What's Changed

• feat(i18n): add Czech GUI localization by @nevrkla in https://github.com/HeyPuter/puter/pull/3617
• fix: provide fallback for signup verification by @Salazareo in https://github.com/HeyPuter/puter/pull/3631
• 🛠️ PUT-1564: Perms docs — drop the app-root-dir raw string, wire the playground examples by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3623
• :wrench: PUT-1560: Deep-link the shared item from email and notifications by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3632
• Land share-email links in the Dashboard's Shared view by @jelveh in https://github.com/HeyPuter/puter/pull/3634
• fix: metering buffer improvements for manual editing by @Salazareo in https://github.com/HeyPuter/puter/pull/3633
• feat: rep score middleware gateway by @Salazareo in https://github.com/HeyPuter/puter/pull/3639
• feat: guest turn for peer by @Salazareo in https://github.com/HeyPuter/puter/pull/3640
• fix: testing for peer by @Salazareo in https://github.com/HeyPuter/puter/pull/3643
• Carry a share link through the OIDC round trip by @jelveh in https://github.com/HeyPuter/puter/pull/3642
• refactor: dedupe model catalog aliases and stop mutating shared catalogs by @404oops in https://github.com/HeyPuter/puter/pull/3630
• docs: link Dutch and Odia README translations by @roarzx in https://github.com/HeyPuter/puter/pull/3635
• 🧹 PUT-1568: Rename GUI helper files to camelCase by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3641
• docs: add puter site config docs by @Salazareo in https://github.com/HeyPuter/puter/pull/3648
• :bug: PUT-1589: Shared file fs events seem to be lost by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3645
• :bug: PUT-1586 + PUT-1599: Share dialog says what it can grant, and what it did by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3647
• :wrench: PUT-1590: Mark shared items in the file listings by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3646
• feat: add Hoonify AI chat provider by @jelveh in https://github.com/HeyPuter/puter/pull/3499
• :wrench: PUT-1585: Share flag in readdir shared users in stat by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3644
• fix: failed email alarms by @Salazareo in https://github.com/HeyPuter/puter/pull/3651
• Show share notifications in the dashboard by @jelveh in https://github.com/HeyPuter/puter/pull/3653
• :wrench: PUT-1594: Settle a permission request from what is already granted by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3652
• fix: derive the signup client IP from req.ip instead of x-forwarded-for by @Salazareo in https://github.com/HeyPuter/puter/pull/3661
• fix: bound failed WebDAV Basic-auth attempts per account and per address by @Salazareo in https://github.com/HeyPuter/puter/pull/3659
• fix: answer 400 instead of 500 on four malformed-input paths by @Salazareo in https://github.com/HeyPuter/puter/pull/3662
• fix: stop sockets outliving the session that authenticated them by @Salazareo in https://github.com/HeyPuter/puter/pull/3658
• fix: complete the malformed-input guards, including the two paths still live by @Salazareo in https://github.com/HeyPuter/puter/pull/3663
• fix: stop a URL parameter putting puter.js into app mode by @Salazareo in https://github.com/HeyPuter/puter/pull/3660
• 🔧 PUT-1616: Close /share/blocks to app tokens by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3657
• :bug: PUT-1656: stop an embedded fs: in a path from escalating to full FS access by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3666
• :bug: PUT-1655: Open read-only shared files instead of forwarding write_url=undefined by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3667
• Fix sharing indicator in file picker by @Leanderroshan07 in https://github.com/HeyPuter/puter/pull/3665
• :wrench: PUT-1619: Publishing a directory takes ownership, not write by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3654
• fix: alaem cascade by @Salazareo in https://github.com/HeyPuter/puter/pull/3668
• fix: document allowedAppIdsGate's real non-app-gate behavior (PUT-1667) by @Salazareo in https://github.com/HeyPuter/puter/pull/3669
• Cap /app/ meta descriptions at 150 characters by @jelveh in https://github.com/HeyPuter/puter/pull/3698
• Comprehensive Normalization. by @404oops in https://github.com/HeyPuter/puter/pull/3655
• fix: metering for ai by @Salazareo in https://github.com/HeyPuter/puter/pull/3703
• Stop server-rendered landings flashing for signed-in users by @jelveh in https://github.com/HeyPuter/puter/pull/3707
• Add Claude Fable 5.1 by @404oops in https://github.com/HeyPuter/puter/pull/3711
• feat: global outbound share listing (PUT-1664) by @Salazareo in https://github.com/HeyPuter/puter/pull/3694
• Ds/put 1674 by @Salazareo in https://github.com/HeyPuter/puter/pull/3715
• feat: better verification step handling by @Salazareo in https://github.com/HeyPuter/puter/pull/3717
