Changelog

BREAKING CHANGES

• Ensure consistent secret token generation and hashing (#20388,13ca9ea) (@Emyrk)

  This change standardizes how Coder hashes secret tokens by switching OAuth2 tokens from salted userpassword. Hash to the same SHA256 hashing method used for API keys, improving consistency across all secret token types.
  This is a breaking change because existing OAuth2 tokens will no longer validate correctly after the update, but the impact is limited to OAuth2 functionality which is only available in dev builds and experimental features.

• Removed TaskAppID field from WorkspaceBuild API response in favor of new task data model (#20583,7a97ebe) (@DanielleMaywood)

  This change removes the task_app_id field from the WorkspaceBuild API response, which was a temporary field that stored the task's workspace app ID directly in the workspace build object. Clients that were consuming this field from the API will need to instead fetch this information from the new dedicated Task data model via the Task API endpoints.

• AI Bridge is now stable - removed experimental flag and moved from/api/experimental/aibridge/* to/api/v2/aibridge/* (#20544,a119fe2) (@dannykopping)

  Removes the experimental flag for AI Bridge and promotes it to Stable. Update URL routes to /api/v2/aibridge/* for continued use of AI Bridge.

Features

Bridge

• Add AWS Bedrock support (#20507,d18441d) (@dannykopping)
• AI Bridge API endpoints are now stable and no longer experimental (#20523,95f45b3) (@dannykopping)

CLI

• Add filtering by initiator to provisioner job listing in the CLI (#20137,d17dd5d) (@SasSwart)
• Add cli commandscaletest dynamic-parameters (#20034,65335bc) (@spikecurtis)
• Add provisioner tags to dynamic-parameters scaletest (#20435,0f342ec) (@spikecurtis)
• Add scoped token support to CLI (#19985,cadf135) (@ThomasK33)
• CLI: Prompt for missing required template variables on template creation (#19973,bb58844) (@rafrdz)
• CLI: Warn user if setting autostart on workspace with template-level autostart (#20454,fb9d8e3) (@mtojek)
• CLI: Add dynamic completions for ssh command (#20171,9780d02) (@matifali)
• AI Bridge CLI commands are now stable and no longer experimental (#20524,f5f17f9) (@dannykopping)

Dashboard

• Add remove task button into the tasks list (#20036,f23a6a1) (@BrunoQuaresma)
• Add workspace status on tasks (#20037,6b61c8a) (@BrunoQuaresma)
• Select template version for tasks (#20146,840afb2) (@BrunoQuaresma)
• Include latest build id in task responses (#20181,23a44d1) (@BrunoQuaresma)
• Skip deprecated:false in templates search bar (#20274,8ac5453) (@mtojek)
• Underline links in announcement banner for better visibility (#20166,5119db3) (@app/blink-so)
• Improve template version select ux (#20347,a6461ab) (@BrunoQuaresma)
• Add copy on ctrl/command+shift+c and selection to web terminal (#20129,cbaa97c) (@code-asher)
• Add terminal in the task page (#20396,aa689cb) (@BrunoQuaresma)
• Add support buttons (#20339,f2a4105) (@mtojek)
• Add copyparty icon (#20440,8daf4f3) (@DevelopmentCats)
• Dashboard: Make TaskPrompt PromptTextarea read-only when submitting (#20363,f6526b7) (@johnstcn)
• Added AI Governance page to view AI Bridge request interception logs (#20331,f5909e5) (@jakehwll)

Experimental Features

• Add allow_list to resource-scoped API tokens (#19964,ed90ecf) (@ThomasK33)
• Add allow list to API keys (#19972,f684831) (@ThomasK33)

MCP Server

• Add task create, list, status, and delete MCP tools (#19901,ebcfae2) (@code-asher)
• Add list_apps MCP tool (#19952,94c76b9) (@code-asher)
• Add task send and logs MCP tools (#20230,41de4ad) (@code-asher)

