Skip to content

chore(internal-dependencies): update ghcr.io/coder/coder (v2.35.6 -> v2.38.5) - #975

Open
ppat-self-hosted-renovate-bot[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-coder-coder-2.x
Open

chore(internal-dependencies): update ghcr.io/coder/coder (v2.35.6 -> v2.38.5)#975
ppat-self-hosted-renovate-bot[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-coder-coder-2.x

Conversation

@ppat-self-hosted-renovate-bot

@ppat-self-hosted-renovate-bot ppat-self-hosted-renovate-bot Bot commented Nov 2, 2026 •
edited by ppat
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ghcr.io/coder/coder minor v2.35.6 → v2.38.5

Release Notes

coder/coder (ghcr.io/coder/coder)

v2.38.5

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

Compare: v2.38.4...v2.38.5

Container image

  • docker pull ghcr.io/coder/coder:v2.38.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.38.4

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

Compare: v2.38.3...v2.38.4

Container image

  • docker pull ghcr.io/coder/coder:v2.38.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.38.3

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes
  • Bump Go to 1.26.10 and terraform to 1.16.7 (backport 2.38) (#​31302, 5bb296e)
Tests
Chores

Compare: v2.38.2...v2.38.3

Container image

  • docker pull ghcr.io/coder/coder:2.38.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.38.2

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

Compare: v2.38.1...v2.38.2

Container image

  • docker pull ghcr.io/coder/coder:2.38.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.38.1

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes
  • Reject encoded path traversal in ai gateway before forwarding upstream (#​30178, e21f785)
  • Documentation: Backport release calendar and install version updates to release/2.38 (#​30739, 6a4301f)
  • Bump Go version from 1.26.5 to 1.26.9 (backport 2.38) (#​30808, f2dba87)
  • Bump bundled terraform to 1.16.6 for 2.38 (#​30522, 75026e3)
  • Bump golang.org/x/net to v0.60.0 (backport 2.38) (#​30814, 434642b)
  • fix(aibridge/intercept/messages): treat Bedrock Opus 5, Haiku 5.5, Fable 5, and Mythos 5 as adaptive-only (#​30692, 3203c01)
Continuous integration

Compare: v2.38.0...v2.38.1

Container image

  • docker pull ghcr.io/coder/coder:2.38.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.38.0

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Tasks fully deprecated and removed

    Tasks are fully deprecated and removed in Coder v2.38.

    Migration: Users who rely on Tasks can stay on the v2.34 Extended Support Release during the support period.

  • Experimental chat API mounts removed (#​29548)

    The experimental chat API mounts have been removed. The new /api/v2 routes are now the only supported path.

    Migration: Update any clients or automation that call the experimental chat API mounts to use the /api/v2 routes.

  • MCP servers on internal networks must be allowlisted (#​28242)

    Connections to MCP servers on internal networks now require their address ranges to be allowlisted with --mcp-allowed-private-cidrs.

    Migration: After upgrading, add the CIDRs of any internal MCP servers to --mcp-allowed-private-cidrs, or those connections will fail.

  • Embedded NATS is now the default pubsub between coderd replicas (#​29283)

    Coder now carries real-time events between coderd replicas over embedded NATS by default, instead of Postgres LISTEN/NOTIFY. Each replica runs an embedded NATS server and meshes with the others, with automatic mutual TLS for Enterprise. The API, CLI, and dashboard are unchanged. The nats_pubsub experiment has been removed.

    Migration: Before upgrading HA deployments, allow TCP port 6222 in both directions between every pair of replicas. With custom relays, set CODER_CLUSTER_HOST, or Coder falls back to Postgres pubsub. To stay on Postgres pubsub, enable the no_nats_pubsub experiment and restart coderd. No data migration is needed. See the high availability docs.

