Release notes
Sourced from github.com/coder/coder/v2's releases.
v2.23.1
Changelog
[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.
Chores
- Revert breaking changes relating to WorkspaceOwnerName (#18304, b906c16b3)
Compare:
v2.23.0...v2.23.1Container image
docker pull ghcr.io/coder/coder:v2.23.1Install/upgrade
Refer to our docs to install or upgrade Coder, or use a release asset below.
Commits
b906c16chore: revert breaking changes relating to WorkspaceOwnerName (#18304)- See full diff in compare view
Most Recent Ignore Conditions Applied to This Pull Request
| Dependency Name | Ignore Conditions | | --- | --- | | github.com/coder/coder/v2 | [>= 2.15.0.a, < 2.15.1] | | github.com/coder/coder/v2 | [>= 2.18.0.a, < 2.18.1] |Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/docker/docker's releases.
28.2.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
- containerd image store: Fix a regression causing
docker build --pushto fail. This reverts the fix fordocker buildnot persisting overridden images as dangling. moby/moby#50105Networking
- When creating the iptables
DOCKER-USERchain, do not add an explicitRETURNrule, allowing users to append as well as insert their own rules. Existing rules are not removed on upgrade, but it won't be replaced after a reboot. moby/moby#5009828.2.1
Packaging updates
- Fix packaging regression in v28.2.0 which broke creating the
dockergroup/user on fresh installations. docker-ce-packaging#120928.2.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 28.2.0 milestone
- moby/moby, 28.2.0 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
[!NOTE] RHEL packages are currently not available and will be released later.
New
- Add
{{.Platform}}as formatting option fordocker psto show the platform of the image the container is running. docker/cli#6042- Add support for relative parent paths (
../) on bind mount sources when usingdocker run/createwith-v/--volumeor--mount type=bindoptions. docker/cli#4966- CDI is now enabled by default. moby/moby#49963
- Show discovered CDI devices in
docker info. docker/cli#6078docker image rm: add--platformoption to remove a variant from multi-platform images. docker/cli#6109- containerd image store: Initial BuildKit support for building Windows container images on Windows (requires an opt-in with
DOCKER_BUILDKIT=1). moby/moby#49740Bug fixes and enhancements
- Add a new log option for fluentd log driver (
fluentd-write-timeout), which enables specifying write timeouts for fluentd connections. moby/moby#49911- Add support for
DOCKER_AUTH_CONFIGfor the experimental--use-api-socketoption. docker/cli#6019- Fix
docker execwaiting for 10 seconds if a non-existing user or group was specified. moby/moby#49868- Fix
docker swarm initignoringcacertoption of--external-ca. docker/cli#5995- Fix an issue where the CLI would not correctly save the configuration file (
~/.docker/config.json) if it was a relative symbolic link. docker/cli#5282- Fix containers with
--restart alwayspolicy using CDI devices failing to start on daemon restart. moby/moby#49990
... (truncated)
Commits
45873beMerge pull request #50105 from jsternberg/revert-build-dangling7994426Revert "containerd: images overridden by a build are kept dangling"f144264Merge pull request #50090 from corhere/libn/overlay-netip768cfaeMerge pull request #50050 from robmry/nftables_internal_dnsd3289ddAdd nftables NAT rules for internal DNS resolver7a0bf74Merge pull request #50038 from ctalledo/fix-for-50037b43afbfMerge pull request #50098 from robmry/remove_docker-user_return_rulec299ba3Update worker.Platforms() in builder-next worker.0e2cc22Merge pull request #50049 from robmry/nftables_env_var_enablee37efd4Merge pull request #50068 from mmorel-35/github.com/containerd/errdefs- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/go-chi/chi/v5's releases.
