LoginSign Up
← Back to all sparks
A

Authelia

INFRA · APIS
Velocity5.0

Open-source authentication and two-factor authorization server.

www.authelia.com ↗

Authelia's 4.39.x series is a continuous patch stream: five releases in nine days, no new features

authoidcself-hostedsecuritydevtools
◆Current state
Authelia is in a sustained maintenance phase on the 4.39.x branch. The project has shipped at least five releases since September 8 — all bug-fix patches targeting OIDC conformance, web UI edge cases, SMTP IPv6, Envoy authz path handling, and storage correctness. The release cadence is high but the content is narrow: there is no visible feature investment in the recent window.
◆Where it's heading
The pattern across these releases is OIDC stabilization — multiple entries address consent handling, resource indicators, and JWT grant correctness. Authelia appears to be closing out conformance gaps accumulated during earlier 4.39.x development rather than adding surface area. The active committer footprint is small (primarily @james-d-elliott), which keeps the pace sustainable but limits breadth.
◆Prediction
Given the absence of feature releases since well before May 2026, a 4.40.x or 5.0 branch with new capabilities is likely being developed in parallel. The current stream is support-mode maintenance.

◆Recent moves

  1. 1mo ago

    Authelia v4.39.28 patch release

    Patch release with no documented changes beyond Docker image availability. Continuation of the 4.39.x maintenance stream.

    View source ↗
  2. 1mo ago

    v4.39.27

    Three bug fixes: consent redirect status code, Envoy authz path query inclusion, and OIDC pre-configured consent being saved twice. Targeted fixes with no feature movement.

    View source ↗
  3. 1mo ago

    v4.39.26

    Single OIDC fix: allow conformant `alg none` JARM responses. A standards-conformance correction with no user-visible product change.

    View source ↗
  4. 1mo ago

    v4.39.25

    SMTP notification fix for IPv6 literal address handling — infrastructure correctness for self-hosted deployments on IPv6 networks.

    View source ↗
  5. 1mo ago

    v4.39.24

    Test suite fixes: preserve log colors under `go test -json` and restore single log groups. Internal tooling only — no user-visible changes.

    View source ↗
  6. 1mo ago

    v4.39.23

    Ten bug fixes in one release: OIDC client auth strategy, resource indicator grants, storage foreign key violations, an unbound query, and three web UI issues including password reset form re-enabling and WebAuthn error display. The density of OIDC fixes continues the conformance-closing pattern visible across this 4.39.x window.

    View source ↗