Changelog

BREAKING CHANGES

• fix!: require org membership for user ACLs (#26852, 85bcd5d3a3) (GHSA-7v78-w67v-pm2g)

Security patches

• Server: Reject workspace proxy hostname prefixes (#27544, d547bea24a) (@geokat) (GHSA-h58h-qvv5-xvwg)
• Redact env var values in agent debug manifest endpoint (#26904, c15ae01435) (GHSA-73wg-wxvv-9r4j)
• Prevent open redirect in proxy authentication flow (#26647, 5c059ba989) (GHSA-98qx-9p2x-c4wh)
• Only return group member count for workspace ACL (#26206, d70055a0fa) (GHSA-cvrm-2xxr-hpcv)
• Server: Scope provisioner module file downloads to the daemon's org (#26635, d6ea2bd16e) (GHSA-hrhj-hpwc-9hmc)

Bug fixes

• Server: Show correct deletion time in dormancy notification (backport #26488) (#27895, b080be4461)
• Dashboard: Backport admin settings dropdown visibility fix to release/2.34 (#27851, 350070e97d)
• Update google.golang.org/grpc to v1.82.1 (#27928, 877fbeb17f)
• Update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27940, 7bd778d881)

Compare: v2.34.7...v2.34.8

Container image

• docker pull ghcr.io/coder/coder:2.34.8

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.