goauthentik / goauthentik/authentik

Prevent application start/migration if sequential upgrade path is skipped

Open
#20,836 3 comments 9 reactions 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Is your feature request related to a problem?

Yes. Currently, if a user ignores the sequential upgrade instructions in the documentation and skips a major version during an upgrade (e.g., going from 2025.10.x directly to 2026.2.x), Authentik attempts to apply migrations. This often results in partial migration, database corruption, or cryptic errors (like "column does not exist") that require a database restore. Furthermore, there may be cases where the upgrade will seem to have been completed with Authentik running properly, but in which issues may be caused in a future upgrade.

### Describe the solution you'd like

It would be nice if a pre-migration check was implemented, so that the application:
1. Detects the current schema version in the database
2. Compares it against the expected version of the new container
3. If it detects that a version is about to be "skipped" (per the sequential upgrade policy), exits with a clear error message, such as "Upgrade skipped. Sequential upgrades are required. Please upgrade to version [X] before moving to [Y]."

### Describe alternatives that you've considered

I guess the alternative is relying on users reading the documentation, but it seems many may miss the relevant article. For example this might have been how issues like #20734 and #20634 came to be.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.