LoginSign Up
← Back to all sparks
C

Coder

INFRA · APIS
Velocity5.0

Self-hosted cloud development environments on your infrastructure.

coder.com ↗

Coder now checks workspace app URLs on the server, a breaking fix sent to all three lines.

devtoolsremote-devsecuritymulti-branchenterprise
◆Current state
Coder maintains supported release lines on v2.29, v2.34 and v2.37 and patches them together. On November 10 all three got the same breaking fix: workspace app URLs are validated on the server, and `coder open app` only attaches the session token to trusted app links. The same releases tighten database connection errors, and 2.29 also stops tailnet coordination panics. This follows the November 3 fixes for CSRF, cross-org group sync and prebuild claims.
◆Where it's heading
Coder's November releases are almost entirely security hardening, sent to three branches at once. The fixes keep narrowing how far tokens, credentials and agent tools can reach outside their intended scope. The feed only shows backport tags, so feature work on the mainline is not visible here.
◆Prediction
Expect more weekly three-line security backports. Whether new mainline features ship cannot be read from these entries.

◆Recent moves

  1. 3d ago

    v2.29.27: server checks app URLs, no tailnet panics

    The oldest supported line gets the breaking server-side app URL check, the trusted-link session token fix and a fix for tailnet coordination panics. Same security set as 2.34 and 2.37, with one extra stability fix.

    View source ↗
  2. 3d ago

    v2.34.19 backports the app URL and token fixes

    The 2.34 copy of the November 10 fix set: server-side app URL validation and session tokens only on trusted links. A backport of the change led on 2.37.

    View source ↗
  3. 3d ago

    v2.37.11: workspace app URLs validated on the server

    A breaking change: the server now rejects invalid workspace app URLs, and the CLI no longer passes the session token to untrusted app links. It extends the month's work on keeping credentials inside their intended scope.

    View source ↗
  4. 10d ago

    v2.34.18 backports CSRF, group-sync and prebuild fixes

    The 2.34 copy of the November 3 fix set, adding the Anthropic thinking-block retry and a Node.js bump. Same security content as 2.37.10.

    View source ↗
  5. 10d ago

    v2.29.26 backports the November security fixes

    The oldest supported line gets the same advisory, CSRF, group-sync and prebuild-lock fixes, plus a Go 1.26.10 bump. Maintenance for sites still pinned to 2.29.

    View source ↗
  6. 10d ago

    v2.37.10 stops group sync crossing org boundaries

    The first 2.37 release in this feed carries the full fix set: group sync can no longer add users to another org's groups, CSRF exemptions are anchored, and prebuild claims lock the workspace row. Continues the October run of permission-boundary fixes.

    View source ↗