26.10

What's Changed

• feat: name the issuing app in share emails, and cut the digest window to 5s by @jfcastro92 in #3871
• fix: a team seat's plan card names its team, and an unreadable plan is not Free (PUT-1843) by @jfcastro92 in #3896
• fix: make the block list bite on team shares, and unshare every re-share (PUT-1813) by @jfcastro92 in #3872
• show app icon when login from external app by @reynaldichernando in #3905
• fix: stop disclosing invite addresses to apps, tokens and delegates by @jfcastro92 in #3892
• fix: harden clickjacking by @Salazareo in #3912
• Redesign the Teams tab in the dashboard by @jelveh in #3901
• Document local Docker builds with Compose overrides by @404oops in #3867
• fix(ai): harden chat/video model maps and txt2vid argument guards by @404oops in #3887
• fix(ai-image): refresh model catalogs, unify txt2img requests, expand docs by @404oops in #3889
• fix(ai): send stable, non-sequential user identifiers to AI providers by @rasadregmi in #3856
• fix(puter-js): restore file pickers on third-party sites by @Salazareo in #3917
• feat: user profiles in a system-owned store, public only for paid accounts by @Salazareo in #3919
• fix(fs): keep a home directory on its account's username by @Salazareo in #3920
• fix: tests by @Salazareo in #3922
• fix: settle a URL file-access prompt from a grant the app already holds by @jfcastro92 in #3913
• fix: restrict godmode app launches to godmode callers by @jfcastro92 in #3928
• fix: bump server timeouts for better error handling by @Salazareo in #3929
• fix: stop leaking an unawaited permission traversal on every check by @jfcastro92 in #3914
• chore(deps-dev): bump @types/node from 24.13.4 to 24.13.6 by @dependabot[bot] in #3926
• chore(deps-dev): bump prettier from 3.9.6 to 3.9.8 by @dependabot[bot] in #3925
• feat: opus 5.5 by @Salazareo in #3930
• fix(ai): classify upstream credit exhaustion, contain the route, redact vendor text (PUT-1870) by @404oops in #3927
• fix: check-app reported every app as already authorized by @jfcastro92 in #3915
• feat(ai): add GPT-6 Sol and Luna and sync Claude pricing by @404oops in #3931
• fix: let apps read opted-in teams, scope worker listing, fix revokeReadURL by @Salazareo in #3933
• fix: refuse app-issued scoped tokens on events handler and worker routes by @Salazareo in #3935
• chore: CODEOWNERS by @Salazareo in #3938
• feat: allow browser extension origins in auth requests by @apirJS in #3907
• fix(tools): spawn npm.cmd through a shell on Windows by @rasadregmi in #3923
• fix: acl check by @Salazareo in #3939
• PUT-1868 by @ProgrammerIn-wonderland in #3940
• fix(hosting): keep alternate-host bootstrap stubs from shadowing private apps by @jfcastro92 in #3936
• fix: Teams lifecycle robustness — owner deletion, cap serialization, provisioned-account scope (PUT-1944) by @jfcastro92 in #3942
• Ns/worker no socket by @ProgrammerIn-wonderland in #3944
• Bug bash fixes (PUT-1876, 1877, 1880, 1881, 1948, 1949, 1951) and KV event fan-out by plan by @Salazareo in #3943
• Add link to AI Builder in README by @jelveh in #3946
• fix: codeowners by @Salazareo in #3948
• fix(selfhost): configure bucket CORS in s3-init so browser uploads work by @rowin-C in #3934
• feat: let the Contact Us form carry screenshots and recordings by @jelveh in #3563
• fix(auth): bind the OIDC popup-return proof to its purpose, browser, and popup by @jfcastro92 in #3937
• fix: PUT-1824 + PUT-1884 + PUT-1952 + PUT-1827 by @Salazareo in #3951
• self hosted mail by @ProgrammerIn-wonderland in #3932
• fix PUT-1872 by @ProgrammerIn-wonderland in #3952
• Fix/3638 shared link account by @rupanjana15 in #3845
