Skip to content

chore(deps): bump the coder-image group across 2 directories with 1 update - #273

Merged
matifali merged 1 commit into
mainfrom
dependabot/docker/heroku/coder-image-2a5f686b03
Sep 7, 2026
Merged

chore(deps): bump the coder-image group across 2 directories with 1 update#273
matifali merged 1 commit into
mainfrom
dependabot/docker/heroku/coder-image-2a5f686b03

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the coder-image group with 1 update in the /heroku directory: coder/coder.
Bumps the coder-image group with 1 update in the /render directory: coder/coder.

Updates coder/coder from v2.36.1 to v2.37.0

Release notes

Sourced from coder/coder's releases.

v2.37.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: Update templates so they declare the intended external-auth provider ID for each host and ensure provider regexes do not overlap. If a template references a provider that was renamed or removed from deployment config, restore that provider or update the template declaration.

  • login_type=none deprecated; existing accounts converted to password login (#26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

... (truncated)

Commits
  • 8a148a9 chore: purge identified terraform modules via dbpurge (#28802) (#28810)
  • 152c5b1 fix(site): remove member-facing Models nav item (#28772) (#28781)
  • e25a7dd docs: remove early access label from chats API reference (#28761)
  • 9ed8ffb fix(site): size chat pill selectors to content with an 8ch truncation floor (...
  • 749e5d4 fix(site/src/pages/AgentsPage): adjust context usage indicator error states s...
  • 7986365 fix(coderd): accept RFC 9728 resource metadata with array-valued resource (#2...
  • 89df1c2 fix: add cache write accounting to OpenAI interceptors and service tier to To...
  • b7d7be9 fix: enable Copilot HTTP transport fallback (#28494) (#28713)
  • 4fef221 chore: refresh AI model price book (#28711) (#28720)
  • 8aad49e refactor: rename edit_files wire type to old_text/new_text (#28467) (#28717)
  • Additional commits viewable in compare view

Updates coder/coder from v2.36.1 to v2.37.0

Release notes

Sourced from coder/coder's releases.

v2.37.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: Update templates so they declare the intended external-auth provider ID for each host and ensure provider regexes do not overlap. If a template references a provider that was renamed or removed from deployment config, restore that provider or update the template declaration.

  • login_type=none deprecated; existing accounts converted to password login (#26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

... (truncated)

Commits
  • 8a148a9 chore: purge identified terraform modules via dbpurge (#28802) (#28810)
  • 152c5b1 fix(site): remove member-facing Models nav item (#28772) (#28781)
  • e25a7dd docs: remove early access label from chats API reference (#28761)
  • 9ed8ffb fix(site): size chat pill selectors to content with an 8ch truncation floor (...
  • 749e5d4 fix(site/src/pages/AgentsPage): adjust context usage indicator error states s...
  • 7986365 fix(coderd): accept RFC 9728 resource metadata with array-valued resource (#2...
  • 89df1c2 fix: add cache write accounting to OpenAI interceptors and service tier to To...
  • b7d7be9 fix: enable Copilot HTTP transport fallback (#28494) (#28713)
  • 4fef221 chore: refresh AI model price book (#28711) (#28720)
  • 8aad49e refactor: rename edit_files wire type to old_text/new_text (#28467) (#28717)
  • Additional commits viewable in compare view

Updates coder/coder from v2.36.1 to v2.37.0

Release notes

Sourced from coder/coder's releases.

v2.37.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: Update templates so they declare the intended external-auth provider ID for each host and ensure provider regexes do not overlap. If a template references a provider that was renamed or removed from deployment config, restore that provider or update the template declaration.

  • login_type=none deprecated; existing accounts converted to password login (#26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

... (truncated)

Commits
  • 8a148a9 chore: purge identified terraform modules via dbpurge (#28802) (#28810)
  • 152c5b1 fix(site): remove member-facing Models nav item (#28772) (#28781)
  • e25a7dd docs: remove early access label from chats API reference (#28761)
  • 9ed8ffb fix(site): size chat pill selectors to content with an 8ch truncation floor (...
  • 749e5d4 fix(site/src/pages/AgentsPage): adjust context usage indicator error states s...
  • 7986365 fix(coderd): accept RFC 9728 resource metadata with array-valued resource (#2...
  • 89df1c2 fix: add cache write accounting to OpenAI interceptors and service tier to To...
  • b7d7be9 fix: enable Copilot HTTP transport fallback (#28494) (#28713)
  • 4fef221 chore: refresh AI model price book (#28711) (#28720)
  • 8aad49e refactor: rename edit_files wire type to old_text/new_text (#28467) (#28717)
  • Additional commits viewable in compare view

Updates coder/coder from v2.36.1 to v2.37.0

Release notes

Sourced from coder/coder's releases.

v2.37.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Coder Agents chats API promoted from /api/experimental to /api/v2 (#28496)

    The Coder Agents chats API is moving from /api/experimental to /api/v2. The experimental routes remain available for a one-month migration period. Integrations using endpoints promoted to /api/v2 must migrate before the compatibility routes are removed in v2.38.

