Starstruk Logo MarkStarstruk

26.10

HeyPuter/puter26.10Oct 5, 2026by Salazareo

Upgrading?

What changed from 26.09.1 → 26.10?

AI Summary

This release features a comprehensive redesign of the Teams dashboard and introduces significant AI model updates, including Opus 5.5 and Claude Sonnet 5.5. It also strengthens security protocols, such as clickjacking protection and stricter token handling, alongside improvements to file system management and self-hosting configurations.

Key Highlights

  • Redesigned Teams dashboard with enhanced lifecycle robustness and two-factor authentication support.
  • Expanded AI capabilities with new models including Opus 5.5, Claude Sonnet 5.5, and GPT-6 variants.
  • Enhanced security measures including clickjacking protection and fixes for permission traversal vulnerabilities.
  • Improved user experience with external app login icon display and updated file sharing features.

New Features

  • Name the issuing app in share emails
  • User profiles in a system-owned store (public only for paid accounts)
  • Opus 5.5 AI model support
  • Allow browser extension origins in auth requests
  • Contact Us form with screenshot and recording support

Full Release Notes

## What's Changed
* feat: name the issuing app in share emails, and cut the digest window to 5s by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3871
* fix: a team seat's plan card names its team, and an unreadable plan is not Free (PUT-1843) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3896
* fix: make the block list bite on team shares, and unshare every re-share (PUT-1813) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3872
* show app icon when login from external app by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3905
* fix: stop disclosing invite addresses to apps, tokens and delegates by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3892
* fix: harden clickjacking by @Salazareo in https://github.com/HeyPuter/puter/pull/3912
* Redesign the Teams tab in the dashboard by @jelveh in https://github.com/HeyPuter/puter/pull/3901
* Document local Docker builds with Compose overrides by @404oops in https://github.com/HeyPuter/puter/pull/3867
* fix(ai): harden chat/video model maps and txt2vid argument guards by @404oops in https://github.com/HeyPuter/puter/pull/3887
* fix(ai-image): refresh model catalogs, unify txt2img requests, expand docs by @404oops in https://github.com/HeyPuter/puter/pull/3889
* fix(ai): send stable, non-sequential user identifiers to AI providers by @rasadregmi in https://github.com/HeyPuter/puter/pull/3856
* fix(puter-js): restore file pickers on third-party sites by @Salazareo in https://github.com/HeyPuter/puter/pull/3917
* feat: user profiles in a system-owned store, public only for paid accounts by @Salazareo in https://github.com/HeyPuter/puter/pull/3919
* fix(fs): keep a home directory on its account's username by @Salazareo in https://github.com/HeyPuter/puter/pull/3920
* fix: tests by @Salazareo in https://github.com/HeyPuter/puter/pull/3922
* fix: settle a URL file-access prompt from a grant the app already holds by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3913
* fix: restrict godmode app launches to godmode callers by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3928
* fix: bump server timeouts for better error handling by @Salazareo in https://github.com/HeyPuter/puter/pull/3929
* fix: stop leaking an unawaited permission traversal on every check by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3914
* chore(deps-dev): bump @types/node from 24.13.4 to 24.13.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3926
* chore(deps-dev): bump prettier from 3.9.6 to 3.9.8 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3925
* feat: opus 5.5 by @Salazareo in https://github.com/HeyPuter/puter/pull/3930
* fix(ai): classify upstream credit exhaustion, contain the route, redact vendor text (PUT-1870) by @404oops in https://github.com/HeyPuter/puter/pull/3927
* fix: check-app reported every app as already authorized by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3915
* feat(ai): add GPT-6 Sol and Luna and sync Claude pricing by @404oops in https://github.com/HeyPuter/puter/pull/3931
* fix: let apps read opted-in teams, scope worker listing, fix revokeReadURL by @Salazareo in https://github.com/HeyPuter/puter/pull/3933
