Daniel Salazar 0e0cedb02b fix(auth): no email password recovery for built-in admin accounts (#4153) ...

- /send-pass-recovery-email for `admin`/`system` (by username or email)
  returns the usual generic message, writes no token, sends no mail, and
  raises a critical alarm with the requester's IP, user agent and, when
  signed in, their user.
- /verify-pass-recovery-token and /set-pass-using-token reject recovery
  tokens for those accounts as no longer valid.

2026-10-09 18:13:22 -07:00

..

apps

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

auth

fix(auth): no email password recovery for built-in admin accounts (#4153)

2026-10-09 18:13:22 -07:00

broadcast

fix(events): single-writer presence items, live-socket counts and region-wide leave grace (PUT-1759) (#4142)

2026-10-08 23:55:55 -07:00

desktop

fix: rate limits, AI routing, and a type-check gate (#3529)

2026-08-10 19:09:47 -07:00

drivers

fix(ai): propagate cancellation and stream termination failures

2026-10-06 20:24:19 +02:00

events

fix(events): bill reached deliveries, bound dispatch reads, seal cursors (PUT-1900) (#4146)

2026-10-09 00:08:13 -07:00

feedback

✨ PUT-1497: Share file link sharing and notifications (#3595)

2026-08-18 09:36:33 -07:00

fs

fix: a signed overwrite lands on the live key only once its completion is accepted (#4136)

2026-10-09 16:22:36 -04:00

homepage

fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) (#4012)

2026-10-01 17:54:25 -07:00

hosting

fix PUT-1888 (#3992)

2026-09-29 17:06:28 -04:00

notification

chore: remove dead notification surfaces (PUT-1669) (#3673)

2026-09-01 22:04:33 -07:00

oidc

Auth limits, reborn-app tokens, seat addresses, drop-area encode (#4148)

2026-10-09 00:12:59 -07:00

peer

fix(metering): stop caching subscription answers from email-less actors and failed lookups (PUT-2002) (#4052)

2026-10-03 16:39:08 -07:00

profile

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

puterai

refactor(ai): trim redundant cancellation checks

2026-10-06 19:49:25 -07:00

share

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

static

fix: duplicate emails (#3556)

2026-08-12 22:00:48 -07:00

system

feat: let the Contact Us form carry screenshots and recordings (#3563)

2026-09-25 14:19:35 -07:00

team

fix: settle which plan an org seat resolves to, and confirm a seat's address (#4139)

2026-10-09 16:17:51 -04:00

webdav

fix(fs): hide the issuer's home from scoped-token root listings (PUT-2053) (#4047)

2026-10-04 00:22:43 -07:00

wisp

PUT-1901 (#4159)

2026-10-09 20:12:45 -04:00

index.ts

feat: user profiles in a system-owned store, public only for paid accounts (#3919)

2026-09-21 23:28:56 -07:00

types.ts

fix(ai-image): refresh model catalogs, unify txt2img requests, expand docs (#3889)

2026-09-21 15:00:02 -07:00