• feat: notification scope columns and backfill (PUT-1659) by @Salazareo in https://github.com/HeyPuter/puter/pull/3670
• feat: notification type registry and audience rules (PUT-1665) by @Salazareo in https://github.com/HeyPuter/puter/pull/3671
• feat: notification retention sweep (PUT-1668) by @Salazareo in https://github.com/HeyPuter/puter/pull/3672
• chore: remove dead notification surfaces (PUT-1669) by @Salazareo in https://github.com/HeyPuter/puter/pull/3673
• feat: events subject registry, parser, anchors, filters (PUT-1660) by @Salazareo in https://github.com/HeyPuter/puter/pull/3674
• feat: session event subscriptions and dispatch hot path (PUT-1666) by @Salazareo in https://github.com/HeyPuter/puter/pull/3675
• feat: app sockets join their own events room (PUT-1671) by @Salazareo in https://github.com/HeyPuter/puter/pull/3676
• allow concept of "home regions" by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3699
• fix: classify Replicate prediction failures instead of surfacing them as 500s by @404oops in https://github.com/HeyPuter/puter/pull/3719
• fix: don't redirect puter.com + per app/worker rate limits by @Salazareo in https://github.com/HeyPuter/puter/pull/3723
• feat: subscribe ACL and app scoping for event subscriptions (PUT-1672) by @Salazareo in https://github.com/HeyPuter/puter/pull/3677
• fix: keep the credit-bounded max_tokens on the context-length retry (PUT-1628) by @404oops in https://github.com/HeyPuter/puter/pull/3718
• feat: puter.events SDK module (PUT-1675) by @Salazareo in https://github.com/HeyPuter/puter/pull/3678
• feat: durable event subscriptions store, cache, and routes (PUT-1673) by @Salazareo in https://github.com/HeyPuter/puter/pull/3679
• feat: pending event deliveries and delivery-class invariants (PUT-1676) by @Salazareo in https://github.com/HeyPuter/puter/pull/3680
• feat: delivery re-check cache, revocation and anchor settle (PUT-1677) by @Salazareo in https://github.com/HeyPuter/puter/pull/3681
• Fix PUT-1625 by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3727
• init docs recipes by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3728
• feat: KV change events and KV subjects (PUT-1678) by @Salazareo in https://github.com/HeyPuter/puter/pull/3682
• feat: event handlers, context, and suspension machine (PUT-1680) by @Salazareo in https://github.com/HeyPuter/puter/pull/3683
• feat: background delivery seam, retries, and consent (PUT-1682) by @Salazareo in https://github.com/HeyPuter/puter/pull/3684
• feat: events metering and quotas (PUT-1683) by @Salazareo in https://github.com/HeyPuter/puter/pull/3685
• gemini 3.8 flash direct integration by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3732
• 🏗️ PUT-1699: Add team columns to group and jct_user_group by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3704
• 🏗️ PUT-1700: Deduplicate jct_user_group and make membership writes unique by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3705
• 🏗️ PUT-1701: Add audit_team_membership and share.holder_group_id by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3708
• 🏗️ PUT-1702: TeamStore — workspace CRUD, handle uniqueness, reserved words by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3709
• 🏗️ PUT-1703: TeamStore — membership reads and writes (single writer) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3710
• 🏗️ PUT-1704 + PUT-1707: TeamService — workspace lifecycle, disable and re-enable by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3712
• 🏗️ PUT-1705: TeamService — provision an org account by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3713
• 🏗️ PUT-1708 + PUT-1709 + PUT-1743: TeamController, teams_enabled, and the isolation suite by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3714
• feat: send app icons as a subdomain URL plus an API fallback by @Salazareo in https://github.com/HeyPuter/puter/pull/3734
• fix: stop video generation timeouts and failures from paging (PUT-1620) by @404oops in https://github.com/HeyPuter/puter/pull/3730
• fix: one ** per match pattern and one * per segment by @Salazareo in https://github.com/HeyPuter/puter/pull/3736
• feat: presence and cross-region event forwarding (PUT-1679) by @Salazareo in https://github.com/HeyPuter/puter/pull/3686
• feat: missed-event fetch and notification fold-in (PUT-1681) by @Salazareo in https://github.com/HeyPuter/puter/pull/3687
• feat: scoped app access to notifications (PUT-1684) by @Salazareo in https://github.com/HeyPuter/puter/pull/3688
• feat: notification GUI rides the events surface (PUT-1685) by @Salazareo in https://github.com/HeyPuter/puter/pull/3689
• feat: cross-user KV share grants and handles (PUT-1686) by @Salazareo in https://github.com/HeyPuter/puter/pull/3690
• feat: revocation settles kv handles (PUT-1687) by @Salazareo in https://github.com/HeyPuter/puter/pull/3691