Server

• Add backoff to workspace agent polling (#20157,e8f0e3e) (@rafrdz)
• Mount pprof and metrics to /api/v2/debug for admins (#20353,0652b18) (@deansheather)
• Implement oauth2 RFC 7009 token revocation endpoint (#20362,4bd7c7b) (@Emyrk)
• Add an organization member permission level (#19953,4f7b279) (@aslilac)
• Server: Add tasks rbac object (#20234,299a54a) (@mafredri)
• Server: Implement task to app linking (#20237,a8f87c2) (@mafredri)
• Server: Add audit resource for tasks (#20301,408b09a) (@mafredri)
• Server: Notify on task completion/failure (#20327,0faee8e) (@johnstcn)
• Server: Add owner-related fields to tasks_with_status view (#20471,659f89e) (@johnstcn)

Tasks

• Add remove task button into the tasks list (#20036,f23a6a1) (@BrunoQuaresma)
• Add workspace status on tasks (#20037,6b61c8a) (@BrunoQuaresma)
• Add task create, list, status, and delete MCP tools (#19901,ebcfae2) (@code-asher)
• Select template version for tasks (#20146,840afb2) (@BrunoQuaresma)
• Include latest build id in task responses (#20181,23a44d1) (@BrunoQuaresma)
• Add task send and logs MCP tools (#20230,41de4ad) (@code-asher)
• Add terminal in the task page (#20396,aa689cb) (@BrunoQuaresma)
• Dashboard: Make TaskPrompt PromptTextarea read-only when submitting (#20363,f6526b7) (@johnstcn)
• Server: Implement task to app linking (#20237,a8f87c2) (@mafredri)
• Server: Add audit resource for tasks (#20301,408b09a) (@mafredri)
• Server: Notify on task completion/failure (#20327,0faee8e) (@johnstcn)
• Server: Add owner-related fields to tasks_with_status view (#20471,659f89e) (@johnstcn)
• Database: Add task status and status view (#20235,952c69f) (@mafredri)
• Database: Add ListTasks query (#20282,9f22937) (@johnstcn)
• Server: Add telemetry for database Tasks (#20279,dc6e50d) (@johnstcn)
• Tasks are now automatically deleted when their associated workspace is deleted (#20585,73dedcc) (@johnstcn)
• Disable task notifications by default (#20518,a1e7e10) (@DanielleMaywood)

Templates

• Cancel pending prebuilds from non-active template versions (#20387,f6e86c6) (@ssncferreira)
• Provisioner: Warn when .terraform.lock.hcl is modified during init (#20451,40e1784) (@mtojek)
• Improved prebuild membership reconciliation performance (#20555,7e8fcb4) (@ssncferreira)
• Canceled pending prebuilds are now automatically deleted (#20554,c3e3bb5) (@ssncferreira)
• Add a dependency management graph for agents (#20208,6c62136) (@SasSwart)

