GeezerVison

Changelog

Bug fixes

• Documentation: Backport the release calendar and install version refresh for v2.39.0 (#31716, 45569d3)
• Server: Tighten up database connection errors (#31850, 4c9e04c) (@f0ssel)
• Write agent host entries with config-ssh --no-wildcard (#31192, b7b80a8) (@matifali)
• Only add the session token to trusted app links in coder open app (#31721, 1b0fab7) (@dylanhuff-at-coder)

Documentation

• Documentation: Add bring your own MCP servers guide for Coder Agents (#31495, fbebb48)
• Add Agent Relay setup and operations guides (#31281, 74697d6) (@app/coder)
• Own the legacy /docs/templates and /docs/workspaces redirects on 2.39 (#31787, 6e6ab22)

Continuous integration

• Run contrib.yaml secret consumers in the main environment on release/2.39 (#31826, a000dc5)

Chores

• Use environments for various CI pipelines (#31654, 4faed00)
• Report Agent Relay builds in telemetry (#31407, 852ce0d)

Compare: v2.39.0...v2.39.1

Container image

• docker pull ghcr.io/coder/coder:v2.39.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

Stable (since November 10, 2026)

Changelog

BREAKING CHANGES

• fix!: validate workspace app URLs on the server (#31262, 2a7bf82)

Bug fixes

• Server: Ignore retired OAuth2 scopes such as task:* (#31117, cd3b3df)
• Server: Tighten up database connection errors (#31850, a882236) (@f0ssel)
• Only add the session token to trusted app links in coder open app (conflicts) (#31721, cfcd463) (@dylanhuff-at-coder)

Continuous integration

• Run contrib.yaml secret consumers in the main environment on release/2.38 (#31825, 96c1ca4)

Chores

• Use environments for various CI pipelines (#31654, b931f81)
• Fix flaky SpendPage.test.tsx (#30132, 8d7c6b5)

Compare: v2.38.6...v2.38.7

Container image

• docker pull ghcr.io/coder/coder:v2.38.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

Changelog

BREAKING CHANGES

• fix!: validate workspace app URLs on the server (#31262, c25f50f)

Bug fixes

• Server: Tighten up database connection errors (#31850, 03690c4) (@f0ssel)
• Only add the session token to trusted app links in coder open app (conflicts) (#31721, b9a928e) (@dylanhuff-at-coder)

Continuous integration

• Run contrib.yaml secret consumers in the main environment on release/2.37 (#31824, d2c3ca1)

Chores

• Use environments for various CI pipelines (#31654, 20fa1ac)

Compare: v2.37.10...v2.37.11

Container image

• docker pull ghcr.io/coder/coder:v2.37.11

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

Changelog

BREAKING CHANGES

• fix!: validate workspace app URLs on the server (#31262, c7c0ece)

Bug fixes

• Server: Tighten up database connection errors (#31850, 6a66464) (@f0ssel)
• Only add the session token to trusted app links in coder open app (conflicts) (#31721, 571a1ba) (@dylanhuff-at-coder)

Continuous integration

• Remove chromatic on release/2.34 (#26777, a8aec11)
• Run contrib.yaml secret consumers in the main environment on release/2.34 (#31821, b302c4e)

Chores

• Use environments for various CI pipelines (#31654, 3c83c12)

Compare: v2.34.18...v2.34.19

Container image

• docker pull ghcr.io/coder/coder:v2.34.19

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

Changelog

BREAKING CHANGES

• fix!: validate workspace app URLs on the server (#31262, 922a71f)

Bug fixes

• Tighten up database connection errors (#31850, 552eb4a) (@f0ssel)
• Only add the session token to trusted app links in coder open app (conflicts) (#31721, 3f094b6) (@dylanhuff-at-coder)
• Prevent tailnet coordination panics (#29300, 8585c29)

Continuous integration

• Remove chromatic on release/2.29 (#26777, b059e35)
• Run contrib.yaml secret consumers in the main environment (57571ff)

Chores

• Use environments for various CI pipelines (#31654, c220a53)

Compare: v2.29.26...v2.29.27

Container image

• docker pull ghcr.io/coder/coder:v2.29.27

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Contributors

Changelog

BREAKING CHANGES

• Connection log migration blocks reads and writes (#30466)

  A migration rewrites the connection_logs table under a lock that blocks reads and writes, about 50 seconds per 10 million rows.

  Migration: Plan a maintenance window for large deployments.

• Template insights and Prometheus usage reporting are now per app (#29796, #29906)

  Template insights and the coderd_insights_applications_usage_seconds metric now report per app. In the API, type is replaced by method. In the metric, application_name is now display_name.

  Migration: Update dashboards, alerts and scripts.

• CLI confirmations and restart error reporting (#30150, #30140, #30199)

  coder update and coder users edit-roles --roles now ask for confirmation, so scripts need -y. coder update also returns an error if the restart fails.

• Unsafe workspace app URL schemes cause template builds to fail (#31262)

  Template builds fail if a coder_app URL uses an unsafe scheme such as javascript:.

  Migration: Check templates before upgrading.

• API keys created from scoped tokens have restricted scopes (#30256)

  API keys created from a scoped token can't go beyond that token's scopes.

SECURITY

• Server: Group sync may only add users to groups of the syncing org (#30706, 296da93) (@eric-hughes-coder)

Features

AI Governance

AI Gateway session costs and usage

• Tidy AI Gateway sessions list columns and tooltips (#30733, afe7472) (@tracyjohnsonux)
• Show cache tokens on AI Gateway session page (#30511, 9efe7a3)
• Add cost to AI Gateway session threads API (#30509, 15a5844) (@ssncferreira)
• Show cost and model prices on AI Gateway session page (#30512, 5bd641a)
• Add approximate cost note to AI Gateway session summary (#31259, 926742b) (@ssncferreira)

Organization model pricing and attribution

• Database: Add organization AI model config table (#30717, d14631d) (@SasSwart)
• Server: Add queries for organization AI model prices (#30718, da78c88) (@SasSwart)
• Server: Price token usage with organization prices (#30719, 837c2e1) (@SasSwart)
• Resolve orgs from workspace session tokens in AI Gateway requests (#30902, 946c2f0) (@SasSwart)
• Server: Store the organization on AI Gateway interceptions (#31118, 161b723) (@SasSwart)

AI Gateway & Model Providers

Models and provider settings

• Add Claude Sonnet 5.5 and GPT-6.1 Sol to Agents and AI Gateway (#30159, 1e9dd0a) (@ibetitsmike)
• Dashboard: Show provider type in model form and model list icon tooltip (#30353, 1320c01) (@SasSwart)
• Add Gemini 4 Argon to Agents and AI Gateway (#30780, e7c2fd5) (@ibetitsmike)

CLI

• Add JSON output to coder ai-gateway keys create (#30139, 93205d9) (@nickvigilante)

Coder Agents

Chat quality of life

• Preserve user-supplied chat titles (#29486, ff158c0) (@mafredri)
• Dashboard: Preview thinking text in header when no heading exists (#30253, 5c9d9db) (@ibetitsmike)
• Match PR number prefixes in chat search (#30404, e468234) (@ibetitsmike)
• Dashboard: Add a copy submenu to agent chat menus (#30016, 0829748) (@jakehwll)
• Dashboard: Group assistant steps into working blocks (#29417, 1910ae4) (@ibetitsmike)
• Dashboard: Add the working block disclosure (#29418, 682d4fd) (@ibetitsmike)
• Dashboard: Fold assistant steps in the conversation timeline (#29419, 045cdc9) (@ibetitsmike)
• Dashboard: Add the collapse assistant steps chat preference (#29115, a26d5c1) (@ibetitsmike)
• Dashboard: Share org in personal agent model settings (#29122, 29e876d) (@jakehwll)
• Load whole chat turns per history page (#30524, 782fb30) (@ibetitsmike)
• Dashboard: Quieter read-only view for other users' chats (#30483, 8697b91) (@tracyjohnsonux)
• Dashboard: Keep agent attachments in working blocks and list them under Attachments (#30788, 8e76aec) (@ibetitsmike)
• List every chat attachment in the Summary panel (#31140, 3f055e7) (@ibetitsmike)
• Show web searches and the pages they found in chats (#29861, 2cb10b5) (@mafredri)

Projects, shared memory, and instructions

• Add chat projects API (#29242, 7cd1b20) (@f0ssel)
• Add shared project memory API for chats in a project (#29301, a08ba6a) (@f0ssel)
• Dashboard: Add the chat projects data layer and project dialog (#30377, 10986ad) (@f0ssel)
• Lock the new-chat form to a project's organization (#30378, 145bf77) (@f0ssel)
• Dashboard: Add the chat project page (#30379, 036e080) (@f0ssel)
• Add chat project folders to the sidebar (#29583, ee63db3) (@f0ssel)
• Dashboard: Choose an organization when creating a project (#30181, c28dc3c) (@jaaydenh)
• Dashboard: Keep project chat list caches in sync (#30292, f32d0b1) (@jaaydenh)
• Dashboard: Redesign the project page header (#30293, 8d50b9d) (@jaaydenh)
• Dashboard: List project chats on the project page (#30294, a531ba3) (@jaaydenh)
• Server: Add chat project instructions storage and prompt injection (#30367, ad85646) (@jaaydenh)
• Add chat project instructions API (#30368, 97c5260) (@jaaydenh)
• Dashboard: Add the project instructions editor dialog (#30369, a46d514) (@jaaydenh)
• Dashboard: Show project instructions in the project page details panel (#30370, 8763780) (@jaaydenh)
• Dashboard: Design improvements for projects page (#30740, 40c0adc) (@jaaydenh)
• Dashboard: Add a project picker to the new chat composer (#30455, 85783e4) (@jaaydenh)
• Dashboard: Add Projects empty state and persist section collapse (#30741, c5bf97b) (@jaaydenh)
• Move a chat family between projects in chatd (#30893, 0968f97) (@ibetitsmike)
• Move chats between projects through the chat update API (#30894, dfdd6a5) (@ibetitsmike)
• Dashboard: Move chats between projects from the chat menu (#30895, 2cade24) (@ibetitsmike)
• Dashboard: Drag chats onto project folders in the sidebar (#30795, 71435e1) (@ibetitsmike)
• SDK: Mark the chat-projects experiment as safe (#31313, f348cd6) (@f0ssel)
• Graduate chat projects out of the chat-projects experiment (#31354, b54f7de) (@f0ssel)

Project skills

• Add project skill queries and authorization (#30826, a379c84) (@jaaydenh)
• Add project skill API routes (#30827, e289c6f) (@jaaydenh)
• Load project skills in chats (#30838, 3216580) (@jaaydenh)
• Dashboard: Add the project skills dialog (#30855, cbc53b4) (@jaaydenh)
• Manage project skills from the project page (#30856, 7253bd1) (@jaaydenh)
• Show project skill actions above project chat composers (#30884, 63f3bde) (@jaaydenh)

Organization instructions and skills

• Add organization-scoped Coder Agents instructions (#30272, 7993c73) (@ibetitsmike)
• Add the organization skills data model (#30609, b67587c) (@ibetitsmike)
• Add organization skill API routes (#30610, db7f5a7) (@ibetitsmike)
• Add organization skill sharing ACL routes (#30611, 2c432a1) (@ibetitsmike)
• Dashboard: Add organization skill settings with a shared skills UI (#30612, 6498c57) (@ibetitsmike)
• Load organization skills in chats (#30613, adcce66) (@ibetitsmike)

Skill uploads, invocation, and controls

• Dashboard: Upload personal skill files (#30170, c94a98a) (@jakehwll)
• Send skill invocations as structured message parts (#30861, ffd2486) (@jaaydenh)
• Dashboard: Insert skills as chips in the composer (#30880, e88de21) (@jaaydenh)
• Render skill invocations in the transcript and edit flow (#30881, 3c83820) (@jaaydenh)
• Add skill action and automatic-use settings (#30882, c4d76a4) (@jaaydenh)
• Honor disable-model-invocation in skill frontmatter (#31147, 514f239) (@ibetitsmike)

Git panel, branches, and pull requests

• Server: Key chat diff statuses by ref (#29081, 63a95d8) (@DanielleMaywood)
• Expose per-ref diff statuses (#29082, 49b1a2c) (@DanielleMaywood)
• Dashboard: Fetch and merge diff statuses per ref (#29543, 8f1fc53) (@DanielleMaywood)
• Dashboard: List every PR in the top bar (#29831, 051eb58)
• Dashboard: Per-ref views in the git panel (#29544, 86013c2) (@DanielleMaywood)
• Dashboard: Count every PR in the chats sidebar (#29832, ff3fa22)
• Dashboard: Move View PR into the git panel toolbar (#30751, 05fa806) (@ibetitsmike)

Tool execution and compaction

• Run chat tool calls once per tool call ID on the agent (#29946, 1ba09d2) (@mafredri)
• Send tool call IDs and cancel unresolved calls on interrupt (#29954, fa5bac6) (@mafredri)
• Remove model_intent from the execute, process_output, and advisor tools (#30397, 67a781c) (@ibetitsmike)
• Server: Evaluate read_template parameters for the chat owner (#29561, 28fe61f) (@ibetitsmike)
• Trigger compaction independently for the chat and compaction models (#28568, c28ae0d) (@ibetitsmike)

MCP integration

• Send RFC 8707 resource parameter on MCP server OAuth2 flows (#30651, fa7cd62) (@ibetitsmike)
• Retry failed MCP servers on context resync (#30489, 281b838) (@jeremyruppel)
• Serve internal MCP servers to chats in process (#29828, 15a160a)

ACP subagents (Experimental)

• Discover ACP harnesses configured in the workspace (#30557, bf5dda3) (@hugodutka)
• Agent: Publish ACP harnesses in context snapshots (#31060, 58276d2)
• Probe ACP harness capabilities (#31057, fbf7eb3)
• Show available ACP harnesses in chat context (#31059, c61d842)
• Add ACP session runtime and transcripts (#30835, 43ec0ba)
• Watch and subscribe to ACP session updates (#30903, d2c32e6...

