containing sensitive information to Okta’s support management system](https://www.crn.com/news/security/okta-faces-potential-for-reputational-risk-after-second-major-breach-in-two-years-analysts), highlighting the risk of insider threats.
+
+Your employees are a risk factor—whether through malice, ignorance, or carelessness. It’s not unheard of for someone to accidentally save a password publicly to the company’s cloud. It can be an honest mistake, but it’s very-low hanging fruit for a bad actor just watching your cloud assets.
+
+With the rise of Ransomware as a Service, there’s also always the possibility that a disgruntled employee can act as an initial access broker: either accidentally or purposefully giving their credentials or their access to someone else. It’s obviously not possible to prevent all possible compromises, so it’s important that your tooling is set up to alert you to unusual activity and your processes are in place so you can react quickly.
+
+## Do you really need certifications?
+
+Apart from using security certifications like ISO/IEC 27001 and SOC 2 to evaluate vendors that make the software you are using, certifications can vouch for your organizational security, which might be important to your customers, depending on what your product does and who your customers are.
+
+For us at Authentik Security, [our source code](https://github.com/goauthentik/authentik) is available for inspection, but that doesn’t tell people anything about how we handle emails, payment information, and so on. That’s where a third-party certification comes in: an auditor verifies your security practices, which in turn signals to your customers that you can be trusted.
+
+Certifications can be expensive though, and as a cash-strapped startup, you may not want or be able to invest in a certification. However there’s nothing stopping you from ingraining some of those good security practices in your company’s culture anyway. That way, you’re already building a strong security posture and when the time comes, you’re not rushing to implement processes that feel unnatural to the team.
+
+Again, it comes back to getting off on the right foot so that you’re not spending 10-20x the amount of money later in people time and resources to course correct later.
+
+## Security doesn’t have to be a big-company luxury
+
+People imagine that large corporations have security all figured out, but a large security department doesn’t guarantee that they have any idea what other teams are doing. As a small company, you do have one thing going for you: it’s much easier to have eyes on everything that’s happening. You’re more tightly knit and you can encompass more with fewer resources.
+
+If you talk to a lot of security people, their happy place is when no one is doing anything. Then your job’s pretty easy. Unfortunately, if you want your company to succeed, you need your developers to develop, your salespeople to talk to prospects, your CEO to meet with whomever they need to meet with. These are standard operations that all put the company at risk, but it’s your job to mitigate that risk the best you can.
+
+Our security engineer likes to say they work alongside teams, not blocking them. If security says it’s their job to make sure there are no vulnerabilities, and it’s the development team’s job to make new features, how do you get these two sides to work together?
+
+Realistically, everything has vulnerabilities. You’re never going to have a completely safe, locked-down environment. So, you partner with other teams and find a compromise. Establish a minimum threshold people have to meet to keep going. If you’re too inflexible, those teams won’t want to work with you and they won’t tell you when they’re making new virtual machines or writing new code.
+
+## Repercussions
+
+You don’t need to be a security company for these things to matter. This advice applies no matter what type of product you’re building.
+
+[Some 422 million individuals were impacted by data compromises in 2022](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/). As consumers we have almost become numb to news of new breaches. A company gets breached, they offer some sort of credit protection, cyber insurance might go up a bit, but life goes on.
+
+If you’re still not motivated to invest in your security posture (or trying to win over teammates who prioritize feature shipping over everything), consider the [case of SolarWinds](https://www.sec.gov/news/press-release/2023-227). The company appears to have exaggerated their internal security posture, leading to an indictment from the SEC.
+
+So not only is security important, it could actually keep you out of jail.
+
+_What’s in your security stack? Let us know in the comments, or send us an email at hello@goauthentik.io!_

website/developer-docs/index.md

@@ -160,7 +160,7 @@ While the prerequisites above must be satisfied prior to having your pull reques
 
 All Python code is linted with [black](https://black.readthedocs.io/en/stable/), [PyLint](https://www.pylint.org/) and [isort](https://pycqa.github.io/isort/).
 