• feat: app-minted kv share handles (PUT-1688) by @Salazareo in https://github.com/HeyPuter/puter/pull/3692
• docs: kv key layout is the ACL boundary (PUT-1689) by @Salazareo in https://github.com/HeyPuter/puter/pull/3693
• PUT-1477 Add fs commands to cli by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3746
• dynamic workers docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3747
• kv add array example by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3748
• fix kv set value type docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3750
• explicit mention of kv and fs being user scope and workers for backend by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3751
• fix(ai): make chat fallback reach streamed Claude calls and rank Azure explicitly by @404oops in https://github.com/HeyPuter/puter/pull/3743
• feat(gui): let users reposition and zoom a new profile picture by @jelveh in https://github.com/HeyPuter/puter/pull/3754
• feat: add astra to models by @Salazareo in https://github.com/HeyPuter/puter/pull/3755
• ci: add Dependabot config and patch auto-merge workflow by @Salazareo in https://github.com/HeyPuter/puter/pull/3760
• chore(deps): bump fast-uri from 3.1.0 to 3.1.7 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3756
• chore(deps): bump qs from 6.15.3 to 6.16.0 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3757
• chore(deps-dev): bump browserslist from 4.28.5 to 4.28.9 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3759
• feat: the per-app events worker runtime by @Salazareo in https://github.com/HeyPuter/puter/pull/3697
• fix: harden the events stack for flag-on by @Salazareo in https://github.com/HeyPuter/puter/pull/3752
• ci: add CODEOWNERS, restrict Dependabot to patch bumps, make test wor… by @Salazareo in https://github.com/HeyPuter/puter/pull/3778
• chore(deps): bump highlight.js from 11.11.1 to 11.11.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3779
• chore(deps): bump @prelude.so/js-sdk from 0.12.0 to 0.12.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3780
• chore(deps): bump @esbuild/linux-x64 from 0.25.11 to 0.25.12 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3781
• chore(deps): bump libphonenumber-js from 1.13.6 to 1.13.12 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3782
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3783
• chore(deps): bump mysql2 from 3.22.5 to 3.22.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3784
• chore(deps): bump sharp from 0.35.3 to 0.35.4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3786
• chore(deps-dev): bump @types/node from 24.13.2 to 24.13.3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3787
• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3788
• chore(deps): bump uuid from 14.0.1 to 14.0.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3789
• chore(deps-dev): bump vite from 8.1.3 to 8.1.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3790
• chore(deps): bump fastify from 5.10.0 to 5.12.3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3749
• fix: withdrawing background consent revokes the app's events session by @Salazareo in https://github.com/HeyPuter/puter/pull/3777
• chore(deps): bump nodemailer from 9.0.3 to 9.0.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3795
• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3793
• chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3792
• chore(deps): bump fs-extra from 11.3.5 to 11.3.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3785
• chore(deps-dev): bump @eslint/js from 9.39.4 to 9.39.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3791
• fix: keep matrix legs of test/coverage jobs always instantiated by @Salazareo in https://github.com/HeyPuter/puter/pull/3799
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3762
• chore(deps): bump shell-quote from 1.8.1 to 1.10.0 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3774
• chore(deps): bump lodash from 4.17.21 to 4.18.1 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3797
• feat: the invoking backend deploys an events worker the dispatcher cannot find by @Salazareo in https://github.com/HeyPuter/puter/pull/3807
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3767
• chore(deps): bump docker/build-push-action from 5 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3765
• chore(deps): bump actions/checkout from 3 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3764
• chore(deps): bump dependabot/fetch-metadata from 2 to 3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3763
• chore(deps): bump webpack from 5.101.3 to 5.110.3 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3800
• chore(deps-dev): bump browserstack-local from 1.5.5 to 1.5.9 in /src/gui/src/lib/jquery-ui-1.13.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3808
