Thanks to visit codestin.com
Credit goes to github.com

Skip to content

v2.37.0

Choose a tag to compare

View all tags
@coder-release-publisher coder-release-publisher released this 01 Sep 09:11
· 6 commits to release/2.37 since this release
Immutable release. Only release title and notes can be modified.
v2.37.0
8a148a9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

Note

This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: If a template declares several providers that match the same host, give them non-overlapping CODER_EXTERNAL_AUTH_<N>_REGEX values or fetch the token with an explicit ID via coder external-auth access-token <id>. If a template declares a provider that was renamed or removed, restore that provider or update the template declaration. Declaring the intended provider in templates is recommended but not required.

  • login_type=none deprecated; existing accounts converted to password login (#26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

  • Coder Agents model configurations and overrides are organization-scoped (#27955, #27959, #28440, #28442, #28704)

    Coder Agents model configurations and overrides are now organization-scoped. Existing model configurations are assigned to the default organization and are not copied to other organizations. Existing deployment-level and personal model overrides are not migrated. API integrations must use the organization-scoped model endpoints; the separate model-availability endpoint has been removed and its availability data is now included in the models response.

    Migration: Configure a usable default model for each organization that uses Coder Agents, and reselect any deployment-level and personal model overrides. Update API integrations to use the organization-scoped model endpoints and read availability data from the models response.

  • MCP server configuration is organization-scoped (#27942)

    MCP server configuration is now organization-scoped. Existing configurations retain their credentials and move to the default organization; other organizations must configure their own MCP servers.

    Migration: Configure MCP servers for each organization that needs them, and migrate API consumers from the deployment-scoped experimental routes to the organization-scoped routes.

  • Native chat spend limits removed in favor of AI Gateway budgets (#27329)

    Native chat spend limits are removed in favor of AI Gateway budgets. Limits are not migrated, and deployments without AI Gateway entitlement lose chat-spend enforcement.

    Migration: Move chat-spend enforcement to AI Gateway budgets. Deployments without AI Gateway entitlement will no longer enforce chat spend.

SECURITY

Features

Coder Agents

Coder Agents is now generally available: production-ready, commercially supported self-hosted infrastructure for AI coding workflows, from interactive development to headless background work. This release introduces deeper organization-level administration, agent time licensing and usage controls, a stable Chats API, and substantial improvements to chat performance, reliability, and usability.

Chat lifecycle hooks

New backend dispatch, chatd wiring, and dashboard surfacing for chat lifecycle hooks, including suffix messages, idle-failure and content-update support, change visibility, and an insecure-HTTP escape hatch for hook URLs.

  • Lifecycle hook dispatch backend and chatd wiring (#27401, #27429)
  • Suffix messages, idle failure, and content-update support (#27428)
  • Surface hook outcomes in the chats UI and show what a hook changed (#27430, #27655)
  • --chat-hook-allow-insecure to allow plain HTTP hook URLs (#27896)
MCP: migration to the official Go SDK

Migrated every MCP surface (coderd server, exp mcp stdio server, external client, workspace agent client, and the aibridge injected-MCP proxy) to the official MCP Go SDK. (#28056, #28057, #28058, #28059, #28060)

MCP server configs, tools, and sharing
  • Org-scoped MCP server configs with group/user ACLs, an org picker on settings pages, and audit logging (#27943, #27944, #28150)
  • Allow sharing MCP servers with users and groups (#28593)
  • Add Coder Agents chat tools to the MCP toolsdk; defer tool schemas behind a find_tools search (#28025, #28225)
  • Extend agent chat MCP tools for remote UAT evidence loops (#28233)
  • Remove task management MCP tools (#28354)
Subagents & providers
  • Surface subagents in the chat sidebar and render list_subagent_models tool results (#28234, #28116)
  • Limit concurrent chat agents with pooled admission (#27902)
  • Per-model OpenAI Responses API toggle (#27683)
  • Apply reasoning effort and surface thinking blocks for Google chat models (#28273)
Chat search

Full-text chat search wired into the search box, with cache invalidation and chats-by-workspace cache reconciliation. (#27973, #27892, #27901)

agent-browser

Built-in Browser tab for agent-browser, plus the dogfood live-preview app. (#27910, #27838)

Agents workspace UI
  • Consolidate the git panel tab strip into a view-switcher dropdown; move the PR icon to the diff line, center the unread dot, and persist the kebab (#27012, #28326)
  • Redesign the advisor tool row; add a provider icon to the chat model selector (#28069, #28330)
  • Label process_output rows with the process command; migrate agent chat scrolling; dim unselected sidebar chat titles (#28300, #28130, #28382)
  • Add download and export for personal skills (#28032)
Per-template Coder Agents access control

Per-template access control with dashboard controls and a --agents-allowed CLI flag. (#27285, #27514, #27517)

Auditing
  • Audit chat system instructions changes and operational agent settings (#27668, #28369)

AI Governance

Cost Control & budgets

Cost tracking now flows through AI Gateway rather than native chat tracking, with a group AI spend endpoint, estimated-spend labeling, and admin budget notifications.

