feat(deps): update authentik ( 2026.5.1 ➔ 2026.8.0 )

[mortyops]

This PR contains the following updates:

Package	Type	Update	Change
authentik (source)	required_provider	minor	~> 2026.5.1 → ~> 2026.8.0

---

Release Notes

goauthentik/terraform-provider-authentik (authentik)

v2026.8.0

Compare Source

Changelog

• 31b8b97: Build(deps): Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#​958) (@​dependabot[bot])
• f88d363: Build(deps): Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#​959) (@​dependabot[bot])
• 2fcb9de: Build(deps): Bump goauthentik.io/api/v3 from 3.2026050.0-rc2 to 3.2026080.0 (#​960) (@​dependabot[bot])
• d5a12d2: Build(deps): Bump github.com/getsentry/sentry-go from 0.48.0 to 0.49.0 (#​963) (@​dependabot[bot])
• 1e4db04: Build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#​964) (@​dependabot[bot])
• e27e628: Build(deps): Bump goauthentik.io/api/v3 from 3.2026080.0 to 3.2026080.1 (#​965) (@​dependabot[bot])
• fce0446: Build(deps): Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#​967) (@​dependabot[bot])

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local@http://litellm.ai.svc.cluster.local:4000/v1 (openai)

Recommendation

Approve. This is a standard Renovate dependency bump for the goauthentik/authentik Terraform provider from 2026.5.1 to 2026.8.0. The changes are confined to the provider version constraint and the corresponding lock file hashes, which is the expected and correct pattern for this type of update.

Change-by-Change Findings

terraform/authentik/main.tofu

• Updated the required_version constraint from ~> 2026.5.1 to ~> 2026.8.0.
• The comment above the block correctly notes that the server is pinned in kubernetes/apps/base/security/authentik/app/helmrelease.yaml. This PR only updates the provider version, which is consistent with the provider being a separate dependency from the application image.

terraform/authentik/.terraform.lock.hcl

• Updated the version and constraints fields to match the new provider version.
• The hashes array has been completely replaced with the new set of cryptographic hashes for v2026.8.0. This is correct; the old hashes are no longer valid for the new version.

Standards Compliance

• No plaintext secrets: Verified. No secrets are present in the diff.
• Renovate scope: The bump is a minor version update (2026.5.1 → 2026.8.0) within the same major line, which is within the scope of the ~> constraint. The PR body confirms this is a required_provider update.
• Naming/Layout: The files are in the correct location (terraform/authentik/) for the Authentik Terraform stack.
• Talos/Flux rules: Not applicable to this diff.

Tool Harness Findings

Tool harness was disabled.

Unknowns or Needs Verification

• Provider Compatibility: While the provider version is updated, the actual compatibility with the running Authentik application version (pinned in the HelmRelease) should be verified by the operator before applying the Terraform changes. The comment in main.tofu suggests this alignment is manual, so the operator should ensure the provider version supports the current application version's API.
• Automerge: The PR body states "Automerge: Disabled by config." This is consistent with the repository's general caution around Authentik changes, as noted in the standards file (tofu apply/tofu destroy in terraform/authentik/ is never a follow-on to a green PR). No action is needed here other than manual merge after verification.