Changelog

Security Update

• Update react to apply patch for CVE-2025-55182 (#21084) (#21168, 59cdd7e)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.29.0...v2.29.1

Container image

• docker pull ghcr.io/coder/coder:v2.29.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since December 09, 2025)

Changelog

Security Update

• Update react to apply patch for CVE-2025-55182 (#21084) (#21175, df47153)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.28.5...v2.28.6

Container image

• docker pull ghcr.io/coder/coder:v2.28.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since December 09, 2025)

Changelog

Security Update

• Update react to apply patch for CVE-2025-55182 (#21084) (#(21176, 1276135)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.27.8...v2.27.9

Container image

• docker pull ghcr.io/coder/coder:v2.27.9

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• chore!: allow coder MCP tools to not be injected (#20713, 04f809f) (@dannykopping)

  Coder MCP tools were previously automatically injected; this will now need to be explicitly enabled with CODER_AIBRIDGE_INJECT_CODER_MCP_TOOLS=true

• feat(cli)!: enable keyring usage by default (#20851, 6238a99) (@zedkipp)

  In order to move away from storing the CLI session token in plain text file, this change begins using the operating system keyring for CLI session token storage by default on Windows and macOS. This will be a breaking change for any users depending on the session token being stored to or read from disk. Users can opt-out and restore file usage via the --use-keyring=false flag.

• refactor!: remove TaskAppID from codersdk.WorkspaceBuild (#20583, d80b5fc) (@DanielleMaywood)

  The task_app_id field has been removed from the codersdk.WorkspaceBuild struct and API responses. If your code or integrations rely on WorkspaceBuild.task_app_id to identify the task's associated app, you should migrate to using Task.WorkspaceAppID instead (available on the Task object directly). The deprecated ai_task_sidebar_app_id field remains temporarily but also points to the new location.

Features

Bridge

• Add page for ai-bridge interception logs (#20331, 3bb7975) (@jakehwll)
• Add duration to the Request Logs details (#20756, f559e51) (@jakehwll)
• Add configurable retention for aibridge (#20828, 5a7d4f6) (@dannykopping)
• Expose aibridged metrics (#20865, c6631e1) (@dannykopping)

CLI

• Optionally store session token in OS keyring (#20256, 139dab7) (@zedkipp)
• Add macOS support for session token keyring storage (#20613, 5e85663) (@zedkipp)
• Promote tasks commands from experimental to GA (#20916, ad8ba4a) (@mafredri)

Dashboard

• Fix build timeline to include entire stage timings (#20805, aff2080) (@Emyrk)
• Associate task icon with workspaces (#20834, 2a9afc7) (@ssncferreira)
• Add startup script error alerts to Task Page (#20820, 8e22cd7) (@DanielleMaywood)
• Use display name field for tasks (#20918, 2f399ea) (@ssncferreira)

Experimental Features

• Add agent unit manager (#20715, 500c17e) (@SasSwart)
• Add agent socket API (#20717, 2840fdc) (@SasSwart)
• Implement agent socket api, client and cli (#20758) (#20976, abe66a3)

MCP Server

• Support workspace name in get workspace tool (#20474, 77e2521) (@code-asher)

Server

• Add prebuild invalidation via last_invalidated_at timestamp (#20582, d004710) (@mtojek)
• Purge expired api keys in dbpurge (#20863, cefe07d) (@Emyrk)
• Add lookup task by name in httpmw.TaskParam (#20647, 34f6e72) (@johnstcn)
• Add task prompt modification endpoint (#20811, 82f525b) (@DanielleMaywood)

Tasks

• Promote Tasks to GA (#20923, 02bac71) (@mafredri)
• Add notification warning alert to Tasks page (#20900, f8d9a80) (@ssncferreira)

Bug Fixes

• Fix incorrect rendering of RBAC in Helm chart when workspacePerms=false (#20569, 30d2fc8) (@rowansmithau)
• Use correct slog arguments (#20721, dc21699) (@spikecurtis)
• Retain searchParams in paginatedInterceptions during filter updates (#20725, 903c045) (@jakehwll)
• Send prebuild job notification after job build db commit (#20693, ca94588) (@ssncferreira)
• Send all params instead of only touched params (#20740, 14f0844) (@jaaydenh)
• Correctly set touched for autofill dynamic parameters (#20769, 6067aa3) (@jaaydenh)
• Set codersdk.Task current_state during task initialization (#20692, 16b8e60) (@ssncferreira)
• Add cache for terraform installer files (#20776, 158243d) (@pawbana)
• Rename AI Governance to AI Bridge (#20790, 52f8143) (@jakehwll)
• Wait for build in task status load generator (#20800, 8ee6e94) (@spikecurtis)
• Ensure embedded-postgres state is wiped between retries (#20809, b4cc982) (@zedkipp)
• Improve http connection pooling for smtp notifications (#20605, 6d41bfa) (@kacpersaw)
• Allow agents to be created on dormant workspaces (#20909, c12303f) (@DanielleMaywood)
• Ensure we check if the user can actually see ai bridge (#20964, cd9d3ef)
• Show task display name in task topbar (#20957) (#20980, 10e70f8) (@ssncferreira)
• Pass context with authorization to agentapi (#21045, c94c470)
• Server: Ensure lifecycle executor has sufficient task permissions (#20539, 06dbada) (@DanielleMaywood)
• Server: Gate AI task notifications on agent ready state (#20690, f2a1a7e) (@DanielleMaywood)
• Enterprise: Preserve actual error when getting provisioner key details (#20813, c12bba4) (@ethanndickson)
• Dashboard: Hide empty tasks list when templates are empty (#20845, 83966e3) (@DanielleMaywood)
• Dashboard: Remove erroneous "install Cursor" notification for Cursor Desktop (#20875, 9c2f94b) (@AloofBuddha)
• Dashboard: Only show active tasks in waiting for input tab (#20933) (#20955, c0a2522)
• Dashboard: Distinguish JB Toolbox from Gateway (#20830, 426cc98) (@phorcys420)
• Pass context with authorization to agentapi (#20959, d22d34e) (@cstyan)
• Ensure we check if the user can actually see AI Bridge (#20942, caf711d) (@jakehwll)
• Only show active tasks in waiting for input tab (#20933, b7d8918) (@mafredri)
• Remove defaulting to keyring when --global-config set (#20943, bbf7b13) (@zedkipp)
• Remove a sensitive field from an agent log line (#20968, 1d726c8) (@SasSwart)