Bug fixes

• Check permission to update username (#20139,d93629b) (@mtojek)
• Add heartbeat to keep dynamic params websocket open (#20026,c517aab) (@rafrdz)
• Only show error once when failing to update org member roles (#20155,2ec9be2) (@aslilac)
• Adjust workspace claims to be initiated by users (#20179,544f155) (@SasSwart)
• Allow unhanger to unhang dormant workspaces (#20229,8942b50) (@deansheather)
• Set default values forRevokeURL property in external auth configs (#20270,847058c) (@pawbana)
• Add default value for RevokeURL property in external auth config for GitHub (#20272,152103b) (@pawbana)
• Keep button in loading state after start request is made (#20294,24dddd5) (@BrunoQuaresma)
• Select the correct version when template changes (#20293,9861931) (@BrunoQuaresma)
• Avoid connection logging crashes in agent (#20307,6c99d5e) (@deansheather)
• Use the selected version to check external auth (#20316,91d4f8b) (@BrunoQuaresma)
• Clear prompt after task creation (#20344,09a41f3) (@BrunoQuaresma)
• Use AvatarData in OAuth2AppsSettings (#20342,a833b7a) (@BrunoQuaresma)
• Improve options table reading (#20341,838fbc1) (@BrunoQuaresma)
• Introduce dedicated queries for workspaces and workspace agents metrics (#19786,141ef23) (@cstyan)
• Normalize oauth2 scope parsing (#20359,251f787) (@ThomasK33)
• Retry embedded postgres port allocation (#20371,e73f9d3) (@zedkipp)
• Renumber api key allow list migration (#20457,c6e551f) (@ThomasK33)
• Fix URL parameter for task (#20463,cd0a284) (@BrunoQuaresma)
• Initialize pseudo console with default size for SSH sessions (#20472,b890930) (@fioan89)
• CLI: Use correct task status in list/status output (#20453,e8e31dc) (@mafredri)
• Server: Correct the name of the unmarshall error variable (#20150,039fa89) (@yyefimov)
• Server: Prevent task working notification for first app status (#20313,ade3fce) (@johnstcn)
• Server: Support string type for oidc response's expires_in json property (#20152,1c8ee5c) (@yyefimov)
• Database: Ensure task name uniqueness (#20236,5dc57da) (@mafredri)
• Database: Add missing columns to tasks with status (#20311,82945cf) (@mafredri)
• Database: Use transaction for workspace builder (#20506,c3cbd97) (@mafredri)
• Server: Pipe through task id and prompt (#20408,5a31c59) (@DanielleMaywood)
• devcontainers: check if ssh folder exists in post_create (#19987,8274251) (@mafredri)
• Provisioner: Use sidebar app id instead of app id (#20246,5d66f1f) (@DanielleMaywood)
• Dashboard: Disable task prompt submit button when prompt empty (#20357,a1fa5c8) (@DanielleMaywood)
• Dashboard: Preserve file path when building template version (#20481,ed3d6fa) (@breadface)
• Dashboard: Fix react state violation in filetree create/update utils (#20483,40fc337) (@DanielleMaywood)
• Fixed issue where workspace builds could be created on deleted workspaces (#20586,3801701) (@johnstcn)
• Fixed Helm chart bug where RBAC resources were incorrectly rendered when workspacePerms=false (#20569,e909a99) (@rowansmithau)
• Fixed task link generation in workspace app status by adding task_id to workspace view (#20551,1ebc217) (@johnstcn)
• Fixed incorrect audit log links for task resources (#20547,566146a) (@johnstcn)
• Fixed lifecycle executor per...

Contributors

Stable (since October 16, 2025)

Changelog

Bug fixes

• Fix incorrect rendering of RBAC in Helm chart when workspacePerm… (#20596,800dd9c)

  Fixed incorrect rendering of Kubernetes RBAC resources in Helm chart whenworkspacePerms=false. Previously, Role and RoleBinding resources were still created for workspace namespaces even when workspace permissions were explicitly disabled, potentially granting unintended permissions.

Compare:v2.27.2...v2.27.3

Container image

• docker pull ghcr.io/coder/coder:v2.27.3

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Initialize pseudo console with default size for SSH sessions [2.27] (#20490,035ad33)

  Fixed an issue where SSH connections to Windows workspaces would fail with an invalid parameter error when clients (like JetBrains Toolbox) force PTY allocation without providing terminal dimensions. The pseudo console now initializes with a default size instead of 0x0, which Windows doesn't accept.

Compare:v2.27.1...v2.27.2

Container image

• docker pull ghcr.io/coder/coder:v2.27.2

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Stable (since October 28, 2025)

Changelog

Bug fixes

• Initialize pseudo console with default size for SSH sessions [2.26] (#20491,ee8e8cb)

Compare:v2.26.2...v2.26.3

Container image

• docker pull ghcr.io/coder/coder:v2.26.3

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Changelog

Bug fixes

• Server: Truncate task prompt to 160 characters in notifications (#20147) (#20153,b2d6a18) (@johnstcn)

  Certaincoder stat commands were failing on more complex Cgroup environments. This patch addresses that failure, and other complex setups.

