LoginSign Up
← Back to all sparks
C

Coder

INFRA · APIS
Velocity2.5

Self-hosted cloud development environments on your infrastructure.

coder.com ↗

Coder clears 16+ Glasswing-disclosed CVEs while expanding AI model support in its aibridge layer.

devtoolssecurityaibridgeremote-deventerprisemulti-branch
◆Current state
Coder is running four concurrent release trains (2.29, 2.32, 2.33, 2.34), all of which received a coordinated security hardening drop in June following Anthropic's Project Glasswing disclosure. The patches covered OIDC account-linking abuse, workspace cross-tenant rebinding, command injection in the shell execer, and session token exfiltration — a broad surface area that points to Coder's expanding enterprise footprint. Alongside the security work, the aibridge layer (Coder's AI model integration point) is being kept current: v2.33.10 added Bedrock Opus 4.8 adaptive thinking support.
◆Where it's heading
The multi-branch maintenance cadence signals a large installed base of enterprise customers pinned to specific LTS lines — Coder is managing the complexity of shipping features while backporting security across four branches. The aibridge thread is the more interesting forward signal: Bedrock support and the new ephemeral CLI parameters both point toward Coder deepening its agentic coding workflow story rather than just being a remote dev box. Expect the security surface to keep growing as AI-driven workspace access becomes a bigger attack vector.
◆Prediction
The next likely move is a v2.35 mainline with expanded AI workflow features — possibly deeper model-selection UI, workspace-agent-to-model routing, or agentic task scheduling — building on the aibridge plumbing already in place.

◆Recent moves

  1. 12d ago

    v2.34.10

    Four internal bug fixes in v2.34.10: Monaco diff model leaks, IDE token substitution, rate-limit path normalization, and a coderd crash on unsupported Tailnet RPCs. No user-visible behavior change.

    View source ↗
  2. 2mo ago

    v2.33.11

    v2.33.11 backports the INSECURE OIDC email fallback flag (an escape hatch for IdP brokers that don't send email claims) and enforces required external auth on workspace creation — both responding to the June security hardening work on the 2.33 stable branch.

    View source ↗
  3. 2mo ago

    v2.32.10

    v2.32.10 carries the same INSECURE OIDC email fallback backport to the 2.32 branch, plus a dashboard fix restricting the workspaces table to parent agent apps only — a narrow UX correction that matters for multi-agent workspace setups.

    View source ↗
  4. 2mo ago

    v2.29.19

    v2.29.19 skips a flaky Azure identity test under investigation and pins the workspace agent API client to its intended agent. Maintenance patch with no user-visible impact.

    View source ↗
  5. 2mo ago

    v2.33.10

    v2.33.10 addresses six bugs including a notable aibridge fix: Bedrock Opus 4.8 adaptive thinking is now supported, keeping Coder's AI model integration current with Anthropic's latest capability tier. The prebuild claim reinit and forwarded Host header fixes close enterprise edge cases.

    View source ↗
  6. 3mo ago

    v2.29.18

    v2.29.18 backports OIDC auth link repair to the long-term 2.29 branch and fixes enterprise aibridge auth to reject inactive users — maintenance that protects customers running older LTS lines from the June OIDC vulnerabilities.

    View source ↗