v5.2.2
What's Changed
- Use strings.Cut in a few places by
@JRaspassin go-chi/chi#971- Fix non-constant format strings in t.Fatalf by
@JRaspassin go-chi/chi#972- Apply fieldalignment fixes to optimize struct memory layout by
@pixel365in go-chi/chi#974- go 1.24 by
@pkieltykain go-chi/chi#977- chore: delint ioutil usage by
@costelain go-chi/chi#962- Fixed typo in Router interface definition by
@mithileshgupta12in go-chi/chi#958- Add support for TinyGo by
@efraimbartin go-chi/chi#978- Exclude middleware/profiler.go in TinyGo, as there's no net/http/pprof pkg by
@cxjavain go-chi/chi#982- Make use of strings.Cut by
@scopin go-chi/chi#1005- Change install command format to code block by
@sglkcin go-chi/chi#1001- Correct documentation by
@mrdominoin go-chi/chi#992Security fix
- Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
- a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
- reported by Anuraag Baishya,
@anuraagbaishya. Thank you!New Contributors
@pixel365made their first contribution in go-chi/chi#974@mithileshgupta12made their first contribution in go-chi/chi#958@efraimbartmade their first contribution in go-chi/chi#978@cxjavamade their first contribution in go-chi/chi#982@sglkcmade their first contribution in go-chi/chi#1001@mrdominomade their first contribution in go-chi/chi#992Full Changelog: https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2
v5.2.1
⚠️ Chi supports Go 1.20+
Starting this release, we will now support the four most recent major versions of Go. See go-chi/chi#963 for related discussion.
What's Changed
- Support the four most recent major versions of Go by
@VojtechVitekin go-chi/chi#969Full Changelog: https://github.com/go-chi/chi/compare/v5.2.0...v5.2.1
v5.2.0
What's Changed
- update credits section to link to goji license by
@pkieltykain go-chi/chi#944- go 1.23 by
@pkieltykain go-chi/chi#945- Make Context.RoutePattern() nil-safe by
@gaiaz-iusipovin go-chi/chi#927- govet: Fix non-constant format string by
@marcofranssenin go-chi/chi#952- Add
FindtoRoutesinterface by@joeriddlesin go-chi/chi#872- Fix grammar error by
@AntonC9018in go-chi/chi#917feat(): add CF-Connecting-IP by@n33pmin go-chi/chi#908
Revert "feat(): add CF-Connecting-IP" by@VojtechVitekin go-chi/chi#966
... (truncated)
Commits
23c395fCorrect documentation (#992)5516d14docs: change install code to code block (#1001)e235052Make use of strings.Cut (#1005)1be7ad9Merge commit from forkd7034fdExclude profiler when use tinygo (#982)d047034support tinygo (#978)fe2c065Fixed the typo (#958)1aae5b2chore: delint ioutil usage (#962)c6225e3go 1.24 (#977)e846b83Apply fieldalignment fixes to optimize struct memory layout (#974)- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/docker/docker's releases.
28.3.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 28.3.0 milestone
- moby/moby, 28.3.0 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
New
- Add support for AMD GPUs in
docker run --gpus. moby/moby#49952- Use
DOCKER_AUTH_CONFIGas a credential store. docker/cli#6008Bug fixes and enhancements
- Ensure that the state of the container in the daemon database (used by /containers/json API) is up to date when the container is stopped using the /containers/{id}/stop API (before response of API). moby/moby#50136
- Fix
docker image inspect inspectomitting empty fields. moby/moby#50135- Fix
docker images --treenot marking images as in-use when the containerd image store is disabled. docker/cli#6140- Fix
docker pull/pushhang in non-interactive when authentication is required caused by prompting for login credentials. docker/cli#6141- Fix a potential resource leak when a node leaves a Swarm. moby/moby#50115
- Fix a regression where a login prompt on
docker pullwould show Docker Hub-specific hints when logging in on other registries. docker/cli#6135- Fix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50211
- Remove an undocumented, hidden, top-level
docker removecommand that was accidentally introduced in Docker 23.0. docker/cli#6144- Validate registry-mirrors configuration as part of
dockerd --validateand improve error messages for invalid mirrors. moby/moby#50240dockerd-rootless-setuptool.sh: Fix the script from silently returning with no error message when subuid/subgid system requirements are not satisfied. moby/moby#50059- containerd image store: Fix
docker pushnot creating a tag on the remote repository. moby/moby#50199- containerd image store: Improve handling of errors returned by the token server during
docker pull/push. moby/moby#50176Packaging updates
- Allow customizing containerd service name for OpenRC. moby/moby#50156
- Update BuildKit to v0.23.1. moby/moby#50243
- Update Buildx to v0.25.0. docker/docker-ce-packaging#1217
- Update Compose to v2.37.2. docker/docker-ce-packaging#1219
- Update Docker Model CLI plugin to v0.1.30. docker/docker-ce-packaging#1218
- Update Go runtime to 1.24.4. docker/docker-ce-packaging#1213, moby/moby#50153, docker/cli#6124
Networking
- Revert Swarm related changes added in 28.2.x builds, due to a regression reported in moby/moby#50129. moby/moby#50169
- Revert: Fix an issue where
docker network inspect --verbosecould sometimes crash the daemon (moby/moby#49937).- Revert: Fix an issue where the load-balancer IP address for an overlay network would not be released in certain cases if the Swarm was lacking an ingress network (moby/moby#49948).
- Revert: Improve the reliability of NetworkDB in busy clusters and lossy networks (moby/moby#49932).
- Revert: Improvements to the reliability and convergence speed of NetworkDB (moby/moby#49939).
- Fix an issue that could cause container startup to fail, or lead to failed UDP port mappings, when some container ports are mapped to
0.0.0.0and others are mapped to specific host addresses. moby/moby#50054- The
network inspectresponse for an overlay network now reports thatEnableIPv4is true. moby/moby#50147- Windows: Improve daemon startup time in cases where the host has networks of type
"Mirrored". moby/moby#50155- Windows: Make sure
docker system pruneanddocker network pruneonly remove networks created by Docker. moby/moby#50154
... (truncated)
Commits
265f709Merge pull request #50247 from vvoland/50245-28.xb2a9318docs: cut api docs for v1.51b3e2e22Merge pull request #50244 from vvoland/50177-28.xc571cd8Merge pull request #50243 from vvoland/50238-28.x8c713c1gha: lower timeouts on "build" and "merge" steps539c115Merge pull request #50240 from thaJeztah/28.x_backport_validate_mirrors8e7ea47vendor: update buildkit to v0.23.1222baf4vendor: github.com/moby/buildkit v0.23.01627e82Merge pull request #50241 from thaJeztah/28.x_backport_update_cgroups4070ebdMerge pull request #50242 from thaJeztah/28.x_backport_fix_event_ordering- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/coder/coder/v2's releases.
v2.24.1
Changelog
[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.
Bug fixes
- Fix tasks becoming unusable when no workspace preset is defined in corresponding template (#18723, 5059c23b4) (
@hugodutka)- Fix task sidebar not displaying apps without health check (#18687, f97bd76bb) (
@hugodutka)Compare:
v2.24.0...v2.24.1Container image
docker pull ghcr.io/coder/coder:v2.24.1Install/upgrade
Refer to our docs to install or upgrade Coder, or use a release asset below.
v2.24.0
Changelog
[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.
BREAKING CHANGES
- Change
updatebuild to stop workspaces before starting (#18425, 49fcffc26) (@johnstcn)⚠ Modifies the behavior when updating a workspace. Previously, a workspace
updatewould triggger astartbuild, re-creating the agent and updating any existing compute resources in-place. This change has workspace updates explicitly trigger astopbuild with a subsequentstartbuild. This was implemented to fix pre-builds and improve consistency. Read more here.
- CLI: Modifies
coder updateto stop the workspace if already running.- Dashboard: Modifies "update" button to always stop the workspace if already running.
- CLI: enforce selection for multiple agents rather than use randomness (#18427, bacdc2888) (
@mafredri)This only impacts the flow for our new devcontainer integration, and existing users will not see changes to behavior.
SECURITY CHANGES
- Both Coder v2.23 and Coder v2.24 now handle OIDC refresh tokens (#17878). If users are being logged out of OIDC after short intervals (e.g. 1 hour), ensure you have properly configured OIDC refresh tokens
Features
We'll be exploring the details of major features included in this release in our first product launch event next week. Subscribe using this link to learn more.
Coder tasks allow users to execute long-running jobs using templates in the Coder dashboard. This is often used to manage agentic tasks with tools like Claude Code. See more in our agentic AI documentation.
... (truncated)
Commits
f97bd76fix: handle task sidebar app health check disabled correctly (cherry-pick #18...5059c23fix: handle null response from the template presets endpoint (cherry-pick #18...e5a74a7chore: pull in cherry picks for v2.24 (#18674)de494d0feat: add Coder registry links to template creation and editing (cherry-pick ...7747924fix: stop tearing down non-TTY processes on SSH session end (cherry-pick #186...4a61bbechore: bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (cherry-p...79c666bfix(vpn): avoid setting session token header twice (#18524)288ec77feat: add workspace build status to task page (#18520)a8e2c75chore: update Coder icons to reflect new branding (#18517)fe22b2cchore: update coder/preview dependency to v1.0.1 (#18550)- Additional commits viewable in compare view
Most Recent Ignore Conditions Applied to This Pull Request
| Dependency Name | Ignore Conditions | | --- | --- | | github.com/coder/coder/v2 | [>= 2.15.0.a, < 2.15.1] | | github.com/coder/coder/v2 | [>= 2.18.0.a, < 2.18.1] |Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/hashicorp/terraform-plugin-docs's releases.
v0.22.0
BREAKING CHANGES:
- generate: The
.ProviderShortNametemplate function now uses the rendered provider name to derive the provider short name. Users that pass in the--rendered-provider-nameflag might see a different output for this function (#492)NOTES:
- generate: Generated import documentation will now contain more information about which methods are supported by the provider (CLI command, config by ID, config by identity). (#495)
FEATURES:
- generate: Added support for defining import example file (
import-by-string-id.tf) using Terraform configuration and theidattribute (#472)- generate: Added support for defining import example file (
import-by-identity.tf) using Terraform configuration and theidentityattribute (managed resource identity) (#496)ENHANCEMENTS:
- validate: Add
allowed-guide-subcategoriesandallowed-resource-subcategoriesto provide a list of allowed subcategories (#456)- validate: Add
allowed-guide-subcategories-fileandallowed-resource-subcategories-fileto provide a file containing a list of allowed subcategories (#456)- generate: Default resource and function templates now use
.RenderedProviderNameinstead of.ProviderName(#492)- generate: Remove trailing whitespace from default function template when
.HasVariadicevaluates to false (#489)BUG FIXES:
Changelog
Sourced from github.com/hashicorp/terraform-plugin-docs's changelog.
0.22.0 (July 01, 2025)
BREAKING CHANGES:
- generate: The
.ProviderShortNametemplate function now uses the rendered provider name to derive the provider short name. Users that pass in the--rendered-provider-nameflag might see a different output for this function (#492)NOTES:
- generate: Generated import documentation will now contain more information about which methods are supported by the provider (CLI command, config by ID, config by identity). (#495)
FEATURES:
- generate: Added support for defining import example file (
import-by-string-id.tf) using Terraform configuration and theidattribute (#472)- generate: Added support for defining import example file (
import-by-identity.tf) using Terraform configuration and theidentityattribute (managed resource identity) (#496)ENHANCEMENTS:
- validate: Add
allowed-guide-subcategoriesandallowed-resource-subcategoriesto provide a list of allowed subcategories (#456)- validate: Add
allowed-guide-subcategories-fileandallowed-resource-subcategories-fileto provide a file containing a list of allowed subcategories (#456)- generate: Default resource and function templates now use
.RenderedProviderNameinstead of.ProviderName(#492)- generate: Remove trailing whitespace from default function template when
.HasVariadicevaluates to false (#489)BUG FIXES:
Commits
0be94a7Update changelog5db5509generate: Add support for import configuration examples withidentity+ sch...3b9b212generate: Add support forimportconfiguration examples with theidattri...31cddc7Revert "Bump github.com/yuin/goldmark from 1.7.7 to 1.7.12 (#484)" (#498)9ff8b91Dependabot: Single weekly PR for GH Actions, Single PR for terraform-plugin-*...0367702Generate: Use rendered provider name instead of provider name in default temp...8b2645dBump github.com/yuin/goldmark from 1.7.7 to 1.7.12 (#484)2f25d2cfix: remove double newlines when no variadic argument (#489)2ffec57Remove subcategory field from frontmatter in default provider template. (#446)20d5937Bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 (#491)- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/docker/docker's releases.
28.3.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 28.3.1 milestone
- moby/moby, 28.3.1 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Packaging updates
- Update BuildKit to v0.23.2. moby/moby#50309
- Update Compose to v2.38.1. docker/docker-ce-packaging#1221
- Update Model to v0.1.32 which adds the support for the new top-level
models:key in Docker Compose. docker/docker-ce-packaging#1222
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/docker/docker's releases.