Features
Coder Agents
New models and org-wide defaults
  • Support for GPT-6 Sol, GPT-6 Luna, GPT-6.1 Sol, Claude Opus 5.5, and Claude Sonnet 5.5 (docs)
  • Non-Anthropic models via AWS Bedrock Mantle
  • Admins can set an org-wide default model under AI > Coder Agents settings; new chats use the org default instead of each user's last pick (docs)
Large file uploads
  • Files outside the inline attachment allowlist (zips, datasets, tarballs, etc.) stream directly to the workspace filesystem with no size cap; the model only sees a path reference, not the file bytes
  • Works from both existing chats and the new chat page; the UI routes attachment-compatible types inline and everything else to the workspace
Chat management
  • Filter chats by status and PR status, including "no PR" (docs)
  • Mark chats read or unread
  • Reworked sidebar with a dropdown filter and section switcher
  • /clear command to reset context mid-conversation
  • Shareable prompt links that prefill the composer from a URL
AI Gateway
Claude Platform on AWS
  • New "Claude Platform for AWS" option on Anthropic providers, configured with a region and workspace ID; no extra signing proxy required (docs)
  • Authenticate with stored Claude Platform API keys, or fall back to the gateway's ambient AWS IAM credentials via SigV4 when no key is present
  • Standard Anthropic model IDs and the full Messages API are preserved, along with central governance, usage attribution, and auditing
Bedrock IAM role authentication
  • New provider.Bedrock with AWS SigV4 middleware; credentials resolve via static keys, the ambient credential chain, or AssumeRole, enabling IAM role and IRSA-based auth (docs)
  • OpenAI Chat Completions and Responses wire protocols over Bedrock's Mantle inference endpoint, alongside Anthropic Messages
  • Budgets, rate limits, BYOK policy, and full interception recording (prompts, tokens, tool calls) continue to work unchanged
RBAC & Auth
  • OAuth 2.1 support for standards-based application access, available behind a feature flag (docs)
  • Admins can restrict OAuth apps to specific scopes
Workspace & Platform
  • Embedded NATS pubsub for high-availability deployments (#​29283); see Breaking Changes
Related releases
Coder VS Code Extension v1.16.4
  • Fix Windows SSH "Bad owner or permissions" errors
  • Workspace updates land on the correct template version (Coder 2.36+), with a prompt if an update fails
  • Debug logs are captured automatically on connection failure

View the docs and the v1.16.4 changelog.

envbox v0.6.9
  • Builds default to the host architecture, preventing mixed-architecture images when building locally
  • Sysbox checksums are matched to the target platform automatically, fixing checksum failures on ARM64 and ARM64 cross-builds
  • Remediated CVEs: bumped Go to 1.26.6 and updated Coder, gRPC, and DataDog tracing dependencies

View the full envbox changelog and the commit comparison.

Compare: v2.37.0...v2.38.0

Container image

  • docker pull ghcr.io/coder/coder:v2.38.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.9

Compare Source

Stable (since October 30, 2026)

Changelog

Bug fixes

Compare: v2.37.8...v2.37.9

Container image

  • docker pull ghcr.io/coder/coder:v2.37.9

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.8

Compare Source

Stable (since October 28, 2026)

Changelog

Bug fixes

Compare: v2.37.7...v2.37.8

Container image

  • docker pull ghcr.io/coder/coder:v2.37.8

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.7

Compare Source

Stable (since October 27, 2026)

Changelog

Bug fixes
  • Bump Go to 1.26.10 and terraform to 1.16.7 (backport 2.37) (#​31303, b40ba6e)
Tests
Chores

Compare: v2.37.6...v2.37.7

Container image

  • docker pull ghcr.io/coder/coder:2.37.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.6

Compare Source

Stable (since October 23, 2026)

Changelog

Bug fixes

Compare: v2.37.5...v2.37.6

Container image

  • docker pull ghcr.io/coder/coder:2.37.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.5

Compare Source

Stable (since October 19, 2026)

Changelog

Bug fixes
  • Reject encoded path traversal in ai gateway before forwarding upstream (#​30178, 4bb5c68)
  • Bump bundled terraform to 1.16.6 for 2.37 (#​30552, 8885b51)
  • Bump golang.org/x/net to v0.60.0 (backport 2.37) (#​30815, a7437bc)
  • Bump Go version from 1.26.5 to 1.26.9 (backport 2.37) (#​30809, 8934626)
  • fix(aibridge/intercept/messages): treat Bedrock Opus 5, Haiku 5.5, Fable 5, and Mythos 5 as adaptive-only (#​30692, c1c10c6)
Continuous integration

Compare: v2.37.4...v2.37.5

Container image

  • docker pull ghcr.io/coder/coder:v2.37.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.4

Compare Source

Stable (since October 14, 2026)

Changelog

Bug fixes
Documentation

Compare: v2.37.3...v2.37.4

Container image

  • docker pull ghcr.io/coder/coder:2.37.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.3

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes
Chores

Compare: v2.37.2...v2.37.3

Container image

  • docker pull ghcr.io/coder/coder:2.37.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.2

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes
Documentation

Compare: v2.37.1...v2.37.2

Container image

  • docker pull ghcr.io/coder/coder:2.37.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.1

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Features
Bug fixes
Documentation

Compare: v2.37.0...v2.37.1

Container image

  • docker pull ghcr.io/coder/coder:2.37.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.37.0

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#​28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#​28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#​28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#​27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#​27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: If a template declares several providers that match the same host, give them non-overlapping CODER_EXTERNAL_AUTH_<N>_REGEX values or fetch the token with an explicit ID via coder external-auth access-token <id>. If a template declares a provider that was renamed or removed, restore that provider or update the template declaration. Declaring the intended provider in templates is recommended but not required.

