Changelog

Security patches

• Server: Reject workspace proxy hostname prefixes (#27544, d547bea24a) (@geokat) (GHSA-h58h-qvv5-xvwg)

Bug fixes

• Remove 403 from key failover and cooldown on 401 (#27419, c9388a1) (@ssncferreira)
• Dashboard: Backport admin settings dropdown visibility fix to release/2.35 (#27850, fe656fc)
• Update google.golang.org/grpc to v1.82.1 (#27925, fd5efa5)
• Update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27938, 81add7e)

Compare: v2.35.3...v2.35.4

Container image

• docker pull ghcr.io/coder/coder:2.35.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• fix!: require org membership for user ACLs (#26852, 85bcd5d3a3) (GHSA-7v78-w67v-pm2g)

Security patches

• Server: Reject workspace proxy hostname prefixes (#27544, d547bea24a) (@geokat) (GHSA-h58h-qvv5-xvwg)
• Redact env var values in agent debug manifest endpoint (#26904, c15ae01435) (GHSA-73wg-wxvv-9r4j)
• Prevent open redirect in proxy authentication flow (#26647, 5c059ba989) (GHSA-98qx-9p2x-c4wh)
• Only return group member count for workspace ACL (#26206, d70055a0fa) (GHSA-cvrm-2xxr-hpcv)
• Server: Scope provisioner module file downloads to the daemon's org (#26635, d6ea2bd16e) (GHSA-hrhj-hpwc-9hmc)

Bug fixes

• Server: Show correct deletion time in dormancy notification (backport #26488) (#27895, b080be4461)
• Dashboard: Backport admin settings dropdown visibility fix to release/2.34 (#27851, 350070e97d)
• Update google.golang.org/grpc to v1.82.1 (#27928, 877fbeb17f)
• Update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27940, 7bd778d881)

Compare: v2.34.7...v2.34.8

Container image

• docker pull ghcr.io/coder/coder:2.34.8

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• Dynamic client registration disabled by default (#27316)

  POST /oauth2/register (RFC 7591 Dynamic Client Registration) is now controlled by a persistent admin setting, oauth2_dcr_enabled, independent of the experiment system. The setting defaults to disabled. A new audited GET/PUT /api/v2/oauth2-provider/settings endpoint lets an owner toggle it live without a restart. When disabled, new registrations are rejected with an RFC 7591-shaped 403, and registration_endpoint is omitted from discovery metadata.

  Migration: Deployments that rely on dynamic client registration must explicitly enable the new setting via the API or UI after upgrading. Existing registered clients are unaffected; only new registrations are gated.

• login_type=none deprecated; existing accounts converted to password login (#26851)

  login_type=none (legacy passwordless machine users) is deprecated in favor of premium service accounts. A database migration (000554) automatically converts existing non-system login_type=none accounts to login_type=password. Creation of new login_type=none accounts via POST /users and coder users create (including the deprecated --disable-login flag) is now rejected unless a service account is explicitly requested.

  Migration: Automatic for existing users. Legacy login_type=none accounts will be migrated to password login on first startup after upgrading. Review any automation that creates users with login_type=none and update it to use service accounts instead.

• chat_model_configs.provider column removed (#26877)

  The provider column has been dropped from the chat_model_configs table. Provider type is now derived exclusively from the linked ai_providers row via ai_provider_id. The experimental HTTP/SDK response for model configs drops the provider field and makes ai_provider_id required; consumers should resolve provider type by joining against the AI providers listing. Telemetry continues to emit provider via a JOIN, so BigQuery columns and Nexus dashboards are unaffected.

  Migration: Update any custom queries or SDK consumers that read chat_model_configs.provider directly. Resolve provider type via ai_provider_id and the AI providers listing instead.

Features

AI Governance

Budget tracking and enforcement

User and group AI spend is now tracked, enforced, and exposed across the platform.