    Migration: Update any integration that calls the experimental chats API to the /api/v2 equivalents before v2.38, when the compatibility routes are removed.

  • Default-organization chat-model routes removed (#28632)

    The obsolete default-organization chat-model routes /api/experimental/chats/models and /api/experimental/chats/model-configs are removed immediately in v2.37.

    Migration: Use /api/v2/organizations/{organization}/chats/models instead.

  • OAuth authorization rejects unsupported or over-broad scopes (#28178)

    OAuth authorization requests now reject unsupported or over-broad scopes with invalid_scope. Integrations sending values such as openid, profile, or email may fail.

    Migration: Review your OAuth integrations and remove unsupported or over-broad scope values so requests are not rejected with invalid_scope.

  • Dynamic client registration disabled by default (#27316)

    POST /oauth2/register is now controlled by the persistent deployment setting oauth2_dcr_enabled, which defaults to disabled. When disabled, Coder omits registration_endpoint from discovery metadata and returns an RFC 7591-style 403 for new dynamic client registrations; existing registered clients continue to work.

    Migration: If your deployment relies on Dynamic Client Registration, explicitly enable it after upgrading through PUT /api/v2/oauth2-provider/settings. Existing registered clients are unaffected; only new registrations are gated.

  • Agent external auth now resolves by template, not deployment config order (#27854)

    For hostname-only external auth requests at runtime, such as Git operations through GIT_ASKPASS, Coder now resolves the provider from the workspace template's declared coder_external_auth entries instead of whichever deployment-configured provider matched last in config order. This is breaking for deployments that relied on provider ordering or stale template declarations, because ambiguous declared matches and declared-but-unconfigured providers now return HTTP 404 instead of silently substituting a different provider's token.

    Migration: Update templates so they declare the intended external-auth provider ID for each host and ensure provider regexes do not overlap. If a template references a provider that was renamed or removed from deployment config, restore that provider or update the template declaration.

  • login_type=none deprecated; existing accounts converted to password login (#26851)

    Legacy login_type=none users are deprecated in favor of service accounts. POST /users and coder users create now reject login_type=none and the deprecated --disable-login path unless a service account is explicitly requested, and migration 000554_legacy_none_login_to_password converts existing non-system, non-service-account login_type=none users to login_type=password while preserving email addresses and existing API tokens.

    Migration: Existing affected users are converted automatically on upgrade. Update any automation that creates login_type=none users to create service accounts instead, and set a password only if a converted account needs interactive login.

  • Coder Tasks disabled and deprecated (#28008)

    Coder Tasks is disabled and deprecated. If --hide-ai-tasks remains in the Coder server command-line arguments, or client.hideAITasks remains in YAML configuration files, the Coder server will fail to start with an unknown-option error.

    Migration: Before upgrading, remove --hide-ai-tasks from the Coder server command-line arguments and remove client.hideAITasks from YAML configuration files.

... (truncated)

Commits
  • 8a148a9 chore: purge identified terraform modules via dbpurge (#28802) (#28810)
  • 152c5b1 fix(site): remove member-facing Models nav item (#28772) (#28781)
  • e25a7dd docs: remove early access label from chats API reference (#28761)
  • 9ed8ffb fix(site): size chat pill selectors to content with an 8ch truncation floor (...
  • 749e5d4 fix(site/src/pages/AgentsPage): adjust context usage indicator error states s...
  • 7986365 fix(coderd): accept RFC 9728 resource metadata with array-valued resource (#2...
  • 89df1c2 fix: add cache write accounting to OpenAI interceptors and service tier to To...
  • b7d7be9 fix: enable Copilot HTTP transport fallback (#28494) (#28713)
  • 4fef221 chore: refresh AI model price book (#28711) (#28720)
  • 8aad49e refactor: rename edit_files wire type to old_text/new_text (#28467) (#28717)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the coder-image group across 2 directories with 1 u…
9283278 
…pdate

Bumps the coder-image group with 1 update in the /heroku directory: [coder/coder](https://github.com/coder/coder).
Bumps the coder-image group with 1 update in the /render directory: [coder/coder](https://github.com/coder/coder).


Updates `coder/coder` from v2.36.1 to v2.37.0
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.36.1...v2.37.0)

Updates `coder/coder` from v2.36.1 to v2.37.0
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.36.1...v2.37.0)

Updates `coder/coder` from v2.36.1 to v2.37.0
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.36.1...v2.37.0)

Updates `coder/coder` from v2.36.1 to v2.37.0
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.36.1...v2.37.0)

---
updated-dependencies:
- dependency-name: coder/coder
  dependency-version: v2.37.0
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.37.0
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.37.0
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.37.0
  dependency-type: direct:production
  dependency-group: coder-image
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Sep 7, 2026
@dependabot dependabot Bot mentioned this pull request Sep 7, 2026
Closed
@matifali
matifali merged commit 2654c51 into main Sep 7, 2026
1 check passed
@matifali
matifali deleted the dependabot/docker/heroku/coder-image-2a5f686b03 branch September 7, 2026 05:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update docker code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matifali