Chores

• Upgrade coder/clistat to v1.1.1 (#20322) (#20325,230b55b)

Compare:v2.27.0...v2.27.1

Container image

• docker pull ghcr.io/coder/coder:v2.27.1

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Contributors

Changelog

Bug fixes

• Avoid connection logging crashes in agent [2.26] (#20306,03440f6)

Chores

• Upgrade coder/clistat to v1.1.1 (#20322) (#20324,4793806)

Compare:v2.26.1...v2.26.2

Container image

• docker pull ghcr.io/coder/coder:v2.26.2

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Changelog

BREAKING CHANGES

• Use client IP when creating connection logs for workspace proxied app accesses (#19788,6a9b896) (@ethanndickson)

  The presence of theip field oncodersdk.ConnectionLog cannot be guaranteed, and so the field has been made optional. It may be omitted on API responses.

• Server: Only show task status for current build (#19966,eb55f0a) (@johnstcn)

  Renames theTaskStateCompleted constant toTaskStateComplete to align with the tense used inWorkspaceAppStatusStateComplete, requiring any code referencing the constant to be updated.

• Rename prompt field to input for task creation (#19982,eb74732) (@DanielleMaywood)

  Renames theCreateTaskRequest.Prompt toCreateTaskRequest.Input to align with language used in our CLI and elsewhere in the codebase.

Features

AI Bridge

AI Bridge, the self-hosted LLM proxy for auditing LLM tools and adoption is now in Early access, get started with oursetup guide.

• Addaibridgedserver pkg (#19902,615585d) (@dannykopping)
• Add aibridged package (#19797,fc9bff7) (@dannykopping)
• Initializeaibridged & mount API handler (#19798,0a79817) (@dannykopping)
• Add endpoint to list aibridge interceptions (#19929,0a6ba5d) (@pawbana)

MCP Server

New tools added to theCoder MCP Server in Beta.

• Addcoder_workspace_read_file MCP tool (#19562,4bf63b4) (@code-asher)
• Add tooltip field to workspace app that renders as markdown (#19651,e53bc24) (@rafrdz)
• Addcoder_workspace_write_file MCP tool (#19591,d5a02d5) (@code-asher)
• Add configs for external auth MCP usage + tool allow/denylist (#19794,348a2e0) (@dannykopping)
• Addcoder_workspace_edit_file MCP tool (#19629,30330ab) (@code-asher)
• Addcoder_workspace_ls MCP tool (#19652,be7aa58) (@code-asher)
• Add coder_workspace_port_forward MCP tool (#19863,7f56212) (@code-asher)
• Aibridged mcp handling (#19911,6971f61) (@dannykopping)

Tasks

v2.27.0 introduces the Tasks API (in beta) for integrating background agents into your ecosystem. Read more in ourdocumentation andblog posts.

• Don't redirect to task page when it is created (#19919,6d0943a) (@BrunoQuaresma)
• Add sidebar to task page (#19944,2df9c5b) (@BrunoQuaresma)
• Redesign tasks page to match AI tools (#19962,89339f6) (@BrunoQuaresma)
• Add notification for task status (#19965,fdb0267) (@ssncferreira)
• Delete task from sidebar (#20023,e96d69b) (@BrunoQuaresma)
• Minor prompt redesign (#20045,f009ebd) (@BrunoQuaresma)
• CLI: Add coder exp task delete (#19644,3470632) (@mafredri)
• CLI: Add quiet flag to task create (#19701,f94abfc) (@DanielleMaywood)
• CLI: Add optional --name arg to 'exp task create' (#19939,78b1ec9) (@johnstcn)
• CLI: Add exp task send (#19922,252f430) (@DanielleMaywood)
• CLI: Add formatting options to coder whoami (#19970,930bbaf) (@johnstcn)
• CLI: Improve exp task status --watch (#19969,82bebc7) (@johnstcn)
• CLI: Add exp task logs (#19915,b7e0b2a) (@DanielleMaywood)
• CLI: Add more information tocoder whoami (#19971,0a840e4) (@johnstcn)
• CLI: Add ability to create tasks for other users (#20012,abdea72) (@johnstcn)
• CLI: Addworkspace-updates scaletest command (#19905,0be9221) (@ethanndickson)

Workspace sharing

Shared workspaces are in the early stages of development and not ready for public testing; we're looking forward to sharing the work when it's available. If you have requests for shared workspaces, please leave feedback in ourGithub Discussions.

