Juan Castro 57f4b6107e test: pin the mint route against the account's own token ...

`/auth/create-access-token` carries only `requireAuth`, so it never showed up
in the sweep over `requireUserActor` routes — the refusal lives in
`AuthService.createAccessToken`, which turns away any access-token actor
outright. That holds today, and a leaked full-access token minting itself a
sibling that survives revoking the original is exactly what the token swap is
meant to rule out, so it is worth a test rather than a reading.

2026-10-02 15:33:58 -04:00

..

backend

test: pin the mint route against the account's own token

2026-10-02 15:33:58 -04:00

cli

PUT-1477 Add fs commands to cli (#3746)

2026-09-04 21:31:33 +07:00

dev-center

fix: app uuid fixes (#3980)

2026-09-28 19:43:23 -07:00

docs

Merge pull request #4007 from HeyPuter/juancastro/put-1896-file-and-sandboxed-iframe-origins-get-a-hard-400-and-cant

2026-10-02 09:58:13 -04:00

gui

Merge pull request #4007 from HeyPuter/juancastro/put-1896-file-and-sandboxed-iframe-origins-get-a-hard-400-and-cant

2026-10-02 09:58:13 -04:00

mcp-connector

fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) (#4012)

2026-10-01 17:54:25 -07:00

puter-js

fix: close /open_item to tokens, and stop the node runner leaking sockets

2026-10-02 14:18:56 -04:00

worker

Ns/worker no socket (#3944)

2026-09-24 18:55:10 -04:00

worker-types

metering: big fixes to metering + jsdoc types (#3547)

2026-08-12 01:06:04 -07:00