HeyPuter/puter 26.09 on GitHub

What's Changed

feat(i18n): add Czech GUI localization by @nevrkla in #3617
fix: provide fallback for signup verification by @Salazareo in #3631
🛠️ PUT-1564: Perms docs — drop the app-root-dir raw string, wire the playground examples by @jfcastro92 in #3623
🔧 PUT-1560: Deep-link the shared item from email and notifications by @jfcastro92 in #3632
Land share-email links in the Dashboard's Shared view by @jelveh in #3634
fix: metering buffer improvements for manual editing by @Salazareo in #3633
feat: rep score middleware gateway by @Salazareo in #3639
feat: guest turn for peer by @Salazareo in #3640
fix: testing for peer by @Salazareo in #3643
Carry a share link through the OIDC round trip by @jelveh in #3642
refactor: dedupe model catalog aliases and stop mutating shared catalogs by @404oops in #3630
docs: link Dutch and Odia README translations by @roarzx in #3635
🧹 PUT-1568: Rename GUI helper files to camelCase by @jfcastro92 in #3641
docs: add puter site config docs by @Salazareo in #3648
🐛 PUT-1589: Shared file fs events seem to be lost by @jfcastro92 in #3645
🐛 PUT-1586 + PUT-1599: Share dialog says what it can grant, and what it did by @jfcastro92 in #3647
🔧 PUT-1590: Mark shared items in the file listings by @jfcastro92 in #3646
feat: add Hoonify AI chat provider by @jelveh in #3499
🔧 PUT-1585: Share flag in readdir shared users in stat by @jfcastro92 in #3644
fix: failed email alarms by @Salazareo in #3651
Show share notifications in the dashboard by @jelveh in #3653
🔧 PUT-1594: Settle a permission request from what is already granted by @jfcastro92 in #3652
fix: derive the signup client IP from req.ip instead of x-forwarded-for by @Salazareo in #3661
fix: bound failed WebDAV Basic-auth attempts per account and per address by @Salazareo in #3659
fix: answer 400 instead of 500 on four malformed-input paths by @Salazareo in #3662
fix: stop sockets outliving the session that authenticated them by @Salazareo in #3658
fix: complete the malformed-input guards, including the two paths still live by @Salazareo in #3663
fix: stop a URL parameter putting puter.js into app mode by @Salazareo in #3660
🔧 PUT-1616: Close /share/blocks to app tokens by @jfcastro92 in #3657
🐛 PUT-1656: stop an embedded fs: in a path from escalating to full FS access by @jfcastro92 in #3666
🐛 PUT-1655: Open read-only shared files instead of forwarding write_url=undefined by @jfcastro92 in #3667
Fix sharing indicator in file picker by @Leanderroshan07 in #3665
🔧 PUT-1619: Publishing a directory takes ownership, not write by @jfcastro92 in #3654
fix: alaem cascade by @Salazareo in #3668
fix: document allowedAppIdsGate's real non-app-gate behavior (PUT-1667) by @Salazareo in #3669
Cap /app/ meta descriptions at 150 characters by @jelveh in #3698
Comprehensive Normalization. by @404oops in #3655
fix: metering for ai by @Salazareo in #3703
Stop server-rendered landings flashing for signed-in users by @jelveh in #3707
Add Claude Fable 5.1 by @404oops in #3711
feat: global outbound share listing (PUT-1664) by @Salazareo in #3694
Ds/put 1674 by @Salazareo in #3715
feat: better verification step handling by @Salazareo in #3717
feat: notification scope columns and backfill (PUT-1659) by @Salazareo in #3670
feat: notification type registry and audience rules (PUT-1665) by @Salazareo in #3671
feat: notification retention sweep (PUT-1668) by @Salazareo in #3672
chore: remove dead notification surfaces (PUT-1669) by @Salazareo in #3673
feat: events subject registry, parser, anchors, filters (PUT-1660) by @Salazareo in #3674
feat: session event subscriptions and dispatch hot path (PUT-1666) by @Salazareo in #3675
feat: app sockets join their own events room (PUT-1671) by @Salazareo in #3676
allow concept of "home regions" by @ProgrammerIn-wonderland in #3699
fix: classify Replicate prediction failures instead of surfacing them as 500s by @404oops in #3719
fix: don't redirect puter.com + per app/worker rate limits by @Salazareo in #3723
feat: subscribe ACL and app scoping for event subscriptions (PUT-1672) by @Salazareo in #3677
fix: keep the credit-bounded max_tokens on the context-length retry (PUT-1628) by @404oops in #3718
feat: puter.events SDK module (PUT-1675) by @Salazareo in #3678
feat: durable event subscriptions store, cache, and routes (PUT-1673) by @Salazareo in #3679
feat: pending event deliveries and delivery-class invariants (PUT-1676) by @Salazareo in #3680
feat: delivery re-check cache, revocation and anchor settle (PUT-1677) by @Salazareo in #3681