-authentik runs on Python 3.11 at the time of writing this.
+authentik runs on Python 3.12 at the time of writing this.
 
 -   Use native type-annotations wherever possible.
 -   Add meaningful docstrings when possible.

website/developer-docs/setup/full-dev-environment.md

@@ -4,7 +4,7 @@ title: Full development environment
 
 ## Requirements
 
--   Python 3.11
+-   Python 3.12
 -   Poetry, which is used to manage dependencies
 -   Go 1.20
 -   Node.js 20

website/integrations/services/nextcloud/index.md

@@ -18,7 +18,192 @@ This setup only works, when Nextcloud is running with HTTPS enabled. See [here](
 In case something goes wrong with the configuration, you can use the URL `http://nextcloud.company/login?direct=1` to log in using the built-in authentication.
 :::
 
-## Preparation
+## Authentication
+
+There are 2 ways to setup single sign on (SSO) for Nextcloud:
+
+-   [via OIDC Connect (OAuth)](#openid-connect-auth)
+-   [via SAML](#saml-auth)
+
+### OpenID Connect auth
+
+#### Preparation
+
+The following placeholders will be used:
+
+-   `nextcloud.company` is the FQDN of the Nextcloud install.
+-   `authentik.company` is the FQDN of the authentik install.
+-   `authentik.local` is the internal FQDN of the authentik install (only relevant when running authentik and Nextcloud behind a reverse proxy)
+
+Lets start by thinking what user attributes need to be available in Nextcloud:
+
+-   name
+-   email
+-   unique user ID
+-   storage quota (optional)
+-   groups (optional)
+
+authentik already provides some default _scopes_ with _claims_ inside them, such as:
+
+-   `email` scope: Has claims `email` and `email_verified`
+-   `profile` scope: Has claims `name`, `given_name`, `preferred_username`, `nickname`, `groups`
+-   `openid` scope: This is a default scope required by the OpenID spec. It contains no claims
+
+##### Custom profile scope
+
+If you do not need storage quota or group information in Nextcloud [skip to the next step](#provider-and-application).
+
+However, if you want to be able to control how much storage users in Nextcloud can use, as well as which users are recognized as Nextcloud administrators, you would need to make this information available in Nextcloud. To achieve this you would need to create a custom `profile` scope. To do so, go to _Customisation_ -> _Property mappings_. Create a _Scope mapping_ with the following parameters:
+
+-   Name: Nextcloud Profile
+-   Scope name: profile
+-   Expression:
+
+```python
+# Extract all groups the user is a member of
+groups = [group.name for group in user.ak_groups.all()]
+
+# Nextcloud admins must be members of a group called "admin".
+# This is static and cannot be changed.
+# We append a fictional "admin" group to the user's groups if they are an admin in authentik.
+# This group would only be visible in Nextcloud and does not exist in authentik.
+if user.is_superuser and "admin" not in groups:
+    groups.append("admin")
+
+return {
+    "name": request.user.name,
+    "groups": groups,
+    # To set a quota set the "nextcloud_quota" property in the user's attributes
+    "quota": user.group_attributes().get("nextcloud_quota", None)
+}
+```
+
+:::note
+To set a quota set the "nextcloud_quota" property in the user's attributes. This can be set for individual users or a group of users, as long as the target user is a member of a group which has this attribute set.
+
+If set to a value, for example `1 GB`, user(s) will have 1GB storage quota. If the attribute is not set, user(s) will have unlimited storage.
+:::
+
+##### Provider and Application
+
+Create a provider for Nextcloud. In the Admin Interface, go to _Applications_ -> _Providers_. Create an _OAuth2/OpenID Provider_ with the following parameters:
+
