Update CHANGELOG.md (#16997)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -530,6 +530,18 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-03
+
+### 🚀 Updated Scripts
+
+  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
+
+  - #### 🐞 Bug Fixes
+
+    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
+    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
+    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
+
 ## 2026-09-02
 
 ### 🆕 New Scripts
@@ -557,7 +569,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
-  - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
+- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
+- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
 
 ## 2026-09-01
 

ct/authentik.sh

@@ -49,7 +49,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.0"
+  AUTHENTIK_VERSION="version/2026.8.1"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -84,6 +84,16 @@ function update_script() {
     fi
     msg_ok "Stopped Services"
 
+    if [[ ! -d /opt/authentik-data/blueprints ]]; then
+      msg_info "Moving blueprints to presistent directory"
+      cp -r /opt/authentik/blueprints /opt/authentik-data/
+      rm -r /opt/authentik/blueprints
+      chown -R authentik:authentik /opt/authentik-data
+      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
+      msg_ok "blueprints moved to presistent directory"
+      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
+    fi
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
     GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 
@@ -143,21 +153,39 @@ function update_script() {
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-	  msg_info "Updating Worker and Server config"
-    cat <<EOF >>/etc/default/authentik-server
+    cp -r /opt/authentik/blueprints /opt/authentik-data/
+    rm -r /opt/authentik/blueprints
+    chown -R authentik:authentik /opt/authentik-data
+    
+    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
+	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
+      cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
-    cat <<EOF >>/etc/default/authentik-worker
+      cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-    msg_ok "Updated Worker and Server config!"
+      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
+
+      msg_info "Updating services (from $MAJOR.$MINOR)"
+	    sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	    sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	    sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	    sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	    sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+      systemctl daemon-reload
+      msg_ok "Updated services (from $MAJOR.$MINOR)"
+    fi
+
+    msg_info "Updating Worker and Server config"
+    sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server
+	  sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
+    msg_ok "Updated Worker and Server config"
 
     msg_info "Updating services"
-	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
-	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
-	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
-	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
+	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
     systemctl daemon-reload
     msg_ok "Updated services"
 
@@ -198,8 +226,9 @@ done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
   cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
   cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  chown authentik:authentik /opt/authentik-data; \
-  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
+  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
+  rm -r /opt/authentik/blueprints; \
+  chown -R authentik:authentik /opt/authentik-data"
 msg_ok "Attached data storage volume"
 
 msg_info "Starting Services"

ct/immich.sh

@@ -477,7 +477,7 @@ function compile_jpegli() {
 function compile_libheif() {
   SOURCE=${SOURCE_DIR}/libheif
   ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
   # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
@@ -509,7 +509,7 @@ function compile_libheif() {
 
 function compile_libraw() {
   SOURCE=${SOURCE_DIR}/libraw
-  LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+  LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
   # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
   if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libraw"

ct/romm.sh

@@ -65,7 +65,7 @@ function update_script() {
     $STD uv run alembic upgrade head
     if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
       cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund
+      $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
       if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
         rm -rf rom-patcher-js
         cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js

install/authentik-install.sh

@@ -58,7 +58,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.0"
+AUTHENTIK_VERSION="version/2026.8.1"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
-yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
+yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
@@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-server
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
 cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-worker
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -214,6 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
@@ -234,6 +235,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always

install/immich-install.sh

@@ -266,7 +266,7 @@ msg_ok "(2/6) Compiled jpegli"
 
 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
@@ -292,7 +292,7 @@ msg_ok "(3/6) Compiled libheif"
 
 msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
 $STD git clone https://github.com/LibRaw/LibRaw.git "$SOURCE"
 cd "$SOURCE"

install/romm-install.sh

@@ -214,7 +214,7 @@ msg_ok "Set up RomM Backend"
 if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
   msg_info "Building ROM Patcher helper"
   cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund
+  $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
   if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
     rm -rf rom-patcher-js
     cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js