• Addsharing addcommand to the CLI (#19576,909acbc) (@brettkolodny)
• Addsharing showcommand to the CLI (#19707,065c7c3) (@brettkolodny)
• Addsharing remove command to the CLI (#19767,8d5c566) (@brettkolodny)
• Add--shared-with-me flag tocoder list command (#19948,647101b) (@brettkolodny)

Core

• Add user filter to templates page to filter by template author (#19561,95dccf3) (@rafrdz)
• Add default workspace name to Template Embed form (#19688,5c1a708) (@mtojek)
• Add workspaces/acl [delete] endpoint (#19772,854f3c0) (@brettkolodny)
• Add helm var to support RBAC for deploying workspaces in extra namespaces (#19517,6238937) (@rowansmithau)
• Addshared_with_group: andshared_with_user: filters to /workspaces endpoint (#19875,38ca987) (@brettkolodny)
• Show warning in AppLink if hostname is long enough to break port forwarding (#19506,6c01a77) (@aqandrew)
• Add prebuild timing metrics to Prometheus (#19503,0ab345c) (@ssncferreira)
• Replace the jetbrains-gateway module with the jetbrains toolbox (#19583,b61a5d7) (@app/blink-so)
• Supportcustom notifications (#19751,eec6c8c) (@ssncferreira)
• Ensure OAuth2 refresh tokens outlive access tokens (#19769,088d149) (@ThomasK33)
• Scopeallow_list to includeresource_type (#19748,679179f) (@Emyrk)
• Add best effort attempt to revoke oauth access token in external auth provider (#19775,439b041) (@pawbana)
• Implement API key scopes database migration (#19861,fb0ce38) (@ThomasK33)
• Add lint check for API key scope enum completeness (#19862,acc0890) (@ThomasK33)
• Generate RBAC scope name constants (#19896,adb7521) (@ThomasK33)
• Add scaletest Runner for dynamicparameters load gen (#19890,289f021) (@spikecurtis)
• Add public RBAC scope catalog for user-requestable permissions (#19913,47c92ad) (@ThomasK33)
• Add external API key scopes (#19916,4bda395) (@ThomasK33)
• Add multi-scope support to API keys (#19917,d0db9ec) (@ThomasK33)
• Publish RBAC scopes in OAuth2 metadata endpoints (#19942,05537c1) (@ThomasK33)
• Remove agent name from app URLs (#19750,d29a524) (@rafrdz)
• Implement composite API key scopes for workspaces and templates (#19945,79126ab) (@ThomasK33)
• Server: Add tasks delete endpoint (#19638,e5ac640) (@mafredri)
• Server: Allow specifying a name for a task (#19745,f3b152b) (@DanielleMaywood)
• Server: Add experimental tasks send endpoint (#19941,5317d30) (@mafredri)
• Server: Add experimental tasks logs endpoint (#19958,0bac5a4) (@mafredri)
• Server: Add ability to search org members by user_id, is_system, github_user_id (#20048,ff930ad) (@johnstcn)
• Dashboard: Display warning messages when wildcard is not configured (#19660,7c8f8f4) (@kacpersaw)
• Dashboard: Display warnings in tasks page when wildcard is not configured (#19780,0601cc8) (@kacpersaw)
• Dashboard: Allow starting task workspace from task page (#19790,b71d671) (@DanielleMaywood)
• Dashboard: Add custom notification settings (#19938,da467ba) (@ssncferreira)
• Dashboard: Add task notifications to user settings (#20006,7bddd80) (@ssncferreira)
• Enterprise: Allow system users to be added to groups (#19518,4e9ee80) (@SasSwart)