* fix: refuse app-issued scoped tokens on events handler and worker routes by @Salazareo in https://github.com/HeyPuter/puter/pull/3935
* chore: CODEOWNERS by @Salazareo in https://github.com/HeyPuter/puter/pull/3938
* feat: allow browser extension origins in auth requests by @apirJS in https://github.com/HeyPuter/puter/pull/3907
* fix(tools): spawn npm.cmd through a shell on Windows by @rasadregmi in https://github.com/HeyPuter/puter/pull/3923
* fix: acl check by @Salazareo in https://github.com/HeyPuter/puter/pull/3939
* PUT-1868 by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3940
* fix(hosting): keep alternate-host bootstrap stubs from shadowing private apps by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3936
* fix: Teams lifecycle robustness — owner deletion, cap serialization, provisioned-account scope (PUT-1944) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3942
* Ns/worker no socket by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3944
* Bug bash fixes (PUT-1876, 1877, 1880, 1881, 1948, 1949, 1951) and KV event fan-out by plan by @Salazareo in https://github.com/HeyPuter/puter/pull/3943
* Add link to AI Builder in README by @jelveh in https://github.com/HeyPuter/puter/pull/3946
* fix: codeowners by @Salazareo in https://github.com/HeyPuter/puter/pull/3948
* fix(selfhost): configure bucket CORS in s3-init so browser uploads work by @rowin-C in https://github.com/HeyPuter/puter/pull/3934
* feat: let the Contact Us form carry screenshots and recordings by @jelveh in https://github.com/HeyPuter/puter/pull/3563
* fix(auth): bind the OIDC popup-return proof to its purpose, browser, and popup by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3937
* fix: PUT-1824 + PUT-1884 + PUT-1952 + PUT-1827 by @Salazareo in https://github.com/HeyPuter/puter/pull/3951
* self hosted mail by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3932
* fix PUT-1872 by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3952
* Fix/3638 shared link account by @rupanjana15 in https://github.com/HeyPuter/puter/pull/3845
* Remove deprecated AI chat models flagged by live model check by @AnujShrivastava01 in https://github.com/HeyPuter/puter/pull/3947
* fix(ai-ocr): sync OCR models and prices, route by model, cap input size by @404oops in https://github.com/HeyPuter/puter/pull/3949
* feat: let a team require two-factor authentication of its accounts (PUT-1988) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3950
* feat(ai): add Claude Sonnet 5.5 by @404oops in https://github.com/HeyPuter/puter/pull/3970
* fix: events docs by @Salazareo in https://github.com/HeyPuter/puter/pull/3968
* fix: app uuid fixes by @Salazareo in https://github.com/HeyPuter/puter/pull/3980
* fix: PUT-1885 PUT 1950 by @Salazareo in https://github.com/HeyPuter/puter/pull/3981
* fix: read a team back from the primary after writing it (PUT-2033) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3971
* fix: stop group permission scans re-entering the sharer's own grant (PUT-1994) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3966
* docs: easy fs sharing recipe (PUT-1958) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3973
* chore(deps): bump postal-mime from 3.0.0 to 3.0.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3983
* chore(deps-dev): bump prettier from 3.9.8 to 3.9.9 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3986
* docs: easy perms recipe (PUT-1965) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3972
* chore(deps): bump socket.io from 4.8.3 to 4.8.4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3985
* chore(deps): bump libphonenumber-js from 1.13.13 to 1.13.14 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3984
* Fix chat test mode routing to fake provider by @404oops in https://github.com/HeyPuter/puter/pull/3987
* chore(deps): bump socket.io-client from 4.8.3 to 4.8.4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3982
* fix PUT-1888 by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3992
* feat: add gpt 6.1 sol to our direct apis by @Salazareo in https://github.com/HeyPuter/puter/pull/3994
* fix: misc fixes from alert logs by @Salazareo in https://github.com/HeyPuter/puter/pull/3995
* docs: teams recipe and playground examples (PUT-1966) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3967