  • login_type=none deprecated; existing accounts converted to password login (#​26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#​28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

  • Coder Agents model configurations and overrides are organization-scoped (#​27955, #​27959, #​28440, #​28442, #​28704)

    Coder Agents model configurations and overrides are now organization-scoped. Existing model configurations are assigned to the default organization and are not copied to other organizations. Existing deployment-level and personal model overrides are not migrated. API integrations must use the organization-scoped model endpoints; the separate model-availability endpoint has been removed and its availability data is now included in the models response.

    Migration: Configure a usable default model for each organization that uses Coder Agents, and reselect any deployment-level and personal model overrides. Update API integrations to use the organization-scoped model endpoints and read availability data from the models response.

  • MCP server configuration is organization-scoped (#​27942)

    MCP server configuration is now organization-scoped. Existing configurations retain their credentials and move to the default organization; other organizations must configure their own MCP servers.

    Migration: Configure MCP servers for each organization that needs them, and migrate API consumers from the deployment-scoped experimental routes to the organization-scoped routes.

  • Native chat spend limits removed in favor of AI Gateway budgets (#​27329)

    Native chat spend limits are removed in favor of AI Gateway budgets. Limits are not migrated, and deployments without AI Gateway entitlement lose chat-spend enforcement.

    Migration: Move chat-spend enforcement to AI Gateway budgets. Deployments without AI Gateway entitlement will no longer enforce chat spend.

SECURITY
Features
Coder Agents

Coder Agents is now generally available: production-ready, commercially supported self-hosted infrastructure for AI coding workflows, from interactive development to headless background work. This release introduces deeper organization-level administration, agent time licensing and usage controls, a stable Chats API, and substantial improvements to chat performance, reliability, and usability.

Chat lifecycle hooks

New backend dispatch, chatd wiring, and dashboard surfacing for chat lifecycle hooks, including suffix messages, idle-failure and content-update support, change visibility, and an insecure-HTTP escape hatch for hook URLs.

  • Lifecycle hook dispatch backend and chatd wiring (#​27401, #​27429)
  • Suffix messages, idle failure, and content-update support (#​27428)
  • Surface hook outcomes in the chats UI and show what a hook changed (#​27430, #​27655)
  • --chat-hook-allow-insecure to allow plain HTTP hook URLs (#​27896)
MCP: migration to the official Go SDK

Migrated every MCP surface (coderd server, exp mcp stdio server, external client, workspace agent client, and the aibridge injected-MCP proxy) to the official MCP Go SDK. (#​28056, #​28057, #​28058, #​28059, #​28060)

MCP server configs, tools, and sharing
  • Org-scoped MCP server configs with group/user ACLs, an org picker on settings pages, and audit logging (#​27943, #​27944, #​28150)
  • Allow sharing MCP servers with users and groups (#​28593)
  • Add Coder Agents chat tools to the MCP toolsdk; defer tool schemas behind a find_tools search (#​28025, #​28225)
  • Extend agent chat MCP tools for remote UAT evidence loops (#​28233)
  • Remove task management MCP tools (#​28354)
Subagents & providers
  • Surface subagents in the chat sidebar and render list_subagent_models tool results (#​28234, #​28116)
  • Limit concurrent chat agents with pooled admission (#​27902)
  • Per-model OpenAI Responses API toggle (#​27683)
  • Apply reasoning effort and surface thinking blocks for Google chat models (#​28273)
Chat search

Full-text chat search wired into the search box, with cache invalidation and chats-by-workspace cache reconciliation. (#​27973, #​27892, #​27901)

agent-browser

Built-in Browser tab for agent-browser, plus the dogfood live-preview app. (#​27910, #​27838)

Agents workspace UI
  • Consolidate the git panel tab strip into a view-switcher dropdown; move the PR icon to the diff line, center the unread dot, and persist the kebab (#​27012, #​28326)
  • Redesign the advisor tool row; add a provider icon to the chat model selector (#​28069, #​28330)
  • Label process_output rows with the process command; migrate agent chat scrolling; dim unselected sidebar chat titles (#​28300, #​28130, #​28382)
  • Add download and export for personal skills (#​28032)
Per-template Coder Agents access control

Per-template access control with dashboard controls and a --agents-allowed CLI flag. (#​27285, #​27514, #​27517)

Auditing
  • Audit chat system instructions changes and operational agent settings (#​27668, #​28369)
AI Governance
Cost Control & budgets

Cost tracking now flows through AI Gateway rather than native chat tracking, with a group AI spend endpoint, estimated-spend labeling, and admin budget notifications.