  • Back the per-chat cost endpoint with AI Gateway data; remove native chat cost tracking (#27328, #27330)
  • Group AI spend endpoint; label AI spend as estimated (#27568, #27584)
  • CTAs on AI budget admin notifications (#28138)
  • Announce the cost controls move to AI Governance (#27543)
AI model price book
  • Automate a weekly AI model price-book refresh; experimental CLI to price unpriced models (#28146, #27926)
  • Distinguish default vs. custom prices, support custom prices, and add a source filter; show best-effort pricing on the model form (#28204, #28328, #28329, #28290)
Agent runtime hours (billing & licensing)

Metering and billing for Coder Agent runtime, surfaced through license entitlements and a per-license Products section.

  • Hourly hb_agent_runtime_v1 usage events and runtime-hour license claims/entitlement (#27312, #27459)
  • Report runtime-hour usage in entitlements; tolerate unusable claims and decode -1 as unlimited (#27985, #27984)
  • Per-license Products section with Coder Agents price gates; show total agent hours on the licenses page (#28051, #27953)
  • Harden runtime instrumentation for billing; bill completed and interrupted tool batches and record live tool-execution stamps (#27451, #28360, #28361, #28362)
AI Gateway sessions
  • Network-calls summary/list on the AI session threads API and detail card (#27417, #27425, #27418, #27426)
  • Default the sessions list to a 24h range; shared DateTimeRangeFilter / quick-pick date-time range picker used on the AI sessions page (#28256, #28255, #28392, #28426)
  • Track Junie as an AI Gateway client (#28266)
  • YAML config option for the standalone AI Gateway (#28258)

RBAC & Organizations

  • Organization-scoped chat models: RBAC resource, org-scoped model usage, telemetry org IDs, and audit logging (#27957, #27960, #27956, #28439)
  • Enable Coder Agents for organization members (#28186)
  • Server-side search and pagination for the groups page, plus a paginated groups API endpoint (#27994, #27603)
  • Search users by display name; username/email user search filters (#27398, #27922)
  • Promote the MinimumImplicitMember experiment to GA (#27472)
  • Unhide the --oidc-redirect-url server option (#28072)

OAuth2 & Identity

  • Admin-controlled dynamic client registration exposed in deployment settings (#27480)
  • Public OAuth2 clients: schema-layer public client tokens, register public clients without a secret, and scope columns / single-use delete queries (#27712, #28046, #28007)
  • Modernize the OAuth2 applications settings UI; constrain the client-type column; derive client type from token_endpoint_auth_method (#27562, #27931, #28043)
  • Compare scopes by permission coverage (#28167)

Workspaces & Templates

  • Template creation builder: redirect to the builder after first-time setup, make sidebar steps navigable / scroll to module on click, and tighten the base-infra step grid and typography (#27670, #28153, #27351, #27797)
  • Confirm before batch-stopping workspaces (#27631)
  • Include agent metadata in workspace list responses (#27934)
  • Hide workspace resources when lacking workspace-create permission (#27278)

Secrets

  • coder secret import for bulk secret files, with bulk import upload in the Add secret dialog (#27534, #26725)
  • Enable/disable support for user secrets (#27537)

Dashboard & Platform

  • Premium paywalls and badging: appearance settings and external-auth settings paywalls, premium badging, updated paywall component/copy linked to feature docs, CTA/form handling, and conversion telemetry (#27948, #28435, #27847, #28070, #28339, #28226, #28425)
  • Add "Install Coder Desktop" to the user dropdown; replace the proxy emoji with a latency radio icon (#28244, #28128)

Infrastructure & Observability

  • Log tailnet tunnels to the connection log; correlate request logs and spans by client_session_id (#27423, #27671)
  • Add a workspace agent session-count protocol (#28125)
  • Helm: make the HTTPS redirect status code configurable (#27360)
  • Log rate-limited external-auth token validation; add a redirect-URL override for external auth (#26754, #28082)