• Record user daily AI spend on token usage and enforce budgets on the pre-request path (#26741, #26562, #26915)
• User AI spend endpoint and group/member spend endpoints (#26978, #27123, #27130, #27568)
• Prometheus metrics for AI Governance cost control (#27490)
• CSV export for AI spend data (#27491)
• Budget threshold notifications for users and admins (#27346, #27415)
• Fall back to the Everyone group for AI spend attribution (#27364)
• Dashboard: show spend for unlimited and zero AI budgets; announce cost controls in AI Governance (#27458, #27543)
• Dashboard: polished AI budget members table (#26805)
• Network calls column and badges added to AI sessions table (#27269, #27341)

Seat counting

• Count only workspace-capable users toward license seats (#27279)
• Exclude AI Bridge usage from AI Governance seat counting (#27280)

Standalone AI Gateway

The AI Gateway can now be deployed as a standalone process with its own start command, health endpoints, observability stack, and Helm chart.

• coder ai-gateway start command (#26605)
• /healthz and /readyz endpoints (#26988)
• Logging, tracing, and metrics (#27068)
• Helm chart for standalone AI Gateway (#27256)
• --aigateway-proxy-target flag (#27122)
• Prefixed standalone metrics (#27526)
• Known-models catalog and AI Gateway price generation (#27146)
• AWS Bedrock mantle endpoint and Bedrock mantle protocol selector in the provider form (#26745, #27156)
• Generate STS external ID for Bedrock role assumption (#26869)
• Show Bedrock external ID in the provider edit form (#26919)
• Synthetic gateway keys (#27170)
• NATS mTLS pubsub implementation (#26902)

Coder Agents

Chat quality of life

• Full-text search over chat messages (#27126)
• Manual chat compaction via /compact command (#27081)
• Persisted whole-chat summary with background generation; summary tab in right sidebar with per-chat cost endpoint (#26657, #26649)
• Workspace skills available in the agent chat slash menu (#25600)
• Searchable agent model picker with instance-based grouping and custom provider icons (#26927, #27026)
• Configurable reasoning effort per agent and advisor; model and effort override in spawn_agent (#26974, #27196, #27385)
• Admins can override the chat compaction model (#27151)
• Anthropic 1M context window toggle for Agents model configs (#27257)
• Model content-filter refusals surfaced as a blocked chat error; reasoning-only refusals classified as terminal errors (#27118, #27476)
• MCP server OAuth grant disconnect UI, provider-side revocation on disconnect, and graceful handling of revoked grants (#27299, #27300, #27264)
• Chat lifecycle hooks: suffix messages, idle failure, and content updates dispatched from the backend and wired into chatd (#27401, #27428, #27429)
• Notify users when chats are shared (#26914)
• Structured error fields in wait_agent error payload; child error detail surfaced in last_error (#27478, #27477)
• WatchAIProviders synchronizes provider changes to clients in real time (#27091)
• Accumulate user daily AI spend and retain user constraints in compaction summaries (#26741, #27230)
• claude-fable-5 and claude-mythos-5 added as known model defaults (#27131)
• Support Anthropic /v1/messages route on Copilot (#26911)
• Record all tool call types and provider item IDs for tool usage (#26855, #26856)
• Remove chat chain mode and unused chat statuses (#26980, #27064)
• Add chat suffix messages, idle failure, and content update support (#27428)

Template Builder

• Improved image management experience (#27018)
• Auto-fill customization fields from the base template (#27272)
• Browser back and forward support in the wizard (#27104)
• Provisioner warning and disabled create button when no provisioners are available (#26935, #26938)
• Module deselection from the main content area (#27113)
• Template Builder session telemetry (#27124)
• Show all step content without inner scroll (#27437)

User Secrets

• User secrets file parser and shared validator (#26723)
• Bulk user secret import endpoint and SDK client (#26724)
• Bulk secret import upload in the Add secret dialog (#26725)
• Enable/disable support for user secrets (#27537)
• coder secret import CLI command for bulk secret files (#27534)
• Beta label removed; user secrets are now generally available (#27510)

RBAC & Auth

• Support multiple OIDC redirect URIs (#25408)
• Agent runtime hour license claims and entitlement feature (#27459)

Workspace & Platform

• Workspace restart functionality via API (#25757)
• Expose external auth token expiry in agent API and CLI (#26883)
• Tailnet tunnels logged to the connection log (#27423)
• Add dry-run flag via CommandExecutor interface (#26422)