Bug fixes

• Don't show prebuild workspaces as tasks (#19572,abc946c) (@BrunoQuaresma)
• Suppress license expiry warning if a new license covers the gap (#19601,605dad8) (@deansheather)
• Limit the scope of the template average build time query to the last 100 (#19648,4fab14b) (@cstyan)
• Expire token for prebuilds user when regenerating session token (#19667,06cbb28) (@johnstcn)
• Show popup on successful template build (#19674,d415964) (@mtojek)
• Change enqueue error to debug log level (#19686,04dfda8) (@spikecurtis)
• Pin pg_dump version when generating schema (#19696,1b4ce09) (@ethanndickson)
• Prevent new workspace page from scrolling past the bottom of the screen (#19705,a78d65c) (@brettkolodny)
• Support path parameters in OAuth2 metadata endpoints (#19729,2701d55) (@ThomasK33)
• Add xmlns attribute to amazon-q.svg for proper rendering (#19738,d7d69d1) (@app/blink-so)
• Add support for spaces in search & enable searching by display name in templates (#19552,1677a30) (@rafrdz)
• Prevent unruly stacking contexts from breaking scrolling (#19785,8e79dbb) (@aslilac)
• Trim whitespace from API tokens (#19814,d238480) (@ThomasK33)
• Scroll item list into view when openingMultiSelectCombobox (#19806,8ff4ba0) (@aslilac)
• Correct MCP tools' input schemas (#19825,18b0aca) (@dannykopping)
• Use filepath to construct mcp test write path (#19808,c31768d) (@code-asher)
• Fix TestCloserStack_Timeout to wait for all asyncClosers (#19837,4fc0093) (@spikecurtis)
• Update bitnami to use legacy image (#19891,738dbc6) (@david-fraley)
• Update bitnami image (#19892,40ffb79) (@david-fraley)
• Add retry logic to OAuth2 metadata tests to avoid race conditions (#19813,6fb4cc6) (@ThomasK33)
• Make app tabs scrollable (#19881,e7d648f) (@BrunoQuaresma)
• Use unique cookies for workspace proxies (#19930,42dd544) (@deansheather)
• Force task to be created with latest version (#19923,5ff503b) (@BrunoQuaresma)
• Handle chat app not found for Tasks (#19947,c2d5143) (@BrunoQuaresma)
• Fix for template dormancy hour/day toggle (#19884,aaa5071) (@rowansmithau)
• Add tasks link to sidebar logo (#20038,b8370c2) (@BrunoQuaresma)
• CLI: Enhance error handling for multiple agents in SSH command (#19943,c8742ba) (@kacpersaw)
• CLI: Only implicitly read from stdin if the directory flag is unset (#19681,f867a9d) (@ethanndickson)
• Server: Filter out non-task workspaces in api.tasksList (#19559,dbc6c98) (@joh...

Contributors

Stable (since October 7, 2025)

Changelog

Bug fixes

• Server: Ensure agent WebSocket conn is cleaned up (#19711,7afe6c8) (@DanielleMaywood)
• pinpg_dump version when generating schema (#19696,c0f1b9d) (@ethanndickson)
• Remove expensive GetWorkspaces query from entitlements (#19747,5369204) (@kacpersaw)

Compare:v2.26.0...v2.26.1

Container image

• docker pull ghcr.io/coder/coder:v2.26.1

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Contributors

Stable (since October 01, 2025)

Changelog

Bug fixes

• Server: Ensure agent WebSocket conn is cleaned up (#19711,7afe6c8) (@DanielleMaywood)
• Stop reading closed channel for/watch devcontainers endpoint (#19373) (@DanielleMaywood)

Compare:v2.25.2...v2.25.3

Container image

• docker pull ghcr.io/coder/coder:v2.25.3

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Contributors

Stable (since September 04, 2025)

Changelog

Security Fixes

• Expire token for prebuilds user when regenerating session token (#19667) (#19668,ec66090) (@johnstcn)

  ⚠ Fixes an issue allowing previously authenticated users to claim prebuilt workspaces created from templates using thecoder-login module. Read more in ourGHSA for this vulnerability.

• Server: Add audit log on creating a new session key (#19672) (#19684,a79adb1) (@johnstcn)

  Adds an audit log entry when an API key is created viacoder login.

Bug Fixes

• Fix GCP service accounts (#19312) (#19315,d324cf7) (@ethanndickson)

Compare:v2.25.1...v2.25.2

Container image

• docker pull ghcr.io/coder/coder:v2.25.2

Install/upgrade

Refer to our docs toinstall orupgrade Coder, or use a release asset below.

Contributors