• Remove deprecated AI chat models flagged by live model check by @AnujShrivastava01 in #3947
• fix(ai-ocr): sync OCR models and prices, route by model, cap input size by @404oops in #3949
• feat: let a team require two-factor authentication of its accounts (PUT-1988) by @jfcastro92 in #3950
• feat(ai): add Claude Sonnet 5.5 by @404oops in #3970
• fix: events docs by @Salazareo in #3968
• fix: app uuid fixes by @Salazareo in #3980
• fix: PUT-1885 PUT 1950 by @Salazareo in #3981
• fix: read a team back from the primary after writing it (PUT-2033) by @jfcastro92 in #3971
• fix: stop group permission scans re-entering the sharer's own grant (PUT-1994) by @jfcastro92 in #3966
• docs: easy fs sharing recipe (PUT-1958) by @jfcastro92 in #3973
• chore(deps): bump postal-mime from 3.0.0 to 3.0.1 by @dependabot[bot] in #3983
• chore(deps-dev): bump prettier from 3.9.8 to 3.9.9 by @dependabot[bot] in #3986
• docs: easy perms recipe (PUT-1965) by @jfcastro92 in #3972
• chore(deps): bump socket.io from 4.8.3 to 4.8.4 by @dependabot[bot] in #3985
• chore(deps): bump libphonenumber-js from 1.13.13 to 1.13.14 by @dependabot[bot] in #3984
• Fix chat test mode routing to fake provider by @404oops in #3987
• chore(deps): bump socket.io-client from 4.8.3 to 4.8.4 by @dependabot[bot] in #3982
• fix PUT-1888 by @ProgrammerIn-wonderland in #3992
• feat: add gpt 6.1 sol to our direct apis by @Salazareo in #3994
• fix: misc fixes from alert logs by @Salazareo in #3995
• docs: teams recipe and playground examples (PUT-1966) by @jfcastro92 in #3967
• PUT-1959 PUT-1960 subdomains & worker recipes by @ProgrammerIn-wonderland in #3993
• fix(UI): Variable color in text input fields by @rowin-C in #3996
• fix: misc events and kv issues found during recipes by @Salazareo in #3997
• Revert "fix(UI): Variable color in text input fields" by @Salazareo in #4001
• fix: stop deleted apps and users from being resurrected by a lagging replica by @jfcastro92 in #3988
• docs: easy kv recipes (PUT-1962) by @Salazareo in #3999
• fix: let a share recipient create entries in a folder shared with them by @jfcastro92 in #4000
• fix: kv path errors and ttl hardening, events subscription end and race fixes by @Salazareo in #4004
• chore(deps-dev): bump undici from 7.29.0 to 7.30.0 by @dependabot[bot] in #3991
• fix: bound the inputs on the grant and token routes (PUT-1997) by @jfcastro92 in #4011
• chore(deps): bump fastify from 5.12.3 to 5.12.5 by @dependabot[bot] in #4009
• chore(deps): bump axios from 1.18.1 to 1.20.0 by @dependabot[bot] in #4008
• chore(deps): bump @grpc/grpc-js from 1.14.4 to 1.14.5 by @dependabot[bot] in #4010
• fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) by @Salazareo in #4012
• perf: batch per-app origin, canonical and hosted-backing lookups in app listings (PUT-1892) by @Salazareo in #4013
• chore(deps): bump fast-uri from 3.1.7 to 3.1.8 by @dependabot[bot] in #4014
• fix: run a broadcast persistent handler in the worker or the clients, not both (PUT-1889) by @Salazareo in #4016
• fix: don't count failed username change towards rate limit by @Salazareo in #4021
• improve teams docs by @reynaldichernando in #4025
• Update recipes for storing a small list and store per id by @reynaldichernando in #4028
• contact form recipe by @reynaldichernando in #4029
• fix: refuse opaque origins cleanly instead of a logged 400 (PUT-1896) by @jfcastro92 in #4007
• Add rate limit detail for contact form recipe by @reynaldichernando in #4030
• fix: return 400 when a streamed upload is shorter than its declared size by @Salazareo in #4023
• fix: cap FS batch array lengths (PUT-1894) by @Salazareo in #4024