Dashboard

• OSC 52 clipboard support in the web terminal (#26437)
• Confirm before batch stopping workspaces (#27631)
• Hide workspace resources when the user lacks workspace-create permission (#27278)
• Rename "Dismiss warnings" to "Mute warnings" and make health callouts dismissible (#27554)
• Show "Archived chats" sidebar heading when viewing archived chats (#26926)
• Search users by display name (#27398)
• AppearanceProvider introduced to decouple externalImages from theme (#27197)

Bug fixes

Server

• Preserve scopes on Entra v1 token refresh (#24851)
• Allow user-admin password resets to succeed (#26537)
• Recover timed out agents (#27254)
• Retry quickgen without temperature when the model rejects it (#27120)
• Remove compaction timeout (#27007)
• Clarify wait agent timeout (#27335)
• Avoid request recorder race (#27525)
• Prevent concurrent token refreshes (#26530)
• Match sync.Map semantics in the typed wrapper (#27582)
• Sanitize workspace MCP tool names (#26928)
• Reject workspace proxy hostname prefixes (#27544)
• Fix runner bootstrap race (#26989)
• Remove standalone AI Gateway HTTP listener dependency on loading providers (#27303)
• Give chat message IDs an append-order guarantee (#27495)
• Order the chat prompt query and its boundary by ID (#27619)
• Resolve duplicate 000554 migration collision (#27581)
• Explain default GitHub app org visibility on login rejection (#27374)

AI

• Handle Sonnet 5 adaptive thinking in Bedrock (#27339)
• Disable keep-alive on the STS assume-role client (#26971)
• Validate Bedrock protocol at provider construction (#27234)
• Stop sending adaptive thinking to pre-4.6 Anthropic models (#27314)
• Hide and reject chat models from disabled AI providers (#27070)
• Textualize advisor prompt tool exchanges (#27059)
• Classify aibridge 403 as ChatErrorKindUsageLimit (#27538)
• Extract plain-text provider error bodies (#27597)
• Remove chatd usage limit enforcement (#27535)
• Remove 403 from key failover; cooldown on 401 (#27419)
• Delete unused ChatMessagePart.Signature field (#27588)
• Stop manual title generation from writing to chat_messages (#27087)
• Serialize chat model config default election with advisory lock (#27114)
• Use pasted-text attachments as chat title input (#27067)
  ...

Changelog

Bug fixes

• Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) (#27148, e77a5be)
• Bump Go version from 1.26.4 to 1.26.5 (backport 2.34) (#27158, e885cf3)
• fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27261, 744439f)
• Resolve client IP from the rightmost untrusted X-Forwarded-For entry (backport 2.34) (#27236, eda3747)
• Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, ee17a3b)
• Dashboard: Replace ansi-to-html in the log viewer (#27206, ffa50fb) (@aslilac)
• Server: Harden oauth2 redirect validation (#27274, 58e20ab) (@aslilac)
• Remove 403 from key failover and cooldown on 401 (#27419, b7d2742) (@ssncferreira)

Documentation

• Documentation: Fix bmcp_ described as suffix instead of prefix (#27392, 2b9e328) (@nickvigilante)

Compare: v2.34.6...v2.34.7

Container image

• docker pull ghcr.io/coder/coder:2.34.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since August 4, 2026)

Changelog

Bug fixes

• Bump github.com/go-chi/chi/v5 v5.2.4 to v5.3.1 (#27147, abe4d01)
• Bump Go version from 1.26.4 to 1.26.5 (backport 2.35) (#27159, ae1d4ef)
• fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27259, f2653d4)
• Dashboard: Replace ansi-to-html in the log viewer (#27206, 17cbc26) (@aslilac)
• Server: Harden oauth2 redirect validation (#27274, 65e2bfb) (@aslilac)

Compare: v2.35.2...v2.35.3

Container image

• docker pull ghcr.io/coder/coder:2.35.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Bump coder/fantasy for gpt-5.6 Responses routing (#27132, d331a10) (@ibetitsmike)
• Correct gvisor replace directive to match module path (#26822, a330eff)
• Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, 5c2838a) (@jakehwll)

Documentation

• Documentation: Update release calendar for v2.35.1 (#27128, 404826a) (@denisra)

Compare: v2.35.1...v2.35.2

Container image

• docker pull ghcr.io/coder/coder:2.35.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since July 14, 2026)

