Changelog

Chores

Bug Fixes

• fix: early oidc refresh with fake idp tests (cherry 2.31) (#22716, deaacff) (@Emyrk)

Compare: v2.31.2...v2.31.3

Container image

• docker pull ghcr.io/coder/coder:v2.31.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Chores

• Prematurely refresh oidc token near expiry during workspace (cherry 2.31) (#22606, 2828d28) (@Emyrk)

Compare: v2.31.1...v2.31.2

Container image

• docker pull ghcr.io/coder/coder:v2.31.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• feat(cli)!: expire tokens by default (#21783, 4a3304f) (@johnstcn)

  Calling this out as a breaking change in case existing consumers of the CLI depend on being able to see expired tokens OR being able to delete tokens immediately.
  Updates the coder tokens rm command to immediately expire a token by ID, preserving the token record for audit trail purposes. Tokens can still be deleted by passing --delete.

• feat(site)!: add consent prompt for auto-creation with prefilled parameters (#22011, 60e3ab7) (@kacpersaw)

  Links using mode=auto (e.g., "Open in Coder" buttons) will no longer silently create workspaces. Users will now see a consent dialog and must explicitly confirm before the workspace is provisioned. Any existing integrations or automation relying on mode=auto for seamless workspace creation will now require manual user interaction.

• fix!: remove deprecated prometheus metrics (#21788, 036ed56) (@mtojek)

  Removes the following deprecated Prometheus metrics:
  - coderd_api_workspace_latest_build_total → use coderd_api_workspace_latest_build instead
  - coderd_oauth2_external_requests_rate_limit_total → use coderd_oauth2_external_requests_rate_limit instead

Features

AI Governance

• Add client column to aibridge_interceptions table (#21839, 90c11f3) (@pawbana)
• Dashboard: Infer model family icon from model name in AI Bridge logs (#22022, 8e9638c) (@ssncferreira)
• Dashboard: Add Copilot as a provider option in AI Bridge logs filter (#22023, 5cf9795) (@ssncferreira)
• Implement AI Bridge client table column (#22228, adcdbfd) (@jakehwll)
• Add anthropic and gemini-monochrome icons (#22270, bf076fb) (@app/blinkagent)

Tasks

• Server: Return 409 Conflict for non-active task states (#21887, 2549fc7) (@mafredri)
• Implement ai governance consumption frontend (#21595, 62704eb) (@jakehwll)
• CLI: Show snapshots in task logs (#21787, efcfee8) (@mafredri)
• CLI: Add coder task pause command (#22012, 6d41d98) (@DanielleMaywood)
• CLI: Add coder task resume command (#22066, d737f8c) (@DanielleMaywood)
• Server: Return log snapshot for paused tasks (#21771, 21eabb1) (@mafredri)
• Dashboard: Add pause/resume action buttons to tasks table (#21728, d5ae72d) (@EhabY)
• Dashboard: Add pause/resume actions to task page (#21952, 8990a10) (@EhabY)
• Dashboard: Add missing Tasks API client methods (#22079, ebd7ab1) (@EhabY)
• Dashboard: Show task log preview in paused and failed states (#22063, 3fcd8c6) (@EhabY)
• Add an endpoint to manually pause a coder task (#21889, e6fbf50) (@SasSwart)
• Add an endpoint to manually resume a coder task (#21948, 47b8ca9) (@SasSwart)
• Notify on task auto pause, manual pause and manual resume (#22050, 31c1279) (@DanielleMaywood)

CLI

• Add organization delete command to cli (#21940, e3ce3c3) (@rowansmithau)
• Add organizations list command to coder cli (#21960, 683a7c0) (@rowansmithau)
• CLI: Add coder login token command to print session token (#21627, d09300e) (@kacpersaw)

Devontainers

• Provisioner: Associate resources with coder_devcontainer (#21602, 1a94aa6) (@DanielleMaywood)
• Agent: Add subagent ID fields to devcontainers in manifest (#21848, 2de8cdf) (@DanielleMaywood)
• Agent: Populate subagent ID for terraform-defined devcontainers (#21942, 6ccd20d) (@DanielleMaywood)
• Server: Support terraform-defined subagent ids (#21837, af0e171) (@DanielleMaywood)

Dashboard

• Add healthy filter for workspace queries (#21743, 22ece10) (@sreya)
• Add icon and description to preset dropdown (#21694, 7a8d8d2) (@jakehwll)
• Replace Inter with Geist variable font (#22060, c990981) (@jaaydenh)

Shared Workspaces

• Move Shared Workspaces from experiments to beta (#22206, 37a8e61) (@zenithwolf1000)