• fix(ai): remove retired Imagen 4 and legacy Moonshot models by @404oops in https://github.com/HeyPuter/puter/pull/3801
• Add resilient PDF thumbnails to GUI uploads by @jelveh in https://github.com/HeyPuter/puter/pull/3809
• fix(puter-js): require prompt in ai.txt2img by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3804
• feat(email): sendTransactional alias and streaming file inputs by @Salazareo in https://github.com/HeyPuter/puter/pull/3812
• chore(deps): bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3810
• fix: harden events by @Salazareo in https://github.com/HeyPuter/puter/pull/3813
• fix: events hardening by @Salazareo in https://github.com/HeyPuter/puter/pull/3814
• fix(ai): canonicalize image parts once and translate them per provider by @404oops in https://github.com/HeyPuter/puter/pull/3815
• feat: let extensions customize recommended apps by @jelveh in https://github.com/HeyPuter/puter/pull/3818
• chore(deps): bump undici from 7.29.0 to 7.29.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3821
• feat(puter.js): transferables in AppConnection.postMessage by @r58Playz in https://github.com/HeyPuter/puter/pull/3776
• chore(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3825
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3824
• fix: hardening events for shared kv by @Salazareo in https://github.com/HeyPuter/puter/pull/3827
• chore(deps): bump otpauth from 9.5.1 to 9.5.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3820
• 🏗️ PUT-1765: a seat is created, never adopted by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3720
• Teams phase 3: land the remaining three PRs on main (#3733, #3724, #3725) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3830
• add file query param by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3829
• fix: misc event hardening + perm fixes by @Salazareo in https://github.com/HeyPuter/puter/pull/3831
• chore(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3826
• chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3822
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3823
• fix(puter-js): preserve zero amount in kv incr/decr by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3802
• fix(puter-js): return key_undefined for missing kv keys by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3803
• fix(puter-js): account for base64 padding in estimateDataUrlSize by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3805
• fix: CODEOWNERS + perm dialogs outside puter dashboard/desktop by @Salazareo in https://github.com/HeyPuter/puter/pull/3833
• 🏗️ PUT-1719 + PUT-1725: two-workspace fixture and group permission grants by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3726
• 🏗️ PUT-1726 + PUT-1727 + PUT-1729: share with a workspace by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3729
• more recipes by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3819
• 🏗️ PUT-1745: enforce the forced password change on workspace seats by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3737
• 🏗️ PUT-1746 + PUT-1733: tell a member what was done to their account by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3738
• 🏗️ PUT-1732: delete a workspace seat for good, once it is disabled by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3740
• 🏗️ PUT-1735 + PUT-1737 + PUT-1738 + PUT-1739: the puter.teams SDK module, suite and docs by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3741
• 🏗️ PUT-1740 + PUT-1762: the workspace surfaces in the GUI by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3742
• 🏗️ PUT-1736: a team directory apps can read, once the team opens it by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3745
• Add gpt 2.5 image by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3839
• fix(ai): keep per-provider failures when every chat route fails by @404oops in https://github.com/HeyPuter/puter/pull/3836
• feat(ai): refresh txt2vid catalogs, retire Sora, default to Veo 3.1 Lite by @404oops in https://github.com/HeyPuter/puter/pull/3828
• Update CODEOWNERS by @Salazareo in https://github.com/HeyPuter/puter/pull/3841
• Update CODEOWNERS by @Salazareo in https://github.com/HeyPuter/puter/pull/3842
• feat: add TeamStore.countActiveSeats for the billable seat count by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3837
• feat: kv list ordering toggle + addressable path improvements by @Salazareo in https://github.com/HeyPuter/puter/pull/3843

New Contributors

• @nevrkla made their first contribution in https://github.com/HeyPuter/puter/pull/3617
• @roarzx made their first contribution in https://github.com/HeyPuter/puter/pull/3635
• @Leanderroshan07 made their first contribution in https://github.com/HeyPuter/puter/pull/3665

Full Changelog: https://github.com/HeyPuter/puter/compare/26.08.2...26.09