Changelog

Bug fixes

• Correct gvisor replace directive to match module path (conflicts) (#26822, 92c345b) (@denisra)
• Server: Require deployment-wide workspace read permissions for W… (#27029, 94a997d)
• Dashboard: Redirect to new organization after create (#26890, db643c8) (@aslilac)
• Dashboard: Match Formik onSubmit args in Bedrock story (#27211, 660dc56)

Compare: v2.34.5...v2.34.6

Container image

• docker pull ghcr.io/coder/coder:2.34.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• Chat stream silence timeout error renamed (#25973)

  The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup.
  Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

• OIDC login rejects non-boolean or absent email_verified (#25713)

  The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants.
  Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

• OIDC/GitHub email fallback restricted to first-time linking (#25712)

  findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login.
  Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

• HostnameSuffix and SSHConfigOptions validated at startup (#26154)

  Server-side validation has been added for CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS. Invalid values will now cause coderd to exit with an error on startup. Client-side, coder config-ssh will also exit with an error if it detects invalid config. Relevant CLI reference: https://github.com/coder/coder/blob/2778abec4be28ff2f582e1d4b8c1d5adbb6ea1d5/docs/reference/cli/server.md#--ssh-config-options
  Migration: Review your CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS values before upgrading. If they contain invalid characters or formatting, coderd will fail to start. Fix the values before or during the upgrade.

• X-Forwarded-Host only trusted from configured proxies (#26204)

  X-Forwarded-Host was previously honored unconditionally for subdomain app routing. This allowed a share=authenticated app to forge the header and route requests to a victim's owner-only app. The header is now only trusted when the socket peer is in CODER_PROXY_TRUSTED_ORIGINS, matching the existing trust model for X-Forwarded-For and X-Forwarded-Proto.
  Migration: Deployments that rely on reverse proxies rewriting Host and forwarding the original in X-Forwarded-Host must configure CODER_PROXY_TRUSTED_ORIGINS with the proxy addresses. Without this, subdomain app routing will ignore X-Forwarded-Host and fall back to the received Host header.

• AI provider name collision with settings routes prevented (#26688)

  The AI providers page has moved from /ai/settings/:providerId to /ai/settings/providers/:providerId (and /ai/settings/add to /ai/settings/providers/add). The old routes allowed a provider named models to collide with the static Models page. No backward-compatibility redirects were added because a catch-all redirect would reintroduce the collision.
  Migration: Update any bookmarked or automated links from /ai/settings/ to /ai/settings/providers/ and from /ai/settings/add to /ai/settings/providers/add.

• Org membership required for user ACLs (#26852)

  Per-user ACL grants on org-scoped resources (templates, workspaces, chats) previously did not check organization membership. A user explicitly granted access retained it after being removed from the organization. The user-ACL rule now requires is_org_member, matching the existing group-ACL behavior.
  Migration: Users who have been removed from an organization but still have per-user ACL grants will lose access. Re-add them to the organization if access should be preserved.

• Interceptions API and request logs view removed (#26213)

  The GET /api/v2/aibridge/interceptions endpoint, the coder aibridge interceptions list CLI command, and the Request Logs frontend page have been removed. These have been replaced by the session-based view. The /models, /clients, and /sessions endpoints remain.
  Migration: Switch any integrations using the interceptions API to the sessions API (/api/v2/aibridge/sessions). The sessions list page in the dashboard provides equivalent functionality.

• Agents insights page removed (#26457)

  The /agents/settings/insights page and all of its backend support have been removed. The page had previously been hidden from navigation and was only reachable via deep link. Use the AI Gateway sessions page instead.
  Migration: No action needed unless you had bookmarked or automated links to /agents/settings/insights. Redirect to the AI Gateway sessions page.

SECURITY

• Honor fixed lifetime for CLI API tokens (#26376)

Features

Updated Template Creation Process

The template creation process now uses a builder that allows users to pick a base template, select commonly used modules, and then set configuration for the template. This makes it faster to make templates, with less Terraform knowledge required.