Fix PUT-1625 by @ProgrammerIn-wonderland in #3727
init docs recipes by @reynaldichernando in #3728
feat: KV change events and KV subjects (PUT-1678) by @Salazareo in #3682
feat: event handlers, context, and suspension machine (PUT-1680) by @Salazareo in #3683
feat: background delivery seam, retries, and consent (PUT-1682) by @Salazareo in #3684
feat: events metering and quotas (PUT-1683) by @Salazareo in #3685
gemini 3.8 flash direct integration by @reynaldichernando in #3732
🏗️ PUT-1699: Add team columns to group and jct_user_group by @jfcastro92 in #3704
🏗️ PUT-1700: Deduplicate jct_user_group and make membership writes unique by @jfcastro92 in #3705
🏗️ PUT-1701: Add audit_team_membership and share.holder_group_id by @jfcastro92 in #3708
🏗️ PUT-1702: TeamStore — workspace CRUD, handle uniqueness, reserved words by @jfcastro92 in #3709
🏗️ PUT-1703: TeamStore — membership reads and writes (single writer) by @jfcastro92 in #3710
🏗️ PUT-1704 + PUT-1707: TeamService — workspace lifecycle, disable and re-enable by @jfcastro92 in #3712
🏗️ PUT-1705: TeamService — provision an org account by @jfcastro92 in #3713
🏗️ PUT-1708 + PUT-1709 + PUT-1743: TeamController, teams_enabled, and the isolation suite by @jfcastro92 in #3714
feat: send app icons as a subdomain URL plus an API fallback by @Salazareo in #3734
fix: stop video generation timeouts and failures from paging (PUT-1620) by @404oops in #3730
fix: one ** per match pattern and one * per segment by @Salazareo in #3736
feat: presence and cross-region event forwarding (PUT-1679) by @Salazareo in #3686
feat: missed-event fetch and notification fold-in (PUT-1681) by @Salazareo in #3687
feat: scoped app access to notifications (PUT-1684) by @Salazareo in #3688
feat: notification GUI rides the events surface (PUT-1685) by @Salazareo in #3689
feat: cross-user KV share grants and handles (PUT-1686) by @Salazareo in #3690
feat: revocation settles kv handles (PUT-1687) by @Salazareo in #3691
feat: app-minted kv share handles (PUT-1688) by @Salazareo in #3692
docs: kv key layout is the ACL boundary (PUT-1689) by @Salazareo in #3693
PUT-1477 Add fs commands to cli by @reynaldichernando in #3746
dynamic workers docs by @reynaldichernando in #3747
kv add array example by @reynaldichernando in #3748
fix kv set value type docs by @reynaldichernando in #3750
explicit mention of kv and fs being user scope and workers for backend by @reynaldichernando in #3751
fix(ai): make chat fallback reach streamed Claude calls and rank Azure explicitly by @404oops in #3743
feat(gui): let users reposition and zoom a new profile picture by @jelveh in #3754
feat: add astra to models by @Salazareo in #3755
ci: add Dependabot config and patch auto-merge workflow by @Salazareo in #3760
chore(deps): bump fast-uri from 3.1.0 to 3.1.7 in /src/puter-js by @dependabot[bot] in #3756
chore(deps): bump qs from 6.15.3 to 6.16.0 by @dependabot[bot] in #3757
chore(deps-dev): bump browserslist from 4.28.5 to 4.28.9 by @dependabot[bot] in #3759
feat: the per-app events worker runtime by @Salazareo in #3697
fix: harden the events stack for flag-on by @Salazareo in #3752
ci: add CODEOWNERS, restrict Dependabot to patch bumps, make test wor… by @Salazareo in #3778
chore(deps): bump highlight.js from 11.11.1 to 11.11.2 by @dependabot[bot] in #3779
chore(deps): bump @prelude.so/js-sdk from 0.12.0 to 0.12.1 by @dependabot[bot] in #3780
chore(deps): bump @esbuild/linux-x64 from 0.25.11 to 0.25.12 by @dependabot[bot] in #3781
chore(deps): bump libphonenumber-js from 1.13.6 to 1.13.12 by @dependabot[bot] in #3782
chore(deps-dev): bump prettier from 3.9.4 to 3.9.6 by @dependabot[bot] in #3783
chore(deps): bump mysql2 from 3.22.5 to 3.22.6 by @dependabot[bot] in #3784
chore(deps): bump sharp from 0.35.3 to 0.35.4 by @dependabot[bot] in #3786
chore(deps-dev): bump @types/node from 24.13.2 to 24.13.3 by @dependabot[bot] in #3787
chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @dependabot[bot] in #3788
chore(deps): bump uuid from 14.0.1 to 14.0.2 by @dependabot[bot] in #3789
chore(deps-dev): bump vite from 8.1.3 to 8.1.5 by @dependabot[bot] in #3790
chore(deps): bump fastify from 5.10.0 to 5.12.3 by @dependabot[bot] in #3749
fix: withdrawing background consent revokes the app's events session by @Salazareo in #3777
chore(deps): bump nodemailer from 9.0.3 to 9.0.6 by @dependabot[bot] in #3795
chore(deps-dev): bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 by @dependabot[bot] in #3793
chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in #3792
chore(deps): bump fs-extra from 11.3.5 to 11.3.6 by @dependabot[bot] in #3785
chore(deps-dev): bump @eslint/js from 9.39.4 to 9.39.5 by @dependabot[bot] in #3791
fix: keep matrix legs of test/coverage jobs always instantiated by @Salazareo in #3799
chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #3762
chore(deps): bump shell-quote from 1.8.1 to 1.10.0 in /src/puter-js by @dependabot[bot] in #3774
chore(deps): bump lodash from 4.17.21 to 4.18.1 in /src/puter-js by @dependabot[bot] in #3797
feat: the invoking backend deploys an events worker the dispatcher cannot find by @Salazareo in #3807
chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #3767
chore(deps): bump docker/build-push-action from 5 to 7 by @dependabot[bot] in #3765
chore(deps): bump actions/checkout from 3 to 7 by @dependabot[bot] in #3764
chore(deps): bump dependabot/fetch-metadata from 2 to 3 by @dependabot[bot] in #3763
chore(deps): bump webpack from 5.101.3 to 5.110.3 in /src/puter-js by @dependabot[bot] in #3800
chore(deps-dev): bump browserstack-local from 1.5.5 to 1.5.9 in /src/gui/src/lib/jquery-ui-1.13.2 by @dependabot[bot] in #3808
fix(ai): remove retired Imagen 4 and legacy Moonshot models by @404oops in #3801
Add resilient PDF thumbnails to GUI uploads by @jelveh in #3809
fix(puter-js): require prompt in ai.txt2img by @Ayush7614 in #3804
feat(email): sendTransactional alias and streaming file inputs by @Salazareo in #3812
chore(deps): bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in #3810
fix: harden events by @Salazareo in #3813
fix: events hardening by @Salazareo in #3814
fix(ai): canonicalize image parts once and translate them per provider by @404oops in #3815
feat: let extensions customize recommended apps by @jelveh in #3818
chore(deps): bump undici from 7.29.0 to 7.29.1 by @dependabot[bot] in #3821
feat(puter.js): transferables in AppConnection.postMessage by @r58Playz in #3776
chore(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #3825
chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #3824
fix: hardening events for shared kv by @Salazareo in #3827
chore(deps): bump otpauth from 9.5.1 to 9.5.2 by @dependabot[bot] in #3820
🏗️ PUT-1765: a seat is created, never adopted by @jfcastro92 in #3720
Teams phase 3: land the remaining three PRs on main (#3733, #3724, #3725) by @jfcastro92 in #3830
add file query param by @ProgrammerIn-wonderland in #3829
fix: misc event hardening + perm fixes by @Salazareo in #3831
chore(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in #3826
chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #3822
chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #3823
fix(puter-js): preserve zero amount in kv incr/decr by @Ayush7614 in #3802
fix(puter-js): return key_undefined for missing kv keys by @Ayush7614 in #3803
fix(puter-js): account for base64 padding in estimateDataUrlSize by @Ayush7614 in #3805
fix: CODEOWNERS + perm dialogs outside puter dashboard/desktop by @Salazareo in #3833
🏗️ PUT-1719 + PUT-1725: two-workspace fixture and group permission grants by @jfcastro92 in #3726
🏗️ PUT-1726 + PUT-1727 + PUT-1729: share with a workspace by @jfcastro92 in #3729
more recipes by @reynaldichernando in #3819
🏗️ PUT-1745: enforce the forced password change on workspace seats by @jfcastro92 in #3737
🏗️ PUT-1746 + PUT-1733: tell a member what was done to their account by @jfcastro92 in #3738
🏗️ PUT-1732: delete a workspace seat for good, once it is disabled by @jfcastro92 in #3740
🏗️ PUT-1735 + PUT-1737 + PUT-1738 + PUT-1739: the puter.teams SDK module, suite and docs by @jfcastro92 in #3741
🏗️ PUT-1740 + PUT-1762: the workspace surfaces in the GUI by @jfcastro92 in #3742
🏗️ PUT-1736: a team directory apps can read, once the team opens it by @jfcastro92 in #3745
Add gpt 2.5 image by @reynaldichernando in #3839
fix(ai): keep per-provider failures when every chat route fails by @404oops in #3836
feat(ai): refresh txt2vid catalogs, retire Sora, default to Veo 3.1 Lite by @404oops in #3828
Update CODEOWNERS by @Salazareo in #3841
Update CODEOWNERS by @Salazareo in #3842
feat: add TeamStore.countActiveSeats for the billable seat count by @jfcastro92 in #3837
feat: kv list ordering toggle + addressable path improvements by @Salazareo in #3843

New Contributors

@nevrkla made their first contribution in #3617
@roarzx made their first contribution in #3635
@Leanderroshan07 made their first contribution in #3665

Full Changelog: 26.08.2...26.09