26.09.1

HeyPuter/puter26.09.1Sep 20, 2026by Salazareo

Upgrading?

AI Summary

This release introduces a 'share with anyone' link feature, new email APIs, and an enhanced team seat experience with plan-based limits. It also includes significant security hardening for file systems and authorization.

Key Highlights

  • New 'Share with anyone' feature allowing users to share via direct links without email addresses.
  • Enhanced team seat experience with forced password changes and plan-based limits.
  • Introduction of `puter.email.send` and email read APIs for developers.
  • Significant security hardening for authorization, file system permissions, and sharing mechanisms.
  • Paid plans now count as verified cards for the sharing gate.

Breaking Changes

  • Email driver rename
  • Tightened file system permission strings
  • Authorization hardening for sharing, events, and worker credentials

New Features

  • Team seat experience (no email required, forced password change, team label, plan-based limits)
  • Share with anyone with the link (PUT-1580)
  • Email composer API (puter.email.send)
  • Email read API
  • KV events value opt-in
  • Cost factor events
  • Sortby for recursive readdir
  • Auth message for external apps using puterjs

Full Release Notes

## What's Changed
* test: kv tests by @Salazareo in https://github.com/HeyPuter/puter/pull/3844
* fix: card verification missing email by @Salazareo in https://github.com/HeyPuter/puter/pull/3850
* fix: email driver rename by @Salazareo in https://github.com/HeyPuter/puter/pull/3853
* fix: quote and pin Infron service tiers by @404oops in https://github.com/HeyPuter/puter/pull/3852
* add email composer api (puter.email.send) by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3854
* fix: sharing, events and worker-credential authorization hardening by @Salazareo in https://github.com/HeyPuter/puter/pull/3855
* chore(deps): bump nodemailer from 9.0.6 to 9.1.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3832
* Fix/node signed batch upload by @Xcoder2003X in https://github.com/HeyPuter/puter/pull/3816
* Fix/dashboard apps files audit by @jelveh in https://github.com/HeyPuter/puter/pull/3857
* fix: bug bounty dupes by @Salazareo in https://github.com/HeyPuter/puter/pull/3858
* feat: handle sub required endpoints better by @Salazareo in https://github.com/HeyPuter/puter/pull/3859
* chore(deps): bump libphonenumber-js from 1.13.12 to 1.13.13 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3863
* chore(deps-dev): bump @types/node from 24.13.3 to 24.13.4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3862
* chore(deps): bump compression from 1.8.1 to 1.8.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3861
* fix: tighten up fs perm strings by @Salazareo in https://github.com/HeyPuter/puter/pull/3860
* chore(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3864
* chore(deps): bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3866
* chore(deps): bump peter-evans/create-pull-request from 6 to 8 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3865
* feat: the team seat experience — no email required, forced password change, team label, and plan-based limits (PUT-1792) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3846
* fix: auto create folders for fs perms by @Salazareo in https://github.com/HeyPuter/puter/pull/3873
* feat: share with anyone with the link (PUT-1580) by @Salazareo in https://github.com/HeyPuter/puter/pull/3874
* document model variants by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3875
* test: schema version is 80 since 0084 by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3888
* feat: a paid plan counts as a verified card for the sharing gate by @Salazareo in https://github.com/HeyPuter/puter/pull/3886
* fix: list a link share only while the owner's plan covers it by @Salazareo in https://github.com/HeyPuter/puter/pull/3891
* feat: tell the plan picker when a seat's plan is on the way out by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3890
* email read api by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3869
* feat: kv events value opt in by @Salazareo in https://github.com/HeyPuter/puter/pull/3894
* fix: shared kv handles also allow value opt in by @Salazareo in https://github.com/HeyPuter/puter/pull/3895
* One recipient field in the sharing dialogs, with suggestions by @jelveh in https://github.com/HeyPuter/puter/pull/3897
* feat(metering): cost factor events by @Salazareo in https://github.com/HeyPuter/puter/pull/3898
* feat(puterjs): add defensive profile picture lookup by @jelveh in https://github.com/HeyPuter/puter/pull/3899
* feat: sortby for recursive readdir by @Salazareo in https://github.com/HeyPuter/puter/pull/3900
* Add auth message for external apps using puterjs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3893
* fix: hardening of fs links + effective app + bug fixes to icloud  by @Salazareo in https://github.com/HeyPuter/puter/pull/3904
* fix: misc hardening + other fixes by @Salazareo in https://github.com/HeyPuter/puter/pull/3906
* fix: charge stat's return_shares against the share-listing budget by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3870

## New Contributors
* @Xcoder2003X made their first contribution in https://github.com/HeyPuter/puter/pull/3816

**Full Changelog**: https://github.com/HeyPuter/puter/compare/26.09...26.09.1

Related Repositories