Fix Bug #9701

[bnounours]

Hello,
This PR fix a minimum version for lxml to 5.2.2. Indeed the version 5.2.1 raise a core dump on the server and worker image of Authentik as described in #9701

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	b25e1b6
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/665b47a4538dcd0008740a23

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	b25e1b6
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/665b47a4b28a48000893c7d2

[BeryJu]

We don't have a fixed lock in the pyproject file, however the versions themselves are locked in the poetry.lock file: https://github.com/goauthentik/authentik/blob/main/poetry.lock#L2214-L2215

I'm curious as to how something like that could've slipped into a release since:

• as lxml is imported so early, it would affect everyone
• we run the full test suite in the final container images and nothing was broken there

[bnounours]

Hi @BeryJu,
Sorry I did not see the poetry.lock :)
I agree it is strange in fact we see not all people are affected, few people reacted to this version.

Maybe it is related to my hardware that make lxml crash...
Anyway If you want me to perform some tests don't hesitate if it can help.

How do you want to proceed ? Do I change the merge to change the poetry.lock or I close it as you already did the change ?

[bnounours]

I tried to import lxml on my server which is on AMD directly on the host and the behavior is the same => Crash. On my personal computer with intel it works ...

[BeryJu]

so since 2024.6 changing this is not as easy anymore, since we use a custom base image for FIPS compliance, hence changing the lxml version here won't make a difference (see pip install --force-reinstall /wheels/* in the dockerfile)

We'll need to add some intel/amd tests to our base image in addition to the current x86/arm64 tests