* PUT-1959 PUT-1960 subdomains & worker recipes by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3993
* fix(UI): Variable color in text input fields by @rowin-C in https://github.com/HeyPuter/puter/pull/3996
* fix: misc events and kv issues found during recipes by @Salazareo in https://github.com/HeyPuter/puter/pull/3997
* Revert "fix(UI): Variable color in text input fields" by @Salazareo in https://github.com/HeyPuter/puter/pull/4001
* fix: stop deleted apps and users from being resurrected by a lagging replica by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3988
* docs: easy kv recipes (PUT-1962) by @Salazareo in https://github.com/HeyPuter/puter/pull/3999
* fix: let a share recipient create entries in a folder shared with them by @jfcastro92 in https://github.com/HeyPuter/puter/pull/4000
* fix: kv path errors and ttl hardening, events subscription end and race fixes by @Salazareo in https://github.com/HeyPuter/puter/pull/4004
* chore(deps-dev): bump undici from 7.29.0 to 7.30.0 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3991
* fix: bound the inputs on the grant and token routes (PUT-1997) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/4011
* chore(deps): bump fastify from 5.12.3 to 5.12.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4009
* chore(deps): bump axios from 1.18.1 to 1.20.0 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4008
* chore(deps): bump @grpc/grpc-js from 1.14.4 to 1.14.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4010
* fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) by @Salazareo in https://github.com/HeyPuter/puter/pull/4012
* perf: batch per-app origin, canonical and hosted-backing lookups in app listings (PUT-1892) by @Salazareo in https://github.com/HeyPuter/puter/pull/4013
* chore(deps): bump fast-uri from 3.1.7 to 3.1.8 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4014
* fix: run a broadcast persistent handler in the worker or the clients, not both (PUT-1889) by @Salazareo in https://github.com/HeyPuter/puter/pull/4016
* fix: don't count failed username change towards rate limit by @Salazareo in https://github.com/HeyPuter/puter/pull/4021
* improve teams docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/4025
* Update recipes for storing a small list and store per id by @reynaldichernando in https://github.com/HeyPuter/puter/pull/4028
* contact form recipe by @reynaldichernando in https://github.com/HeyPuter/puter/pull/4029
* fix: refuse opaque origins cleanly instead of a logged 400 (PUT-1896) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/4007
* Add rate limit detail for contact form recipe by @reynaldichernando in https://github.com/HeyPuter/puter/pull/4030
* fix: return 400 when a streamed upload is shorter than its declared size by @Salazareo in https://github.com/HeyPuter/puter/pull/4023
* fix: cap FS batch array lengths (PUT-1894) by @Salazareo in https://github.com/HeyPuter/puter/pull/4024
* feat(metering): per-month allowance override for partly billed plan changes (PUT-1996) by @Salazareo in https://github.com/HeyPuter/puter/pull/4027
* fix: make app-data delete grants imply write and read (PUT-1998) by @Salazareo in https://github.com/HeyPuter/puter/pull/4022
* fix(fs): keep a vacated username off-limits to other accounts for an hour by @Salazareo in https://github.com/HeyPuter/puter/pull/4039
* chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4015
* chore(deps): bump engine.io from 6.6.9 to 6.6.11 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/4017
* add ai builder link to docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/4044
* fix(events): keep app-less scoped tokens off the account's durable rows and mailbox by @Salazareo in https://github.com/HeyPuter/puter/pull/4042
* fix: keep launch tokens out of URLs and storage (PUT-2040) by @Salazareo in https://github.com/HeyPuter/puter/pull/4038
* event based FBL implementation by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3969
* chore(ai): sync model catalogs with provider listings and deprecations by @404oops in https://github.com/HeyPuter/puter/pull/4033
* fix(ai): price speech credit gates at the charged cost and hold them in flight (PUT-1895) by @404oops in https://github.com/HeyPuter/puter/pull/4034
