Sourced from github.com/coder/coder/v2's releases.

v2.37.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

  The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

  Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

• Default-organization chat-model routes removed (#28632)

  The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

  Migration: Use /api/v2/organizations/{organization}/chats/models instead.

• OAuth authorization rejects unsupported or over-broad scopes (#28178)

  OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

  Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

• Dynamic client registration disabled by default (#27316)

  POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

  Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

• Agent external auth now resolves by template, not deployment config order (#27854)

  For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

  Migration: Update templates so they declare the intended external-auth provider ID for each host and ensure provider regexes do not overlap. If a template references a provider that was renamed or removed from deployment config, restore that provider or update the template declaration.

• login_type=none deprecated; existing accounts converted to password login (#26851)

  Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

  Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

• Coder Tasks disabled and deprecated (#28008)

  Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

  Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

... (truncated)

• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)