• Base templates for all major cloud providers, module catalog with 19+ modules, and go:embed wiring (#25909, #26115, #26117, #26193, #26194, #26634, #26838)
• Wizard UI: step registry, base infra selection, module selection and search/filter, module settings, customizations, prerequisites display, loading animation, and template creation (#25123, #26423, #26424, #26427, #26428, #26433, #26523, #26524, #26531, #26627, #26674, #26682, #26757, #26806, #26835, #26830, #26878, #26880, #26881)
• Backend: compose/bundle API, variable validation, base template variables, module rendering and agent name extraction (#26347, #26349, #26350, #26351, #26354, #26360, #26425, #26432, #26633)
• Entrypoint wired from templates list page (#26756)

Improvements

Coder Agents

Durable chat runtime

Chatd now uses a more reliable state machine for queues, retries, interrupts, streaming, and multi-replica operation. (#26270, #26345, #26344, #26478)

Pinned workspace context

Chats now use stable snapshots of workspace instructions, skills, and MCP context. The agent pushes context state over a new Agent API (v2.10), coderd persists snapshots and pins them per-chat, and prompt generation consumes the pinned context instead of live-reading it on every turn. The dashboard surfaces pinned context, grouped by directory, with sizes and full .mcp.json paths. (#25983, #26145, #26385, #26389, #26430, #26438, #26526, #26533, #26558, #26570, #26573, #26577, #26581, #26598, #26614, #26715)

Quality-of-life improvements

• AI Gateway naming: Renamed user-facing "AI Bridge" surfaces to "AI Gateway" across the dashboard, API routes, docs, and swagger summaries. Added a migration guide for operators. (#26161, #26165, #26475, #26567, #26569, #26700, #26704, #26854)
• Expanded provider support: Added or improved support for Bedrock cross-account AssumeRole with Role ARN UI (#26527, #26578), GitHub Copilot provider via UI (#25888), OpenCode client and session tracking (#26098, #26128), Codex hyphenated session-id header (#26346), and Opus 4.8 known model (#25839)
• Centralized AI settings: Moved models, MCP servers, template allowlist, spend, instructions, lifecycle, and Coder Agents pages into a unified AI settings section. (#26615, #26624, #26625, #26642, #26692, #26800)
• Better context visibility: The Agents UI now shows pinned context indicators, context sizes, full .mcp.json paths, and resources grouped by directory. (#26573, #26598, #26614)
• Improved Agents workspace UI: Shared chats and agents appear in the sidebar (#26056, #26328), updated search dialog with filter pills (#25753), right-panel tabs for workspace apps and ports (now GA) (#26208, #26906), multiple terminal tabs (#26089), and desktop panel toolbar with zoom modes and pop-out window (#25585)
• MCP Registry listing: Published the Coder MCP server to the official MCP Registry. (#21673)
• Improved sub-agent orchestration tools (#26673)
• Workspace skill directory returned from read_skill (#26713)
• Tool output capped to fit the model context window (#26637)
• Agent session env unified via EnvInfoer (#26099)

AI Governance

The Cost Control and Session Correlation projects are slated for future releases, but significant groundwork has been laid in 2.35.

Cost Control

User and group AI budget management, including override endpoints, effective budget resolution, cost recording on token usage, experiment flag, and dashboard UI for user/group budget columns and s...

Changelog

Features

• Add INSECURE oidc email fallback flag for IdP brokers (#26751, 8266eb0)

Bug fixes

• Server: Enforce required external auth on workspace create (#26314, 98bca81)
• Dashboard: Add a custom copy/paste menu to the web terminal (#26015, 9513245)
• Examples: Remove vscode-desktop module from quickstart to avoid duplicate VS Code Desktop (#26789, 210bb5e) (@bpmct)
• Dashboard: Show only parent agent apps in workspaces table (#26568, c3dd41e)

Documentation

• Add GitLab read_api scope change to ESR upgrade guide (backport #26829) (#26840, 85d7837)

Compare: v2.34.4...v2.34.5

Container image

• docker pull ghcr.io/coder/coder:2.34.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since June 30, 2026)

Changelog

Features

• Add INSECURE oidc email fallback flag for IdP brokers (#26751, 0cfa936)

Bug fixes

• Server: Enforce required external auth on workspace create (#26314, 30f8b64)

Compare: v2.33.10...v2.33.11

Container image

• docker pull ghcr.io/coder/coder:2.33.11

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.