* fix(ai): price the chat credit gate at the factored cost (PUT-1895) by @404oops in https://github.com/HeyPuter/puter/pull/4035
* refactor(metering): route free-plan checks through isFreeSubscription (PUT-1830) by @Salazareo in https://github.com/HeyPuter/puter/pull/4046
* fix(fs): refuse renaming or moving AppData roots (PUT-2050) by @Salazareo in https://github.com/HeyPuter/puter/pull/4048
* fix: scope whoami billing details and monthly usage to the calling app (PUT-2015) by @Salazareo in https://github.com/HeyPuter/puter/pull/4050
* fix(metering): stop caching subscription answers from email-less actors and failed lookups (PUT-2002) by @Salazareo in https://github.com/HeyPuter/puter/pull/4052
* fix: own system sites by the system user by @Salazareo in https://github.com/HeyPuter/puter/pull/4056
* fix(fs): hide the issuer's home from scoped-token root listings (PUT-2053) by @Salazareo in https://github.com/HeyPuter/puter/pull/4047
* fix: keep system sites writable and their names out of reach by @Salazareo in https://github.com/HeyPuter/puter/pull/4064
* fix(auth): stop a deleted app's sessions authenticating as the next app with its uid (PUT-2049) by @Salazareo in https://github.com/HeyPuter/puter/pull/4057
* fix(events): carry handler depth onto tokens a handler mints by @Salazareo in https://github.com/HeyPuter/puter/pull/4049
* fix(auth): require a step-up to set up 2FA and a valid code to enable it by @Salazareo in https://github.com/HeyPuter/puter/pull/4051
* fix(thumbnails): bind thumbnail keys to their entry and size-bound uploads (PUT-1999) by @Salazareo in https://github.com/HeyPuter/puter/pull/4054
* fix(socket): hold unlisted free plans to the free connection cap (PUT-1830) by @Salazareo in https://github.com/HeyPuter/puter/pull/4060
* fix(fs): bind signed file URLs to the owner they were issued under by @Salazareo in https://github.com/HeyPuter/puter/pull/4053
* fix(metering): decide app-usage access in MeteringService only (PUT-2015) by @Salazareo in https://github.com/HeyPuter/puter/pull/4061
* fix(metering): keep a failed lookup's fallback out of the credit cache (PUT-2002) by @Salazareo in https://github.com/HeyPuter/puter/pull/4062
* fix(fs): keep restore metadata out of reach of anyone but the tree's owner (PUT-2050) by @Salazareo in https://github.com/HeyPuter/puter/pull/4063
* fix: clarify team directory app access by @nikhiljangid120 in https://github.com/HeyPuter/puter/pull/4031
* fix(ai-ocr): check credits for the whole document before calling the provider by @Salazareo in https://github.com/HeyPuter/puter/pull/4055
* fix: alert errors from timeouts by @Salazareo in https://github.com/HeyPuter/puter/pull/4066
* fix: drop database_id from the subdomain reclaim; MySQL has no such column by @Salazareo in https://github.com/HeyPuter/puter/pull/4067
* fix: follow-ups from the reviews of #4047, #4049, #4051, #4053, #4055 and #4057 by @Salazareo in https://github.com/HeyPuter/puter/pull/4068
* fix(apps): keep ids longer than an app uid out of the app-stats query by @Salazareo in https://github.com/HeyPuter/puter/pull/4070
* fix(ai): chat credit gate ceiling, in-flight holds and disconnects by @Salazareo in https://github.com/HeyPuter/puter/pull/4071
* chore: bump puter js ver by @Salazareo in https://github.com/HeyPuter/puter/pull/4073

## New Contributors
* @rasadregmi made their first contribution in https://github.com/HeyPuter/puter/pull/3856
* @apirJS made their first contribution in https://github.com/HeyPuter/puter/pull/3907
* @rupanjana15 made their first contribution in https://github.com/HeyPuter/puter/pull/3845
* @AnujShrivastava01 made their first contribution in https://github.com/HeyPuter/puter/pull/3947
* @nikhiljangid120 made their first contribution in https://github.com/HeyPuter/puter/pull/4031

**Full Changelog**: https://github.com/HeyPuter/puter/compare/26.09.1...26.10

Related Repositories

openclaw/openclaw★ 392,706

The AI that really does things. Any OS. Any Platform. The lobster way. 🦞

nilbuild/developer-roadmap★ 370,075

Interactive roadmaps, guides and other educational content to help developers grow in their careers.

morluto/rea★ 358,379

Reverse engineer anything with agents, from app behavior down to native binaries.

anomalyco/opencode★ 219,726

The open source coding agent.

n8n-io/n8n★ 208,261

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.