+-   Name: Nextcloud
+-   Client type: Confidential
+-   Redirect URIs/Origins (RegEx): `https://nextcloud.company/apps/user_oidc/code`
+-   Signing key: Any valid certificate
+-   Under advanced settings:
+    -   Scopes:
+        -   `authentik default Oauth Mapping email`
+        -   `Nextcloud Profile` (or `authentik default Oauth Mapping profile` if you skipped the [custom profile scope](#custom-profile-scope) section)
+    -   Subject mode: Based on the User's UUID
+        :::danger
+        Nextcloud will use the UUID as username. However, mapping the subject mode to authentik usernames is **not recommended** due to their mutable nature. This can lead to security issues such as user impersonation. If you still wish to map the subject mode to an username, [disable username changing](../../../docs/installation/configuration#authentik_default_user_change_username) in authentik and set this to `Based on the User's username`.
+        :::
+    -   Include claims in ID token: ✔️
+
+Before continuing, make sure to take note of your `client ID` and `secret ID`. Don't worry you can go back to see/change them at any time.
+
+:::warning
+Currently there is a bug in the Nextcloud OIDC app, that is [limiting the size of the secret ID](https://github.com/nextcloud/user_oidc/issues/405) token to 64 characters. Since authentik uses 128 characters for a secret ID by default, you will need to trim it down to 64 characters in order to be able to set it in Nextcloud. Don't worry, 64 characters is still sufficiently long and should not compromise security.
+:::
+
+:::note
+Depending on your Nextcloud configuration, you might need to use `https://nextcloud.company/index.php/` instead of `https://nextcloud.company/`
+:::
+
+After the provider is created, link it to an app. Go to _Applications_ -> _Applications_. Create an application and choose the provider you just created. Make sure to take note of the _application slug_. You will need this later.
+
+#### Nextcloud
+
+In Nextcloud, ensure that the `OpenID Connect user backend` app is installed. Navigate to `Settings`, then `OpenID Connect`.
+
+Add a new provider using the `+` button and set the following values:
+
+-   Identifier: Authentik
+-   Client ID: The client ID from the provider
+-   Client secret: The secret ID from the provider
+-   Discovery endpoint: `https://authentik.company/application/o/<nextcloud-app-slug>/.well-known/openid-configuration`
+    :::tip
+    If you are running both your authentik and Nextcloud instances behind a reverse proxy, you can go ahead and use your internal FQDN here (i.e. `http://authentik.local`, however, note that if you do so there is [extra configuration required](#extra-configuration-when-running-behind-a-reverse-proxy)).
+    :::
+-   Scope: `email`, `profile` (you can safely omit `openid` if you prefer)
+-   Attribute mappings:
+    -   User ID mapping: sub
+    -   Display name mapping: name
+    -   Email mapping: email
+    -   Quota mapping: quota (leave empty if you have skipped the [custom profile scope](#custom-profile-scope) section)
+    -   Groups mapping: group (leave empty if you have skipped the [custom profile scope](#custom-profile-scope) section)
+        :::tip
+        You need to enable the "Use group provisioning" checkmark to be able to write to this field
+        :::
+-   Use unique user ID: If you only have one provider you can uncheck this if you prefer.
+
+At this stage you should be able to login with SSO.
+
+##### Making the OIDC provider the default login method
+
+If you intend to only login to Nextcloud using your freshly configured authentik provider, you may wish to make it the default login method. This will allow your users to be automatically redirected to authentik when they attempt to access your Nextcloud instance, as opposed to having to manually click on "Log in with Authentik" every time they wish to login.
