chore(deps): update dependency lsh123/xmlsec to v1.3.12

[renovate]

This PR contains the following updates:

Package	Update	Change
lsh123/xmlsec	patch	1.3.11 → 1.3.12

---

Release Notes

lsh123/xmlsec (lsh123/xmlsec)

v1.3.12: XMLSec 1.3.12

Compare Source

The XML Security Library 1.3.12release includes the following changes:

• (xmlsec-openssl) Added experimental ML-KEM support.
• (xmlsec-nss) Added SHA3 support.
• (xmlsec-gnutls) Added RSA-OEAP (SHA-256/SHA-384/SHA-512) support.
• (xmlsec-core) Added --transform-max-depth option to control maximum transforms execution depth (0 disables the depth check).
• Several other small fixes (see more details).

Thanks to everyone who contributed PRs or reported bugs / issues!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

authentik FIPS Image build status - debian-fips (``)

Image built: ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-debian
full=ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-154
### Debian version ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-154 \
	cat /etc/debian_version
13.5
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-154 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.6
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.6
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active

[github-actions]

authentik FIPS Image build status - xmlsec1-fips (``)

Image built: ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-xmlsec1
full=ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-154
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-154 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.6
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.6
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
### xmlsec1 version ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-154 \
	xmlsec1 --version
xmlsec1 1.3.12 (openssl)

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.15.0a2)

Image built: ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-154
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-154 \
	python --version
Python 3.15.0a2
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-154 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.6+ak-fips 7 Apr 2026

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.14.6)

Image built: ghcr.io/goauthentik/fips-python:3.14.6-slim-trixie-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.14.6-slim-trixie-fips-pr-154
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.6-slim-trixie-fips-pr-154 \
	python --version
Python 3.14.6
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.6-slim-trixie-fips-pr-154 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.6+ak-fips 7 Apr 2026

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.12.12)

Image built: ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-154
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-154 \
	python --version
Python 3.12.12
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-154 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.6+ak-fips 7 Apr 2026

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.13.9)

Image built: ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-154 for commit 2150add52403bd91b0255433c7dc36262f810044

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-154
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-154 \
	python --version
Python 3.13.9
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-154 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.6+ak-fips 7 Apr 2026