  • Back the per-chat cost endpoint with AI Gateway data; remove native chat cost tracking (#​27328, #​27330)
  • Group AI spend endpoint; label AI spend as estimated (#​27568, #​27584)
  • CTAs on AI budget admin notifications (#​28138)
  • Announce the cost controls move to AI Governance (#​27543)
AI model price book
  • Automate a weekly AI model price-book refresh; experimental CLI to price unpriced models (#​28146, #​27926)
  • Distinguish default vs. custom prices, support custom prices, and add a source filter; show best-effort pricing on the model form (#​28204, #​28328, #​28329, #​28290)
Agent runtime hours (billing & licensing)

Metering and billing for Coder Agent runtime, surfaced through license entitlements and a per-license Products section.

  • Hourly hb_agent_runtime_v1 usage events and runtime-hour license claims/entitlement (#​27312, #​27459)
  • Report runtime-hour usage in entitlements; tolerate unusable claims and decode -1 as unlimited (#​27985, #​27984)
  • Per-license Products section with Coder Agents price gates; show total agent hours on the licenses page (#​28051, #​27953)
  • Harden runtime instrumentation for billing; bill completed and interrupted tool batches and record live tool-execution stamps (#​27451, #​28360, #​28361, #​28362)
AI Gateway sessions
RBAC & Organizations
  • Organization-scoped chat models: RBAC resource, org-scoped model usage, telemetry org IDs, and audit logging (#​27957, #​27960, #​27956, #​28439)
  • Enable Coder Agents for organization members (#​28186)
  • Server-side search and pagination for the groups page, plus a paginated groups API endpoint (#​27994, #​27603)
  • Search users by display name; username/email user search filters (#​27398, #​27922)
  • Promote the MinimumImplicitMember experiment to GA (#​27472)
  • Unhide the --oidc-redirect-url server option (#​28072)
OAuth2 & Identity
  • Admin-controlled dynamic client registration exposed in deployment settings (#​27480)
  • Public OAuth2 clients: schema-layer public client tokens, register public clients without a secret, and scope columns / single-use delete queries (#​27712, #​28046, #​28007)
  • Modernize the OAuth2 applications settings UI; constrain the client-type column; derive client type from token_endpoint_auth_method (#​27562, #​27931, #​28043)
  • Compare scopes by permission coverage (#​28167)
Workspaces & Templates
  • Template creation builder: redirect to the builder after first-time setup, make sidebar steps navigable / scroll to module on click, and tighten the base-infra step grid and typography (#​27670, #​28153, #​27351, #​27797)
  • Confirm before batch-stopping workspaces (#​27631)
  • Include agent metadata in workspace list responses (#​27934)
  • Hide workspace resources when lacking workspace-create permission (#​27278)
Secrets
  • coder secret import for bulk secret files, with bulk import upload in the Add secret dialog (#​27534, #​26725)
  • Enable/disable support for user secrets (#​27537)
Dashboard & Platform
  • Premium paywalls and badging: appearance settings and external-auth settings paywalls, premium badging, updated paywall component/copy linked to feature docs, CTA/form handling, and conversion telemetry (#​27948, #​28435, #​27847, #​28070, #​28339, #​28226, #​28425)
  • Add "Install Coder Desktop" to the user dropdown; replace the proxy emoji with a latency radio icon (#​28244, #​28128)
Infrastructure & Observability
  • Log tailnet tunnels to the connection log; correlate request logs and spans by client_session_id (#​27423, #​27671)
  • Add a workspace agent session-count protocol (#​28125)
  • Helm: make the HTTPS redirect status code configurable (#​27360)
  • Log rate-limited external-auth token validation; add a redirect-URL override for external auth (#​26754, #​28082)
Bug fixes
Security & authentication

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone US/Eastern)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@ppat-self-hosted-renovate-bot

ppat-self-hosted-renovate-bot Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Rebase not applied

This branch has not been rebased, as its update has not yet met the internal checks configured for it, such as minimumReleaseAge. Rebasing it now would add a dependency version which is still within its configured observation period.

Renovate will rebase this branch once its update has met those checks.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

pr-type:renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants