Update Helm release coder to v2

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
coder (source)	major	0.17.1 -> 2.29.1

---

Release Notes

coder/coder (coder)

v2.29.1

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Security Update

• Update react to apply patch for CVE-2025-55182 (#​21084) (#​21168, 59cdd7e)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.29.0...v2.29.1

Container image

• docker pull ghcr.io/coder/coder:v2.29.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.29.0

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

[!IMPORTANT]
This release is also the next Extended Support Release for Coder. For guidance on upgrading from the first ESR, Coder 2.24, see the detailed upgrade notes here.

BREAKING CHANGES

• chore!: allow coder MCP tools to not be injected (#​20713, 04f809f) (@​dannykopping)

  Coder MCP tools were previously automatically injected; this will now need to be explicitly enabled with CODER_AIBRIDGE_INJECT_CODER_MCP_TOOLS=true

• feat(cli)!: enable keyring usage by default (#​20851, 6238a99) (@​zedkipp)

  In order to move away from storing the CLI session token in plain text file, this change begins using the operating system keyring for CLI session token storage by default on Windows and macOS. This will be a breaking change for any users depending on the session token being stored to or read from disk. Users can opt-out and restore file usage via the --use-keyring=false flag.

• refactor!: remove TaskAppID from codersdk.WorkspaceBuild (#​20583, d80b5fc) (@​DanielleMaywood)

  The task_app_id field has been removed from the codersdk.WorkspaceBuild struct and API responses. If your code or integrations rely on WorkspaceBuild.task_app_id to identify the task's associated app, you should migrate to using Task.WorkspaceAppID instead (available on the Task object directly). The deprecated ai_task_sidebar_app_id field remains temporarily but also points to the new location.

Features

Bridge

• Add page for ai-bridge interception logs (#​20331, 3bb7975) (@​jakehwll)
• Add duration to the Request Logs details (#​20756, f559e51) (@​jakehwll)
• Add configurable retention for aibridge (#​20828, 5a7d4f6) (@​dannykopping)
• Expose aibridged metrics (#​20865, c6631e1) (@​dannykopping)

CLI

• Optionally store session token in OS keyring (#​20256, 139dab7) (@​zedkipp)
• Add macOS support for session token keyring storage (#​20613, 5e85663) (@​zedkipp)
• Promote tasks commands from experimental to GA (#​20916, ad8ba4a) (@​mafredri)

Dashboard

• Fix build timeline to include entire stage timings (#​20805, aff2080) (@​Emyrk)
• Associate task icon with workspaces (#​20834, 2a9afc7) (@​ssncferreira)
• Add startup script error alerts to Task Page (#​20820, 8e22cd7) (@​DanielleMaywood)
• Use display name field for tasks (#​20918, 2f399ea) (@​ssncferreira)

Experimental Features

• Add agent unit manager (#​20715, 500c17e) (@​SasSwart)
• Add agent socket API (#​20717, 2840fdc) (@​SasSwart)
• Implement agent socket api, client and cli (#​20758) (#​20976, abe66a3)

MCP Server

• Support workspace name in get workspace tool (#​20474, 77e2521) (@​code-asher)

Server

• Add prebuild invalidation via last_invalidated_at timestamp (#​20582, d004710) (@​mtojek)
• Purge expired api keys in dbpurge (#​20863, cefe07d) (@​Emyrk)
• Add lookup task by name in httpmw.TaskParam (#​20647, 34f6e72) (@​johnstcn)
• Add task prompt modification endpoint (#​20811, 82f525b) (@​DanielleMaywood)

Tasks

• Promote Tasks to GA (#​20923, 02bac71) (@​mafredri)
• Add notification warning alert to Tasks page (#​20900, f8d9a80) (@​ssncferreira)

Bug Fixes

• Fix incorrect rendering of RBAC in Helm chart when workspacePerms=false (#​20569, 30d2fc8) (@​rowansmithau)
• Use correct slog arguments (#​20721, dc21699) (@​spikecurtis)
• Retain searchParams in paginatedInterceptions during filter updates (#​20725, 903c045) (@​jakehwll)
• Send prebuild job notification after job build db commit (#​20693, ca94588) (@​ssncferreira)
• Send all params instead of only touched params (#​20740, 14f0844) (@​jaaydenh)
• Correctly set touched for autofill dynamic parameters (#​20769, 6067aa3) (@​jaaydenh)
• Set codersdk.Task current_state during task initialization (#​20692, 16b8e60) (@​ssncferreira)
• Add cache for terraform installer files (#​20776, 158243d) (@​pawbana)
• Rename AI Governance to AI Bridge (#​20790, 52f8143) (@​jakehwll)
• Wait for build in task status load generator (#​20800, 8ee6e94) (@​spikecurtis)
• Ensure embedded-postgres state is wiped between retries (#​20809, b4cc982) (@​zedkipp)
• Improve http connection pooling for smtp notifications (#​20605, 6d41bfa) (@​kacpersaw)
• Allow agents to be created on dormant workspaces (#​20909, c12303f) (@​DanielleMaywood)
• Ensure we check if the user can actually see ai bridge (#​20964, cd9d3ef)
• Show task display name in task topbar (#​20957) (#​20980, 10e70f8) (@​ssncferreira)
• Pass context with authorization to agentapi (#​21045, c94c470)
• Server: Ensure lifecycle executor has sufficient task permissions (#​20539, 06dbada) (@​DanielleMaywood)
• Server: Gate AI task notifications on agent ready state (#​20690, f2a1a7e) (@​DanielleMaywood)
• Enterprise: Preserve actual error when getting provisioner key details (#​20813, c12bba4) (@​ethanndickson)
• Dashboard: Hide empty tasks list when templates are empty (#​20845, 83966e3) (@​DanielleMaywood)
• Dashboard: Remove erroneous "install Cursor" notification for Cursor Desktop (#​20875, 9c2f94b) (@​AloofBuddha)
• Dashboard: Only show active tasks in waiting for input tab (#​20933) (#​20955, c0a2522)
• Dashboard: Distinguish JB Toolbox from Gateway (#​20830, 426cc98) (@​phorcys420)
• Pass context with authorization to agentapi (#​20959, d22d34e) (@​cstyan)
• Ensure we check if the user can actually see AI Bridge (#​20942, caf711d) (@​jakehwll)
• Only show active tasks in waiting for input tab (#​20933, b7d8918) (@​mafredri)
• Remove defaulting to keyring when --global-config set (#​20943, bbf7b13) (@​zedkipp)
• Remove a sensitive field from an agent log line (#​20968, 1d726c8) (@​SasSwart)

Documentation

• Add OIDC documentation for Microsoft Entra ID user auth (#​20202, 1d1e1f9) (@​PhoenixSheppy)
• Add client configuration section and support matrix for AI Bridge (#​20640, c21b3e4) (@​matifali)
• Reflect steps required to enable coder MCP tool injection (#​20735, c69eb7c) (@​dannykopping)
• Add API key scopes documentation (#​20742, a272843) (@​Emyrk)
• Improve boundary docs (#​20806, a83328c) (@​evgeniy-scherbina)
• Fix ANTHROPIC_BASE_URL example in AI Bridge client docs (#​20853, 3fe29ec) (@​matifali)
• Standardize "AIBridge" to "AI Bridge" in documentation (#​20831, 6364089) (@​matifali)
• Add migration guide for provider version 2.13.0 (#​20426, b6935c3) (@​johnstcn)
• Document key scopes for OpenAI and Anthropic for aibridge (#​20903, 823009d) (@​dannykopping)
• Document bedrock setup process for aibridge (#​20956) (#​20966, dfa25d5)

Performance improvements

• Use a single query for notification target lookups (#​20574, e49c917) (@​ethanndickson)
• Improve performance of metricsAggregator path by reducing memory allocations (#​20724, 658e8c3) (@​cstyan)
• Reduce DB calls to GetWorkspaceByAgentID via caching workspace info (#​20662, b0e8384) (@​cstyan)
• Optimize migration 371 to run faster on large deployments (#​20906, a926157) (@​geokat)
• Add index to improve the GetWorkspaceAgentByInstanceID query performance (#​20936, c87c33f) (@​mykyta-protsenko)
• Database: Limit GetLatestWorkspaceAppStatusByAppID to 1 row (#​20917, 37fc664) (@​mafredri)

Chores

• Graduate aibridge API out of experimental (#​20523, b20fd6f) (@​dannykopping)
• Graduate aibridge cli out of experimental (#​20524, dcfd6d6) (@​dannykopping)
• Add API key ID to interceptions (#​20513, 991831b) (@​pawbana)
• Implement persistent terraform directories (experimental) (#​20563, 9ca5b44) (@​Emyrk)
• Per template opt into cached terraform directories (#​20609, fe3b825) (@​Emyrk)
• Add timing flag context to warn message (#​20772, 86c4948) (@​dannykopping)
• Protect build timings insert for invalid enums (#​20821, a10c5ff) (@​Emyrk)
• Update OIDC scopes to include offline_access (#​20876, a6581c7) (@​rowansmithau)
• Promote tasks to stable from experimental (#​20921, b255827) (@​DanielleMaywood)
• Actually store translated token metadata (#​20929, e340560) (@​dannykopping)

Compare: v2.28.4...v2.29.0

Container image

• docker pull ghcr.io/coder/coder:v2.29.0

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.6

Compare Source

Stable (since December 09, 2025)

Changelog

Security Update

• Update react to apply patch for CVE-2025-55182 (#​21084) (#​21175, df47153)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.28.5...v2.28.6

Container image

• docker pull ghcr.io/coder/coder:v2.28.6

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.5

Compare Source

Stable (since Dec 2, 2025)

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

• Do not notify marked for deletion for deleted workspaces (#​20937) (#​20945, ed5785f)
• Allow agents to be created on dormant workspaces (#​20909) (#​20912, d81d7ee)

Performance improvements

• Optimize migration 371 to run faster on large deployments (#​20906) (#​21042, 8d18875) (@​geokat)

Compare: v2.28.4...v2.28.5

Container image

• docker pull ghcr.io/coder/coder:v2.28.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.4

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

SECURITY FIXES

• Remove a sensitive field from an agent log line (#​20968) (#​20972, e2a4639)

Bug fixes

• Backport dynamic parameters fix #​20740 (#​20777, 8765352)
• Backport fix #​20769 to 2.28 (#​20872, aa5b22c)

Compare: v2.28.3...v2.28.4

Container image

• docker pull ghcr.io/coder/coder:v2.28.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.3

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

• Upgrade aibridge lib to fix cache issue (#​20730) (#​20734, 7beb95f)

  AI Bridge's injected MCP tools were not being set in a stable sort order. This lead to invalidation of the cache in upstream AI providers' APIs, resulting in more cache writes and therefore higher token spend. Deployments with AI Bridge enabled as well as the oauth2 and mcp-server-http experiments will be affected by this bug, and are highly encouraged to upgrade.

Compare: v2.28.2...v2.28.3

Container image

• docker pull ghcr.io/coder/coder:v2.28.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.2

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

• Use correct slog arguments (#​20721) (#​20723, 097e085)

Compare: v2.28.1...v2.28.2

Container image

• docker pull ghcr.io/coder/coder:v2.28.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.1

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Chores

• Update Go to 1.24.10 (#​20684) (#​20688, b8ab2d3)

Compare: v2.28.0...v2.28.1

Container image

• docker pull ghcr.io/coder/coder:v2.28.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.28.0

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Ensure consistent secret token generation and hashing (#​20388, 13ca9ea) (@​Emyrk)

  This change standardizes how Coder hashes secret tokens by switching OAuth2 tokens from salted userpassword. Hash to the same SHA256 hashing method used for API keys, improving consistency across all secret token types.
  This is a breaking change because existing OAuth2 tokens will no longer validate correctly after the update, but the impact is limited to OAuth2 functionality which is only available in dev builds and experimental features.

• Removed TaskAppID field from WorkspaceBuild API response in favor of new task data model (#​20583, 7a97ebe) (@​DanielleMaywood)

  This change removes the task_app_id field from the WorkspaceBuild API response, which was a temporary field that stored the task's workspace app ID directly in the workspace build object. Clients that were consuming this field from the API will need to instead fetch this information from the new dedicated Task data model via the Task API endpoints.

• AI Bridge is now stable - removed experimental flag and moved from /api/experimental/aibridge/* to /api/v2/aibridge/* (#​20544, a119fe2) (@​dannykopping)

  Removes the experimental flag for AI Bridge and promotes it to Stable. Update URL routes to /api/v2/aibridge/* for continued use of AI Bridge.

Features

Bridge

• Add AWS Bedrock support (#​20507, d18441d) (@​dannykopping)
• AI Bridge API endpoints are now stable and no longer experimental (#​20523, 95f45b3) (@​dannykopping)

CLI

• Add filtering by initiator to provisioner job listing in the CLI (#​20137, d17dd5d) (@​SasSwart)
• Add cli command scaletest dynamic-parameters (#​20034, 65335bc) (@​spikecurtis)
• Add provisioner tags to dynamic-parameters scaletest (#​20435, 0f342ec) (@​spikecurtis)
• Add scoped token support to CLI (#​19985, cadf135) (@​ThomasK33)
• CLI: Prompt for missing required template variables on template creation (#​19973, bb58844) (@​rafrdz)
• CLI: Warn user if setting autostart on workspace with template-level autostart (#​20454, fb9d8e3) (@​mtojek)
• CLI: Add dynamic completions for ssh command (#​20171, 9780d02) (@​matifali)
• AI Bridge CLI commands are now stable and no longer experimental (#​20524, f5f17f9) (@​dannykopping)

Dashboard

• Add remove task button into the tasks list (#​20036, f23a6a1) (@​BrunoQuaresma)
• Add workspace status on tasks (#​20037, 6b61c8a) (@​BrunoQuaresma)
• Select template version for tasks (#​20146, 840afb2) (@​BrunoQuaresma)
• Include latest build id in task responses (#​20181, 23a44d1) (@​BrunoQuaresma)
• Skip deprecated:false in templates search bar (#​20274, 8ac5453) (@​mtojek)
• Underline links in announcement banner for better visibility (#​20166, 5119db3) (@​app/blink-so)
• Improve template version select ux (#​20347, a6461ab) (@​BrunoQuaresma)
• Add copy on ctrl/command+shift+c and selection to web terminal (#​20129, cbaa97c) (@​code-asher)
• Add terminal in the task page (#​20396, aa689cb) (@​BrunoQuaresma)
• Add support buttons (#​20339, f2a4105) (@​mtojek)
• Add copyparty icon (#​20440, 8daf4f3) (@​DevelopmentCats)
• Dashboard: Make TaskPrompt PromptTextarea read-only when submitting (#​20363, f6526b7) (@​johnstcn)
• Added AI Governance page to view AI Bridge request interception logs (#​20331, f5909e5) (@​jakehwll)

Experimental Features

• Add allow_list to resource-scoped API tokens (#​19964, ed90ecf) (@​ThomasK33)
• Add allow list to API keys (#​19972, f684831) (@​ThomasK33)

MCP Server

• Add task create, list, status, and delete MCP tools (#​19901, ebcfae2) (@​code-asher)
• Add list_apps MCP tool (#​19952, 94c76b9) (@​code-asher)
• Add task send and logs MCP tools (#​20230, 41de4ad) (@​code-asher)

Server

• Add backoff to workspace agent polling (#​20157, e8f0e3e) (@​rafrdz)
• Mount pprof and metrics to /api/v2/debug for admins (#​20353, 0652b18) (@​deansheather)
• Implement oauth2 RFC 7009 token revocation endpoint (#​20362, 4bd7c7b) (@​Emyrk)
• Add an organization member permission level (#​19953, 4f7b279) (@​aslilac)
• Server: Add tasks rbac object (#​20234, 299a54a) (@​mafredri)
• Server: Implement task to app linking (#​20237, a8f87c2) (@​mafredri)
• Server: Add audit resource for tasks (#​20301, 408b09a) (@​mafredri)
• Server: Notify on task completion/failure (#​20327, 0faee8e) (@​johnstcn)
• Server: Add owner-related fields to tasks_with_status view (#​20471, 659f89e) (@​johnstcn)

Tasks

• Add remove task button into the tasks list (#​20036, f23a6a1) (@​BrunoQuaresma)
• Add workspace status on tasks (#​20037, 6b61c8a) (@​BrunoQuaresma)
• Add task create, list, status, and delete MCP tools (#​19901, ebcfae2) (@​code-asher)
• Select template version for tasks (#​20146, 840afb2) (@​BrunoQuaresma)
• Include latest build id in task responses (#​20181, 23a44d1) (@​BrunoQuaresma)
• Add task send and logs MCP tools (#​20230, 41de4ad) (@​code-asher)
• Add terminal in the task page (#​20396, aa689cb) (@​BrunoQuaresma)
• Dashboard: Make TaskPrompt PromptTextarea read-only when submitting (#​20363, f6526b7) (@​johnstcn)
• Server: Implement task to app linking (#​20237, a8f87c2) (@​mafredri)
• Server: Add audit resource for tasks (#​20301, 408b09a) (@​mafredri)
• Server: Notify on task completion/failure (#​20327, 0faee8e) (@​johnstcn)
• Server: Add owner-related fields to tasks_with_status view (#​20471, 659f89e) (@​johnstcn)
• Database: Add task status and status view (#​20235, 952c69f) (@​mafredri)
• Database: Add ListTasks query (#​20282, 9f22937) (@​johnstcn)
• Server: Add telemetry for database Tasks (#​20279, dc6e50d) (@​johnstcn)
• Tasks are now automatically deleted when their associated workspace is deleted (#​20585, 73dedcc) (@​johnstcn)
• Disable task notifications by default (#​20518, a1e7e10) (@​DanielleMaywood)

Templates

• Cancel pending prebuilds from non-active template versions (#​20387, f6e86c6) (@​ssncferreira)
• Provisioner: Warn when .terraform.lock.hcl is modified during init (#​20451, 40e1784) (@​mtojek)
• Improved prebuild membership reconciliation performance (#​20555, 7e8fcb4) (@​ssncferreira)
• Canceled pending prebuilds are now automatically deleted (#​20554, c3e3bb5) (@​ssncferreira)
• Add a dependency management graph for agents (#​20208, 6c62136) (@​SasSwart)

Bug fixes

• Check permission to update username (#​20139, d93629b) (@​mtojek)
• Add heartbeat to keep dynamic params websocket open (#​20026, c517aab) (@​rafrdz)
• Only show error once when failing to update org member roles (#​20155, 2ec9be2) (@​aslilac)
• Adjust workspace claims to be initiated by users (#​20179, 544f155) (@​SasSwart)
• Allow unhanger to unhang dormant workspaces (#​20229, 8942b50) (@​deansheather)
• Set default values for RevokeURL property in external auth configs (#​20270, 847058c) (@​pawbana)
• Add default value for RevokeURL property in external auth config for GitHub (#​20272, 152103b) (@​pawbana)
• Keep button in loading state after start request is made (#​20294, 24dddd5) (@​BrunoQuaresma)
• Select the correct version when template changes (#​20293, 9861931) (@​BrunoQuaresma)
• Avoid connection logging crashes in agent (#​20307, 6c99d5e) (@​deansheather)
• Use the selected version to check external auth (#​20316, 91d4f8b) (@​BrunoQuaresma)
• Clear prompt after task creation (#​20344, 09a41f3) (@​BrunoQuaresma)
• Use AvatarData in OAuth2AppsSettings (#​20342, a833b7a) (@​BrunoQuaresma)
• Improve options table reading (#​20341, 838fbc1) (@​BrunoQuaresma)
• Introduce dedicated queries for workspaces and workspace agents metrics (#​19786, 141ef23) (@​cstyan)
• Normalize oauth2 scope parsing (#​20359, 251f787) (@​ThomasK33)
• Retry embedded postgres port allocation (#​20371, e73f9d3) (@​zedkipp)
• Renumber api key allow list migration (#​20457, c6e551f) (@​ThomasK33)
• Fix URL parameter for task (#​20463, cd0a284) (@​BrunoQuaresma)
• Initialize pseudo console with default size for SSH sessions (#​20472, b890930) (@​fioan89)
• CLI: Use correct task status in list/status output (#​20453, e8e31dc) (@​mafredri)
• Server: Correct the name of the unmarshall error variable (#​20150, 039fa89) (@​yyefimov)
• Server: Prevent task working notification for first app status (#​20313, ade3fce) (@​johnstcn)
• Server: Support string type for oidc response's expires_in json property (#​20152, 1c8ee5c) (@​yyefimov)
• Database: Ensure task name uniqueness (#​20236, 5dc57da) (@​mafredri)
• Database: Add missing columns to tasks with status (#​20311, 82945cf) (@​mafredri)
• Database: Use transaction for workspace builder ([#​2050

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.