Contributors

Stable (since November 03, 2026)

Changelog

Bug fixes

• Bump go-chi/chi/v5 to v5.5.0 (backport 2.38) (#31501, c2f9967)
• Bump bundled terraform to 1.17.1 (backport 2.38) (#31441, 8fe3103)
• Bump gomarkdown/markdown to fix GHSA-cv23-7vc5-jfh7 (backport 2.38) (#31442, c8dc3bd)
• Bump hashicorp/go-getter to v1.8.10 (backport 2.38) (#31506, d7fa32b)
• Bump go-jose/v4 to v4.1.6 (backport 2.38) (#31440, ebe7031)
• Server: Anchor CSRF exemption patterns (#31125, 76b6518)
• Server: Group sync may only add users to groups of the syncing org (#30706, 27adaaf)
• Bump Node.js to 22.23.4 (#31263, db7c30f)

Compare: v2.38.5...v2.38.6

Container image

• docker pull ghcr.io/coder/coder:v2.38.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Bump go-chi/chi/v5 to v5.5.0 (backport 2.37) (#31502, 029ed94)
• Bump bundled terraform to 1.17.1 (backport 2.37) (#31446, 5ef63d7)
• Bump gomarkdown/markdown to fix GHSA-cv23-7vc5-jfh7 (backport 2.37) (#31445, 00206d1)
• Bump hashicorp/go-getter to v1.8.10 (backport 2.37) (#31507, 6d61155)
• Bump go-jose/v4 to v4.1.6 (backport 2.37) (#31444, 021fa86)
• Database: Lock the workspaces row when claiming a prebuild (#31518, 6af1792)
• Server: Anchor CSRF exemption patterns (#31125, 8804cbe)
• Server: Group sync may only add users to groups of the syncing org (#30706, ab4ec8d)
• Retry Anthropic thinking binding errors with drop_block (#29792, 51680d9)
• Bump Node.js to 22.23.4 (#31263, b47cfed)

Compare: v2.37.9...v2.37.10

Container image

• docker pull ghcr.io/coder/coder:v2.37.10

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Bump go-chi/chi/v5 to v5.5.0 (backport 2.34) (#31504, 58c58cd)
• Bump bundled terraform to 1.17.1 (backport 2.34) (#31452, 1a93651)
• Bump gomarkdown/markdown to fix GHSA-cv23-7vc5-jfh7 (backport 2.34) (#31451, da95120)
• Bump hashicorp/go-getter to v1.8.10 (backport 2.34) (#31509, 5189a86)
• Bump go-jose/v4 to v4.1.6 (backport 2.34) (#31450, 3c254da)
• Server: Anchor CSRF exemption patterns (#31125, 524d0f5)
• Database: Lock the workspaces row when claiming a prebuild (#31518, 81ecea4)
• Server: Group sync may only add users to groups of the syncing org (#30706, 11fb642)
• Bump Node.js to 22.23.4 (#31263, b08b9ec)
• Retry Anthropic thinking binding errors with drop_block (#29792, 665f629)

Compare: v2.34.17...v2.34.18

Container image

• docker pull ghcr.io/coder/coder:v2.34.18

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Bump bundled terraform to 1.17.1 (backport 2.29) (#31456, 666c974)
• Bump go-chi/chi/v5 to v5.5.0 (backport 2.29) (#31505, e69fa8a)
• Bump gomarkdown/markdown to fix GHSA-cv23-7vc5-jfh7 (backport 2.29) (#31455, 810b0c5)
• Bump go-jose/v4 to v4.1.6 (backport 2.29) (#31454, 5fd7dc1)
• Bump Go to 1.26.10 (backport 2.29) (#31510, be21af2)
• Bump hashicorp/go-getter to v1.8.10 (backport 2.29) (#31511, 404b04f)
• Server: Anchor CSRF exemption patterns (#31125, d22567c)
• Database: Lock the workspaces row when claiming a prebuild (#31518, 1aeaaf0)
• Group sync may only add users to groups of the syncing org (#30706, d880273)

Compare: v2.29.25...v2.29.26

Container image

• docker pull ghcr.io/coder/coder:v2.29.26

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.