Misc

• Server: Filter expired API tokens server-side (#22263, 1e27406) (@kacpersaw)
• Server: Insert sub agent resource (#21699, 37aecda) (@DanielleMaywood)
• Dashboard: Add query param support to OAuth2 app creation page (#21821, 6ac77f2) (@app/blinkagent)
• VPN: Add Linux support for vpn-daemon and OS networking stack (#22051, adc7775) (@ibetitsmike)
• Add Prometheus metrics for license warnings and errors (#21749, 04b0253) (@mtojek)
• Add link for viewing raw build logs in workspace and template build jobs (#21727, 353ebd9) (@johnstcn)
• Add cachecompress package to compress static files for HTTP (#21915, 8aa9e9a) (@spikecurtis)
• Add standard encodings to binary cache (#21921, b84bb43) (@spikecurtis)
• Add e2e workspace build duration metric (#21739, 6035e45) (@sreya)
• Add provisioner job queue wait time histogram and jobs enqueued counter (#21869, 5f3be6b) (@cstyan)
• Remove license gate from workspace and task bulk actions (#22090, 0071338) (@app/blinkagent)
• Add support for agentsock on Windows (#22171, 1069ce6) (@spikecurtis)
• Add template toggle to disable module caching (#21931, efd98bd) (@Emyrk)

Bug fixes

• CLI: Ignore space in custom input mode (#21752, bb7b49d) (@mtojek)
• CLI: Allow site admins to use coder create --org for any organization (#21528, 4b3889e) (@ethanndickson)
• CLI: Allow new immutable parameters via --parameter flag during update (#22221, 3c69d68) (@kacpersaw)
• CLI: Proactively use active template version when require_active_version is set (#22033, 6c16794) (@f0ssel)
• Server: Clean up task snapshots on task deletion (#21949, c60c373) (@mafredri)
• Server: Use BuildReasonTaskAutoPause for task workspaces (#22126, f8eea54) (@johnstcn)
• Server: Add role param to agent RPC to prevent false connectivity (#22052, f016d9e) (@kacpersaw)
• Server: Harden OAuth2 provider security (#22194, b776a14) (@ThomasK33)
• Database: Prevent AcquireProvisionerJob from grabbing canceled jobs (#21852, f75cbab) (@mafredri)
• Database: Correct task pending status logic (#21886, 96695ed) (@mafredri)
• Server: Support client_secret_basic client auth (#21793, dd6aec0) (@ThomasK33)
• Server: Make workspace ACL disabled flag atomic (#21799, c60f802) (@geokat)
• Server: Prefer app session cookie over Authorization (#22041, fcf431c) (@cryptoluks)
• Helm: Allow overriding CODER_PPROF_ADDRESS and CODER_PROMETHEUS_ADDRESS (#21714, 892b226) (@app/blinkagent)
• Dashboard: Use total_member_count for group subtitles when sharing (#21744, f5d4926) (@geokat)
• Dashboard: Use native thin scrollbar style for admin bar (#21825, c3ea544) (@kylecarbs)
• Dashboard: Filter build timeline events by agent ID (#21831, b612762) (@mafredri)
• Dashboard: Remove overflow-hidden (#22032, 0ab54fd) (@DanielleMaywood)
• Dashboard: Render username with content-primary, not white (#22172, 873e054) (@DanielleMaywood)
• Dashboard: Show when secret deployment options are configured (#22151, de4ff78) (@jeremyruppel)
• Dashboard: Respect meta user appearance preference as theme fallback (#22152, 0652664) (@jeremyruppel)
• Propagate correct agent exit code (#21718, 4f1fd82) (@sreya)
• Don't allow sharing admins to change own role (#21634, 4847920) (@jaaydenh)
• Use existing transaction to claim prebuild (#21862, 3c1db17) (@sreya)
• Use dynamic parameter resolution in the cli (#21734, b1e18f2) (@Emyrk)
• Resolve heading sizing (#21914, 9d887f2) (@jakehwll)
• Increase retry attempts for builtin postgres port conflicts (#21796, 953a615) (@f0ssel)
• Set content-primary text color instead of hardcoding white text (#21908, 62fa0e8) (@aqandrew)
• Always show View Task for Tasks workspaces (#21970, edcee32) (@jakehwll)
• Enable strict mode for swagger generation & upgrade swag (#21975, 456c0bc) (@mtojek)
• Limit doc-check comments by restricting to one sticky comment and updating logic (#21933, a5bc0eb) (@DevelopmentCats)
• Make boundary usage telemetry collection atomic (#21907, a31e476) (@zedkipp)
• Disable Activity bump when Default autostop is 0 (#22112, 5e7b3c3) (@jakehwll)
• Avoid re-using AuthInstanceID for sub agents (#22196, 911d734) (@DanielleMaywood)
• Allow users with workspace:create for any owner to list users (#21947, e8d6016) (@f0ssel)
• Restore block to Managed Agents on Enterprise (#22210, d700f9e) (@jakehwll)
• Ensure stopping a workspace before starting it when updating (#22201, e2cbf03) (@Emyrk)
• Floor provisioner job queue wait metric (#22184, 6a783fc) (@zedkipp)
• Exclude provisioner_state from workspace_build_with_user view (#22159, 0a7a3da) (@sreya)
• Use "idle timeout" as task auto-pause reason (#22287, 974ca3e) (@DanielleMaywood)
• Allow agent-reported final states, add SSE reconnection (#22286, 947b390) (@mafredri)
• Allow sharing ports >9999 (#22273, 93e8239) (@Emyrk)
• Avoid derp-related panic during wsproxy registration (backport release/2.31) (#22526, 107fd97) (@rowansmithau)
• Register task pause/resume routes under /api/v2 (#22544) (#22550, 22c2da5) (@EhabY)

Documentation

• Update AI Governance Add-On licensing information (#21899, 2add69a) (@mattvollmer)
• Clarify Tasks limit and AI Governance relationship (#21774, 5da28ff) (@app/blinkagent)
• Clarify that only Coder tokens work with AI Bridge authentication (#21791, b035843) (@app/blinkagent)
• Reorganize AI Bridge client document...