+
+To achieve this, you will need to use the `occ` command of your Nextcloud instance:
+
+```bash
+sudo -u www-data php var/www/nextcloud/occ config:app:set --value=0 user_oidc allow_multiple_user_backends
+```
+
+##### Extra configuration when running behind a reverse proxy
+
+The OpendID Connect discovery endpoint is queried by Nextcloud and contains a list of endpoints for use by both the relying party (Nextcloud) and the authenticating user.
+
+:::note
+If you are configuring an insecure (http) discovery endpoint, Nextcloud will, by default, refuse to connect to it. To change this behaviour, you must add `allow_local_remote_servers => true` to your `config.php`
+:::
+
+:::note
+It is currently not possible force Nextcloud to connect to an https endpoint which uses an untrusted (selfsigned) certificate. If this is the case with your setup, you can do one of 3 things:
+
+-   switch to using a trusted certificate
+-   add the selfsigned certificate to Nextcloud's trust store
+-   switch to using an http endpoint and add `allow_local_remote_servers => true` to your `config.php`
+
+:::
+
+Because authentik has no knowledge of where each endpoint is/can be accessed from, it will always return endpoints with domain names matching the one used to make the discovery endpoint request.
+
+For example, if your Nextcloud instance queries the discovery endpoint using an internal domain name (`authentik.local`), all returned endpoints will have the same domain name. In this case:
+
+-   `http://authentik.local/application/o/<app-slug>/`
+-   `http://authentik.local/application/o/authorize/`
+-   `http://authentik.local/application/o/token/`
+-   `http://authentik.local/application/o/userinfo/`
+-   `http://authentik.local/application/o/<app-slug>/end-session/`
+-   `http://authentik.local/application/o/introspect/`
+-   `http://authentik.local/application/o/revoke/`
+-   `http://authentik.local/application/o/device/`
+-   `http://authentik.local/application/o/<app-slug>/jwks/`
+
+This represents a problem, because Nextcloud will attempt to redirect the user to the received `authorization` and `end-session` endpoints during login and logout respectively. When that happens, the user will try to access an internal domain and fail.
+
+The easiest way to fix this is to modify the redirect response's `Location` header coming back from Nextcloud during login and logout. Different proxies have different ways of achieving this. For example with Traefik, a 3rd party plugin called [Rewrite Header](https://plugins.traefik.io/plugins/628c9eb5108ecc83915d7758/rewrite-header) can be used.
+
+At a minimum, the `authorize` and `end-session` endpoints must be edited in-flight like so:
+
+-   `http://authentik.local/application/o/authorize/` -> `https://authentik.company/application/o/authorize/`
+-   `http://authentik.local/application/o/<app-slug>/end-session/` -> `https://authentik.company/application/o/<app-slug>/end-session/`
+
+:::note
+HTTP headers are usually capitalised (e.g. **L**ocation), however, at least some versions of Nextcloud seem to return all lowercase headers (e.g. **l**ocation). To be safe, make sure to add header replacement rules for both cases.
+:::
+
+If you prefer, you may also edit the rest of the endpoints, though that should not be necessary, as they should not be accessed by the user.
+
+:::tip
+If you do not have any relying parties accessing authentik from the outside, you may also configure your proxy to only allow access to the `authorize` and `end-session` endpoints from the outside world.
+:::
+
+### SAML auth
+
+#### Preparation
 
