26.09.1

What's Changed

• test: kv tests by @Salazareo in #3844
• fix: card verification missing email by @Salazareo in #3850
• fix: email driver rename by @Salazareo in #3853
• fix: quote and pin Infron service tiers by @404oops in #3852
• add email composer api (puter.email.send) by @ProgrammerIn-wonderland in #3854
• fix: sharing, events and worker-credential authorization hardening by @Salazareo in #3855
• chore(deps): bump nodemailer from 9.0.6 to 9.1.1 by @dependabot[bot] in #3832
• Fix/node signed batch upload by @Xcoder2003X in #3816
• Fix/dashboard apps files audit by @jelveh in #3857
• fix: bug bounty dupes by @Salazareo in #3858
• feat: handle sub required endpoints better by @Salazareo in #3859
• chore(deps): bump libphonenumber-js from 1.13.12 to 1.13.13 by @dependabot[bot] in #3863
• chore(deps-dev): bump @types/node from 24.13.3 to 24.13.4 by @dependabot[bot] in #3862
• chore(deps): bump compression from 1.8.1 to 1.8.2 by @dependabot[bot] in #3861
• fix: tighten up fs perm strings by @Salazareo in #3860
• chore(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #3864
• chore(deps): bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in #3866
• chore(deps): bump peter-evans/create-pull-request from 6 to 8 by @dependabot[bot] in #3865
• feat: the team seat experience — no email required, forced password change, team label, and plan-based limits (PUT-1792) by @jfcastro92 in #3846
• fix: auto create folders for fs perms by @Salazareo in #3873
• feat: share with anyone with the link (PUT-1580) by @Salazareo in #3874
• document model variants by @reynaldichernando in #3875
• test: schema version is 80 since 0084 by @jfcastro92 in #3888
• feat: a paid plan counts as a verified card for the sharing gate by @Salazareo in #3886
• fix: list a link share only while the owner's plan covers it by @Salazareo in #3891
• feat: tell the plan picker when a seat's plan is on the way out by @jfcastro92 in #3890
• email read api by @ProgrammerIn-wonderland in #3869
• feat: kv events value opt in by @Salazareo in #3894
• fix: shared kv handles also allow value opt in by @Salazareo in #3895
• One recipient field in the sharing dialogs, with suggestions by @jelveh in #3897
• feat(metering): cost factor events by @Salazareo in #3898
• feat(puterjs): add defensive profile picture lookup by @jelveh in #3899
• feat: sortby for recursive readdir by @Salazareo in #3900
• Add auth message for external apps using puterjs by @reynaldichernando in #3893
• fix: hardening of fs links + effective app + bug fixes to icloud by @Salazareo in #3904
• fix: misc hardening + other fixes by @Salazareo in #3906
• fix: charge stat's return_shares against the share-listing budget by @jfcastro92 in #3870

New Contributors

• @Xcoder2003X made their first contribution in #3816

Full Changelog: 26.09...26.09.1