Documentation

• Add OIDC documentation for Microsoft Entra ID user auth (#20202, 1d1e1f9) (@PhoenixSheppy)
• Add client configuration section and support matrix for AI Bridge (#20640, c21b3e4) (@matifali)
• Reflect steps required to enable coder MCP tool injection (#20735, c69eb7c) (@dannykopping)
• Add API key scopes documentation (#20742, a272843) (@Emyrk)
• Improve boundary docs (#20806, a83328c) (@evgeniy-scherbina)
• Fix ANTHROPIC_BASE_URL example in AI Bridge client docs (#20853, 3fe29ec) (@matifali)
• Standardize "AIBridge" to "AI Bridge" in documentation (#20831, 6364089) (@matifali)
• Add migration guide for provider version 2.13.0 (#20426, b6935c3) (@johnstcn)
• Document key scopes for OpenAI and Anthropic for aibridge (#20903, 823009d) (@dannykopping)
• Document bedrock setup process for aibridge (#20956) (#20966, dfa25d5)

Performance improvements

• Use a single query for notification target lookups (#20574, e49c917) (@ethanndickson)
• Improve performance of metricsAggregator path by reducing memory allocations (#20724, 658e8c3) (@cstyan)
• Reduce DB calls to GetWorkspaceByAgentID via caching workspace info (#20662, b0e8384) (@cstyan)
• Optimize migration 371 to run faster on large deployments (#20906, a926157) (@geokat)
• Add index to improve the GetWorkspaceAgentByInstanceID query performance (#20936, c87c33f) (@mykyta-protsenko)
• Database: Limit GetLatestWorkspaceAppStatusByAppID to 1 row (#20917, 37fc664) (@mafredri)

Chores

• Graduate aibridge API out of experimental (#20523, b20fd6f) (@dannykopping)
• Graduate aibridge cli out of experimental (#20524, dcfd6d6) (@dannykopping)
• Add API key ID to interceptions (#20513, 991831b) (@pawbana)
• Implement persistent terraform directories (experimental) (#20563, 9ca5b44) (@Emyrk)
• Per template opt into cached terraform directories (#20609, fe3b825) (@Emyrk)
• Add timing flag context to warn message (#20772, 86c4948) (@dannykopping)
• Protect build timings insert for invalid enums (#20821, a10c5ff) (@Emyrk)
• Update OIDC scopes to include offline_access (#20876, a6581c7) (@rowansmithau)
• Promote tasks to stable from experimental (#20921, b255827) (@DanielleMaywood)
• Actually store translated token metadata (#20929, e340560) (@dannykopping)

Compare: v2.28.4...v2.29.0

Container image

• docker pull ghcr.io/coder/coder:v2.29.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since Dec 2, 2025)

Changelog

Bug fixes

• Do not notify marked for deletion for deleted workspaces (#20937) (#20945, ed5785f)
• Allow agents to be created on dormant workspaces (#20909) (#20912, d81d7ee)

Performance improvements

• Optimize migration 371 to run faster on large deployments (#20906) (#21042, 8d18875) (@geokat)

Compare: v2.28.4...v2.28.5

Container image

• docker pull ghcr.io/coder/coder:v2.28.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since December 01, 2025)

Changelog

Bug fixes

• Do not notify marked for deletion for deleted workspaces (#20937) (#20944, 5ed27e7)
• Allow agents to be created on dormant workspaces (#20909) (#20911, 42f06c8)

Performance improvements

• Optimize migration 371 to run faster on large deployments (#20906) (#21041, 5098e02) (@geokat)

Compare: v2.27.7...v2.27.8

Container image

• docker pull ghcr.io/coder/coder:v2.27.8

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BUG FIXES

• purge expired api keys in dbpurge (#20863) #21040

Compare: v2.26.5...v2.26.6

Container image

• docker pull ghcr.io/coder/coder:v2.26.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

SECURITY FIXES

• Remove a sensitive field from an agent log line (#20968) (#20972, e2a4639)

Bug fixes

• Backport dynamic parameters fix #20740 (#20777, 8765352)
• Backport fix #20769 to 2.28 (#20872, aa5b22c)

Compare: v2.28.3...v2.28.4

Container image

• docker pull ghcr.io/coder/coder:v2.28.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since November 27, 2025)

Changelog

SECURITY FIXES

• Remove a sensitive field from an agent log line (#20968) (#20971, 06c6abb)

Bug fixes

• Backport fix #20740 to 2.27 (#20778, bef0766)
• Backport fix #20769 to 2.27 (#20871, db0f0aa)

Compare: v2.27.6...v2.27.7

Container image

• docker pull ghcr.io/coder/coder:v2.27.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

SECURITY FIXES

• Remove a sensitive field from an agent log line (#20968) (#20970, a75205a)

Compare: v2.26.4...v2.26.5

Container image

• docker pull ghcr.io/coder/coder:v2.26.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.