 The following placeholders will be used:
 
@@ -40,7 +225,7 @@ Depending on your Nextcloud configuration, you might need to use `https://nextcl
 
 You can of course use a custom signing certificate, and adjust durations.
 
-## Nextcloud
+#### Nextcloud
 
 In Nextcloud, ensure that the `SSO & SAML Authentication` app is installed. Navigate to `Settings`, then `SSO & SAML Authentication`.
 
@@ -70,7 +255,7 @@ To do this you will need to add the line `'overwriteprotocol' => 'https'` to `co
 See https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html#overwrite-parameters for additional information
 :::
 
-## Group Quotas
+#### Group Quotas
 
 Create a group for each different level of quota you want users to have. Set a custom attribute, for example called `nextcloud_quota`, to the quota you want, for example `15 GB`.
 
@@ -91,7 +276,7 @@ In Nextcloud, go to `Settings`, then `SSO & SAML Authentication`Under `Attribute
 
 -   Attribute to map the quota to.: `nextcloud_quota`
 
-## Admin Group
+#### Admin Group
 
 To give authentik users admin access to your Nextcloud instance, you need to create a custom Property Mapping that maps an authentik group to "admin". It has to be mapped to "admin" as this is static in Nextcloud and cannot be changed.
 

website/package-lock.json

@@ -19,14 +19,14 @@
                 "clsx": "^2.0.0",
                 "disqus-react": "^1.1.5",
                 "postcss": "^8.4.31",
-                "prism-react-renderer": "^2.2.0",
+                "prism-react-renderer": "^2.3.0",
                 "rapidoc": "^9.3.4",
                 "react": "^18.2.0",
                 "react-before-after-slider-component": "^1.1.8",
                 "react-dom": "^18.2.0",
                 "react-feather": "^2.0.10",
                 "react-toggle": "^4.1.3",
-                "react-tooltip": "^5.23.0",
+                "react-tooltip": "^5.24.0",
                 "remark-github": "^12.0.0"
             },
             "devDependencies": {
@@ -13617,25 +13617,17 @@
             }
         },
         "node_modules/prism-react-renderer": {
-            "version": "2.2.0",
-            "resolved": "https://registry.npmjs.org/prism-react-renderer/-/prism-react-renderer-2.2.0.tgz",
-            "integrity": "sha512-j4AN0VkEr72598+47xDvpzeYyeh/wPPRNTt9nJFZqIZUxwGKwYqYgt7RVigZ3ZICJWJWN84KEuMKPNyypyhNIw==",
+            "version": "2.3.0",
+            "resolved": "https://registry.npmjs.org/prism-react-renderer/-/prism-react-renderer-2.3.0.tgz",
+            "integrity": "sha512-UYRg2TkVIaI6tRVHC5OJ4/BxqPUxJkJvq/odLT/ykpt1zGYXooNperUxQcCvi87LyRnR4nCh81ceOA+e7nrydg==",
             "dependencies": {
                 "@types/prismjs": "^1.26.0",
-                "clsx": "^1.2.1"
+                "clsx": "^2.0.0"
             },
             "peerDependencies": {
                 "react": ">=16.0.0"
             }
         },
-        "node_modules/prism-react-renderer/node_modules/clsx": {
-            "version": "1.2.1",
-            "resolved": "https://registry.npmjs.org/clsx/-/clsx-1.2.1.tgz",
-            "integrity": "sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg==",
-            "engines": {
-                "node": ">=6"
-            }
-        },
         "node_modules/prismjs": {
             "version": "1.29.0",
             "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.29.0.tgz",
@@ -14238,9 +14230,9 @@
             }
         },
         "node_modules/react-tooltip": {
-            "version": "5.23.0",
-            "resolved": "https://registry.npmjs.org/react-tooltip/-/react-tooltip-5.23.0.tgz",
-            "integrity": "sha512-MYqn6n+Af8NHHDL3zrSqzVSoK2LLqTNFp30CuuHCYlBEf+q88FWfg+8pSO+0GnDvOa5ZaryNDq9sAVQeNhnsgw==",
+            "version": "5.24.0",
+            "resolved": "https://registry.npmjs.org/react-tooltip/-/react-tooltip-5.24.0.tgz",
+            "integrity": "sha512-HjstgpOrUwP4eN6mHU4EThpbxVuKO5SvqumRt1aAcPq0ya+pIVVxlwltndtdIIMBJ7w3jnN05vNfcfh2sxE2mQ==",
             "dependencies": {
                 "@floating-ui/dom": "^1.0.0",
                 "classnames": "^2.3.0"

website/package.json

@@ -26,13 +26,13 @@
         "clsx": "^2.0.0",
         "disqus-react": "^1.1.5",
         "postcss": "^8.4.31",
-        "prism-react-renderer": "^2.2.0",
+        "prism-react-renderer": "^2.3.0",
         "rapidoc": "^9.3.4",
         "react-before-after-slider-component": "^1.1.8",
         "react-dom": "^18.2.0",
         "react-feather": "^2.0.10",
         "react-toggle": "^4.1.3",
-        "react-tooltip": "^5.23.0",
+        "react-tooltip": "^5.24.0",
         "react": "^18.2.0",
         "remark-github": "^12.0.0"
     },