• feat(metering): per-month allowance override for partly billed plan changes (PUT-1996) by @Salazareo in #4027
• fix: make app-data delete grants imply write and read (PUT-1998) by @Salazareo in #4022
• fix(fs): keep a vacated username off-limits to other accounts for an hour by @Salazareo in #4039
• chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 by @dependabot[bot] in #4015
• chore(deps): bump engine.io from 6.6.9 to 6.6.11 by @dependabot[bot] in #4017
• add ai builder link to docs by @reynaldichernando in #4044
• fix(events): keep app-less scoped tokens off the account's durable rows and mailbox by @Salazareo in #4042
• fix: keep launch tokens out of URLs and storage (PUT-2040) by @Salazareo in #4038
• event based FBL implementation by @ProgrammerIn-wonderland in #3969
• chore(ai): sync model catalogs with provider listings and deprecations by @404oops in #4033
• fix(ai): price speech credit gates at the charged cost and hold them in flight (PUT-1895) by @404oops in #4034
• fix(ai): price the chat credit gate at the factored cost (PUT-1895) by @404oops in #4035
• refactor(metering): route free-plan checks through isFreeSubscription (PUT-1830) by @Salazareo in #4046
• fix(fs): refuse renaming or moving AppData roots (PUT-2050) by @Salazareo in #4048
• fix: scope whoami billing details and monthly usage to the calling app (PUT-2015) by @Salazareo in #4050
• fix(metering): stop caching subscription answers from email-less actors and failed lookups (PUT-2002) by @Salazareo in #4052
• fix: own system sites by the system user by @Salazareo in #4056
• fix(fs): hide the issuer's home from scoped-token root listings (PUT-2053) by @Salazareo in #4047
• fix: keep system sites writable and their names out of reach by @Salazareo in #4064
• fix(auth): stop a deleted app's sessions authenticating as the next app with its uid (PUT-2049) by @Salazareo in #4057
• fix(events): carry handler depth onto tokens a handler mints by @Salazareo in #4049
• fix(auth): require a step-up to set up 2FA and a valid code to enable it by @Salazareo in #4051
• fix(thumbnails): bind thumbnail keys to their entry and size-bound uploads (PUT-1999) by @Salazareo in #4054
• fix(socket): hold unlisted free plans to the free connection cap (PUT-1830) by @Salazareo in #4060
• fix(fs): bind signed file URLs to the owner they were issued under by @Salazareo in #4053
• fix(metering): decide app-usage access in MeteringService only (PUT-2015) by @Salazareo in #4061
• fix(metering): keep a failed lookup's fallback out of the credit cache (PUT-2002) by @Salazareo in #4062
• fix(fs): keep restore metadata out of reach of anyone but the tree's owner (PUT-2050) by @Salazareo in #4063
• fix: clarify team directory app access by @nikhiljangid120 in #4031
• fix(ai-ocr): check credits for the whole document before calling the provider by @Salazareo in #4055
• fix: alert errors from timeouts by @Salazareo in #4066
• fix: drop database_id from the subdomain reclaim; MySQL has no such column by @Salazareo in #4067
• fix: follow-ups from the reviews of #4047, #4049, #4051, #4053, #4055 and #4057 by @Salazareo in #4068
• fix(apps): keep ids longer than an app uid out of the app-stats query by @Salazareo in #4070
• fix(ai): chat credit gate ceiling, in-flight holds and disconnects by @Salazareo in #4071
• chore: bump puter js ver by @Salazareo in #4073

New Contributors

• @rasadregmi made their first contribution in #3856
• @apirJS made their first contribution in #3907
• @rupanjana15 made their first contribution in #3845
• @AnujShrivastava01 made their first contribution in #3947
• @nikhiljangid120 made their first contribution in #4031

Full Changelog: 26.09.1...26.10