Bug fixes

Security & authentication

AI Gateway & providers

Token accounting & runtime billing

Coder Agents & chat

AI Governance (budgets & pricing)

Organizations, RBAC & models

Workspaces & templates

Secrets

Deployment (Helm)

Documentation

  • Present AI Governance as included with Premium (#27545) → AI Governance
  • Add standalone AI Gateway docs (#27592) → AI Gateway · Setup
  • Document AI Gateway cost controls (#27643) → AI Gateway
  • Update 2.35 latest release to v2.35.3 (#27511) → Releases
  • Note user secret target uniqueness and delivery boundary (#27532) → User secrets
  • Bump AI Gateway client modules to latest and remove Coder Tasks refs (#27810) → AI Gateway · Client Configuration
  • Correct 2.35 stable version to v2.35.3 (#27842) → Releases
  • Document per-template agents_allowed (#27518) → Coder Agents
  • Refresh JFrog Artifactory integration guide for SaaS (#28005) → JFrog Artifactory
  • Remove beta references from Coder Agents docs and manifest (#27939) → Coder Agents
  • Document prebuilds quota group behavior (#28015) → Prebuilt workspaces
  • Remove AI Governance Add-On references (#28073) → AI Governance
  • Use approximate spend and add Everyone group tip for AI Gateway cost controls (#28012) → AI Gateway
  • Add Coder Desktop stale-tunnel recovery and improve macOS log capture (#26735) → Coder Desktop
  • Remove invalid --yes flag from coder template version promote (#28084) → CLI reference
  • Correct broken CLI commands and flags from drift sweep (#28098) → CLI reference
  • Add Licensing & Usage page and reorder agents manifest (#28263) → Coder Agents
  • Remove inaccurate Agent Firewall filesystem protection claim (#28286) → AI Governance (Agent Firewall)
  • Note JetBrains client attribution in AI Gateway (#28296) → AI Gateway · Client Configuration
  • Fix prebuilt-workspaces example syntax and defaults (#28088) → Prebuilt workspaces
  • Fix broken callout on the AI Gateway Monitoring page (#28303) → AI Gateway · Reference
  • Complete swagger annotations for organization-scoped MCP routes (#28064) → API reference
  • Clarify who can set AI model prices and how they are keyed (#28401) → AI Gateway
  • Streamline agent instructions (#28243) → Coder Agents · Getting Started
  • Address AI Gateway documentation review feedback (#28309) → AI Gateway
  • Documentation: Document the chat search: full-text filter (#28474) → Coder Agents
  • Remove early access label from chats API reference (#28761) → API reference
  • Lead with env vars in admin docs and add configuration reference (#26824) → Admin · Setup
  • Replace enterprise-base image references with example-base (#27025) → Admin · Templates
  • Note bulk stop confirmation (#27908) → Workspace management
  • Refresh workspace-management screenshots with current UI (#28356) → Workspace management
  • Add a glossary to the reference section (#27165) → Reference · Glossary
  • Fix Helm TLS/ingress value keys in admin/setup (#28087) → Install · Kubernetes
  • Correct nginx X-Forwarded-Proto and certbot instructions flavor (#28086) → Admin · Setup
  • Fix prometheus metric name and slack webhook backtick (#28085) → Admin · Monitoring
  • Rebrand Windsurf doc page to Devin Desktop (#28205) → IDEs · Access Workspaces
  • Remove JetBrains Fleet references (#28301) → IDEs · Access Workspaces
  • Update Tallyman Agent Time reporting (#28275) → Coder Agents

Internal docs maintenance (no single user-facing page): Fix self-violating examples (#27849), style-guide rule against "whose" (#27866), STE-derived prose rules (#27852), P2/P3 typo/syntax drift-sweep fixes (#28101), self-violation audit fixes (#27855), uppercase callout markers [DOCS-681] (#28304), remove space in callout markers [DOCS-680] (#28305), fix broken .style/ link (#28180), markdown_url front matter for About page (#28281), CLI/API doc generators emit front-matter metadata (#27246).

Performance improvements

Other changes

Compare: e96e7cfec23ca55d6700b684474b82df97cfd22b...v2.37.0

Container image

  • docker pull ghcr.io/coder/coder:2.37.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

mafredri, jeremyruppel, and 30 other contributors
Assets 28
Loading