## goauthentik/authentik — version/2026.8.0…version/2026.8.1

_52 commits._

### Features
- **website/docs: add 2026.8.1 release notes (#25613)** (dc886f2)
- **core: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.8) (#25385)** (36970c8)
- **core: add user type-active-username index (cherry-pick #25223 to version-2026.8) (#25242)** (3cd574b)

### Fixes
- **web: Fix issues surrounding text field focus behavior. (cherry-pick #25159 to version-2026.8) (#25451)** (6e14844)
- **tenants: fix base URL validation rejecting internal hostnames (cherry-pick #25560 to version-2026.8) (#25563)** (ea17f12)
- **web: Fix imports when in compatibility mode. (cherry-pick #25526 to version-2026.8) (#25529)** (3791deb)
- **web: Fix Sentry Initialization (cherry-pick #25450 to version-2026.8) (#25501)** (b3b157e)
- **outpost/event: fix websocket connection with AUTHENTIK_INSECURE=true (cherry-pick #25472 to version-2026.8) (#25475)** (609fc7e)
- **lib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.8) (#25467)** (bd0ebe3)
- **website/docs: fix order for install items (cherry-pick #25399 to version-2026.8) (#25400)** (574d747)
- **outposts: fix docker controller for proxy outpost (cherry-pick #25353 to version-2026.8) (#25383)** (211dbae)
- **web/user: fix missing enterprise check on agents tab in user interface (cherry-pick #25371 to version-2026.8) (#25372)** (5294655)
- **endpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.8) (#25338)** (6d8d3b6)
- **outpost/proxy: fix double host sent on token introspection (cherry-pick #25234 to version-2026.8) (#25245)** (9e34fbc)
- **website/docs: 2026.8 release notes: fix commands (cherry-pick #25218 to version-2026.8) (#25224)** (03c6611)

### Backend
- **release: 2026.8.1** (b4de733)
- **web: Auto focus password field after login error. (cherry-pick #25026 to version-2026.8) (#25034)** (941fe5b)
- **stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.8) (#25498)** (a5c0a73)
- **sources/ldap/freeipa: handle list-valued krbLastPwdChange (cherry-pick #20600 to version-2026.8) (#25561)** (27f7bdc)
- **server/core: relay negotiated websocket subprotocol and stop offering extensions upstream (cherry-pick #25487 to version-2026.8) (#25510)** (1d07ed7)
- **crypto: don't dispatch discovery if one is queued (cherry-pick #25483 to version-2026.8) (#25512)** (9551a62)
- **core: bump goauthentik/fips-python from 6abe1b to 3ebb7c in /lifecycle/container (cherry-pick #25504 to version-2026.8) (#25506)** (59aa2b9)
- **core: bump goauthentik/fips-debian from f18dbc4 to ed780d in /lifecycle/container (cherry-pick #25503 to version-2026.8) (#25509)** (c7adb73)
- **website/docs: document ak_call_policy gotchas (cherry-pick #25461 to version-2026.8) (#25502)** (802f55f)
- **core: bump h2 from 4.3.0 to 4.4.1 (cherry-pick #24871 to version-2026.8) (#25497)** (b7550ef)
- **web: keep the search-select dropdown inside its modal (cherry-pick #24812 to version-2026.8) (#24884)** (481706c)
- **lib/expression: use literal fallback in ak_obj_attr (cherry-pick #25414 to version-2026.8) (#25465)** (c434d55)
- **web/admin/events: Allow selecting public cert only on transport form verification (cherry-pick #24771 to version-2026.8) (#25443)** (2b73c05)
- **providers/saml: remove redundant backchannel logout call (cherry-pick #25086 to version-2026.8) (#25444)** (feefe83)
- **packages/ak-axum: extract the rightmost untrusted IP from X-Forwarded-For (cherry-pick #25397 to version-2026.8) (#25442)** (b348ed9)
- **outpost/proxy: avoid breaking header parsing in non-compliant backends (cherry-pick #25439 to version-2026.8) (#25441)** (68ac943)
- **core: bump library/golang from 1.27rc3-trixie to 1.27-trixie in /lifecycle/container (cherry-pick #25425 to version-2026.8) (#25436)** (fc21b26)
- **website/docs: release 2026.8: clarify hash_password prompt wording (cherry-pick #25207 to version-2026.8) (#25221)** (9ede0d4)
- **web/elements/table: show scrollbar instead of overflowing off the page (cherry-pick #25232 to version-2026.8) (#25391)** (29377f1)
- **stages/identification: only join Source subtypes that can render a login button (cherry-pick #25238 to version-2026.8) (#25387)** (2d140c4)
- **sources: don't 500 on an object-shaped `groups` claim (cherry-pick #25208 to version-2026.8) (#25384)** (06c2329)
- **web: keep sticky form actions below nav menus (cherry-pick #25336 to version-2026.8) (#25350)** (bf1bc35)
- **root: SECURITY.md vulnerability reporting channel (cherry-pick #25365 to version-2026.8) (#25370)** (6891eb6)
- **core/sources: forward kwargs when updating an existing connection (cherry-pick #25204 to version-2026.8) (#25360)** (41f3c0a)
- **server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.8) (#25362)** (463d362)
- **sources/oauth: cover object group property mappings (cherry-pick #25195 to version-2026.8) (#25359)** (2a6b3cd)
- **core/sources: reuse group property mapping manager across groups (cherry-pick #24699 to version-2026.8) (#25357)** (86616f8)
- **root: update SECURITY.md supported versions (cherry-pick #25351 to version-2026.8) (#25358)** (640daf3)
- **core: declare authorization_flow and invalidation_flow as nullable in root provider list (cherry-pick #25243 to version-2026.8) (#25337)** (d9b443a)
- **core: bump aiohttp from 3.14.1 to 3.14.3 (cherry-pick #24712 to version-2026.8) (#25228)** (080c074)
- **core: bump sqlparse from 0.5.5 to 0.6.0 (cherry-pick #25165 to version-2026.8) (#25229)** (2f0b87f)
- **website/docs: finalize 2026.8 docs (cherry-pick #25202 to version-2026.8) (#25203)** (b4d07fd)
- **website/docs: sidebar: ordering (cherry-pick #25151 to version-2026.8) (#25188)** (9a04dd6)

### Chore
- **ci: bump golangci lint (cherry-pick #25513 to version-2026.8) (#25522)** (cd63c42)
- **ci: release tag: don't generate release notes on pre-release, nor feature release (cherry-pick #24693 to version-2026.8) (#25367)** (407da3a)
- **ci: downgrade golangci to fix panic (cherry-pick #25354 to version-2026.8) (#25356)** (36acd27)
- **ci: flatten image merge output to prevent podman pull issues (cherry-pick #25231 to version-2026.8) (#25233)** (9613edd)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/goauthentik/authentik?utm_source=github-action)._