coder

v2.34.2 Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

Published 1mo Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agents dev-tools development-environment go ide jetbrains

+3 more

remote-development terraform vscode

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

BREAKING CHANGES restrict OIDC email fallback and validate config; bug fixes across Server, Agent, AI Bridge, CLI, and UI; Container image updated to 2.34.2.

Full changelog

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

fix(coderd)!: restrict OIDC email fallback to first-time account linking (#25712, ffe764531a)
fix!: validate HostnameSuffix and SSHConfigOptions' (#26154, fb52711371)
fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713, 120b37a09d)

Features

Cli: add support for supplying ephemeral parameters at workspac… (#26280, bd5666a46e)

Bug fixes

Escape agent log HTML (#25808, bf5a2205e9)
Escape appearance values in HTML output (#25804, aba08538bb)
Clamp template port sharing level in SubAgentAPI (#26061, b78ec312ed)
Use a random value for a simulated hash for built-in users (#26205, 6879532f9d)
Require update permission to recreate devcontainers (#25812, e822677bd2)
Server: Verify workspace owner matches app username (#26085, 3019613cd5)
Always verify TLS on aibridgeproxyd upstream transport (#26131, 6293c89895)
Check user user is active in aibridge auth (#26173, 943b04f663)
Add max bytes request limit to aibridge (#26164, 9fc2550fe1)
Rename bundled rstudio.svg to rproject.svg, add real RStudio icon (#26216, f3839ebaa9)
Server: Suppress AI Governance seat-count error for not-entitled licenses (#26276, 6419f535dd)
Preserve gemini thought signatures (#25933, 9595e6cc73)
Server: Prevent user-admin from resetting owner password (#25709, f15a934eec)
Validate FileSize in NewDataBuilder to prevent OOM DoS (#25710, 531ef5ecb3)
Reject oversized and invalid zip uploads (#25877, 430ba84ada)
Allow lifecycle code path to retry failed stop jobs (#26278, 05e50d10f4)
Server: Prevent cross-tenant workspace app rebinding (#26103, e4a765754a) (@dylanhuff-at-coder)
Agent: Prevent command injection in shell execer (#26235, b949480248) (@zedkipp)
Validate agent-supplied AllowedIPs in coordinator (#26144, c3e7e94a90) (@f0ssel)
Only trust x-forwarded-host from configured trusted proxies (#2… (#26296, 3c46473d53)
Prevent session token exfiltration via external app URLs (#26146, d7774e5c4c) (@zedkipp)

Chores

Bump Go to 1.26.4 on release/2.34 (#26265, fad8efd4b0)

Compare: v2.34.1...v2.34.2

Container image

docker pull ghcr.io/coder/coder:2.34.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Breaking Changes

Restrict OIDC email fallback to first-time account linking (coderd)
Validate HostnameSuffix and SSHConfigOptions
Reject OIDC login when email_verified claim is non-bool or absent

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track coder

Get notified when new releases ship.

About coder

Secure environments for developers and their agents

All releases →

Related context

Related tools

Earlier breaking changes

v2.29.17 Validate HostnameSuffix and SSHConfigOptions
v2.29.17 Reject OIDC login when email_verified claim is non-bool or absent
v2.29.17 Restrict OIDC email fallback to first-time account linking
v2.29.17 Only trust x-forwarded-host from configured trusted proxies