Stable (since March 03, 2026)

Changelog

Bug fixes

• Avoid derp-related panic during wsproxy registration (backport release/2.30) (#22343, 55da992)
• fix(stringutil): operate on runes instead of bytes in Truncate (#22388) (#22467, 7e0cf53) (@johnstcn)

Chores

• Update Go from 1.25.6 to 1.25.7 (#22465, 613029c)

Compare: v2.30.2...v2.30.3

Container image

• docker pull ghcr.io/coder/coder:v2.30.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since March 03, 2026)

Changelog

Bug fixes

• Avoid derp-related panic during wsproxy registration (backport release/2.29) (#22342, 50c4832)
• fix(stringutil): operate on runes instead of bytes in Truncate (#22388) (#22468, 72d05f3) (@johnstcn)

Security Update

• Update Go from 1.24.10 to 1.24.13 (#22473, 5c99fed)

  Updated the Go runtime from 1.24.10 to 1.24.13, resolving 9 security vulnerabilities addressed across the 1.24.11, 1.24.12, and 1.24.13 patch releases. No user-facing behavior changes.

Compare: v2.29.7...v2.29.8

Container image

• docker pull ghcr.io/coder/coder:v2.29.8

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• feat(site)!: add consent prompt for auto-creation with prefilled parameters (#22255, 40b3970)

Features

• Convert soft_limit to limit (cherry-pick/v2.30) (#22209, bfb6583)

Bug fixes

• Avoid re-using AuthInstanceID for sub agents (#22196) (#22211, fa284dc)

Chores

• Bump versions of gh actions 2.30 (#22217, d4ce962)
• Bump bundled terraform to 1.14.5 for 2.30 (#22192, b89dc43)
• Backport aibridge fixes (#22266, fa050ee)

Compare: v2.30.1...v2.30.2

Container image

• docker pull ghcr.io/coder/coder:v2.30.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since February 23, 2026)

Changelog

BREAKING CHANGES

• feat(site)!: add consent prompt for auto-creation with prefilled parameters (#22256, 8a097ee)

Features

• Convert soft_limit to limit (cherry-pick/v2.29) (#22207, 79a0ff8)

Bug fixes

• Avoid re-using AuthInstanceID for sub agents (#22196) (#22212, 2ca88b0)

Chores

• Bump versions of gh actions for 2.29 (#22218, 3aa8212)
• Bump bundled terraform to 1.14.5 for 2.29 (#22193, 7819c47)

Compare: v2.29.6...v2.29.7

Container image

• docker pull ghcr.io/coder/coder:v2.29.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Features

• Convert soft_limit to limit (cherry-pick/v2.28) (#22208, 62b5c49)

Chores

chore: bump versions of gh actions for 2.28 (#22265, 898489b)

Compare: v2.28.10...v2.28.11

Container image

• docker pull ghcr.io/coder/coder:v2.28.11

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Update AI Bridge to preserve stream property in 'chat/completions' calls (#21953, ef29702)

  This fix bumps the coder/aibridge dependency from v1.0.1 to v1.0.3 (along with a forked openai-go update) to fix a bug where the stream property was not being preserved in chat/completions calls through AI Bridge. This is important because without it, streaming responses from LLM providers could break or behave unexpectedly for users relying on AI Bridge as their proxy layer. It targets the release/2.30 branch, so it's a targeted fix for the upcoming stable release.

• CLI: Revert #21583 (#22000) (#22002, 16408b1)

  This commit reverts a change which added a background goroutine to coder ssh --stdio to monitor the parent PID and exit when it died. While we believe the fix addressed orphaned SSH processes, it was found to break SSH ControlMaster (connection multiplexing), so the change was pulled back. An alternative fix is being investigated, and this revert ensures ControlMaster users on the 2.30 release aren't impacted.

Compare: v2.30.0...v2.30.1

Container image

• docker pull ghcr.io/coder/coder:v2.30.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Stable (since February 05, 2026)

Changelog

Chores

• Backport fixes (#21957, b275be2)

  This change propagates the correct exit code on agent shutdown, improves logging, fixes an issue where prebuild claims were not included in the in-flight transaction, and resolves an errant nil panic in the agentsocket client.

Compare: v2.29.5...v2.29.6

Container image

• docker pull ghcr.io/coder/coder:v2.29.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.