28.3.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 28.3.2 milestone
- moby/moby, 28.3.2 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Bug fixes and enhancements
- Fix
--use-api-socketnot working correctly when targeting a remote daemon. docker/cli#6157- Fix stray "otel error" logs being printed if debug logging is enabled. docker/cli#6160
- Quote SSH arguments when connecting to a remote daemon over an SSH connection to avoid unexpected expansion. docker/cli#6147
- Warn when
DOCKER_AUTH_CONFIGis set duringdocker loginanddocker logout. docker/cli#6163Packaging updates
- Update Compose to v2.38.2. docker/docker-ce-packaging#1225
- Update Docker Model CLI plugin to v0.1.33. docker/docker-ce-packaging#1227
- Update Go runtime to 1.24.5. moby/moby#50354
Commits
e77ff99Merge pull request #50354 from vvoland/50353-28.x6e3cf7fMerge pull request #50351 from vvoland/50179-28.x38c0abfupdate to go1.24.53b7d703Merge pull request #50352 from vvoland/50347-28.xd14a60fMerge pull request #50348 from vvoland/50314-28.xda65c86Merge pull request #50350 from vvoland/50333-28.x76fbfe9Merge pull request #50349 from vvoland/50255-28.xbfade89integration/networking: increase context timeout for attacha818cfdgha: run windows 2025 on PRs, 2022 scheduled653777agha: update to windows 2022 / 2025- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from actions/checkout's releases.
v4.3.0
What's Changed
- docs: update README.md by
@motssin actions/checkout#1971- Add internal repos for checking out multiple repositories by
@mouismailin actions/checkout#1977- Documentation update - add recommended permissions to Readme by
@benwellsin actions/checkout#2043- Adjust positioning of user email note and permissions heading by
@joshmgrossin actions/checkout#2044- Update README.md by
@nebuk89in actions/checkout#2194- Update CODEOWNERS for actions by
@TingluoHuangin actions/checkout#2224- Update package dependencies by
@salmanmkcin actions/checkout#2236- Prepare release v4.3.0 by
@salmanmkcin actions/checkout#2237New Contributors
@motssmade their first contribution in actions/checkout#1971@mouismailmade their first contribution in actions/checkout#1977@benwellsmade their first contribution in actions/checkout#2043@nebuk89made their first contribution in actions/checkout#2194@salmanmkcmade their first contribution in actions/checkout#2236Full Changelog: https://github.com/actions/checkout/compare/v4...v4.3.0
Changelog
Sourced from actions/checkout's changelog.
Changelog
V4.3.0
- docs: update README.md by
@motssin actions/checkout#1971- Add internal repos for checking out multiple repositories by
@mouismailin actions/checkout#1977- Documentation update - add recommended permissions to Readme by
@benwellsin actions/checkout#2043- Adjust positioning of user email note and permissions heading by
@joshmgrossin actions/checkout#2044- Update README.md by
@nebuk89in actions/checkout#2194- Update CODEOWNERS for actions by
@TingluoHuangin actions/checkout#2224- Update package dependencies by
@salmanmkcin actions/checkout#2236v4.2.2
url-helper.tsnow leverages well-known environment variables by@jww3in actions/checkout#1941- Expand unit test coverage for
isGhesby@jww3in actions/checkout#1946v4.2.1
- Check out other refs/* by commit if provided, fall back to ref by
@orhantoyin actions/checkout#1924v4.2.0
- Add Ref and Commit outputs by
@lucacomein actions/checkout#1180- Dependency updates by
@dependabot- actions/checkout#1777, actions/checkout#1872v4.1.7
- Bump the minor-npm-dependencies group across 1 directory with 4 updates by
@dependabotin actions/checkout#1739- Bump actions/checkout from 3 to 4 by
@dependabotin actions/checkout#1697- Check out other refs/* by commit by
@orhantoyin actions/checkout#1774- Pin actions/checkout's own workflows to a known, good, stable version. by
@jww3in actions/checkout#1776v4.1.6
- Check platform to set archive extension appropriately by
@cory-millerin actions/checkout#1732v4.1.5
- Update NPM dependencies by
@cory-millerin actions/checkout#1703- Bump github/codeql-action from 2 to 3 by
@dependabotin actions/checkout#1694- Bump actions/setup-node from 1 to 4 by
@dependabotin actions/checkout#1696- Bump actions/upload-artifact from 2 to 4 by
@dependabotin actions/checkout#1695- README: Suggest
user.emailto be41898282+github-actions[bot]@users.noreply.github.comby@cory-millerin actions/checkout#1707v4.1.4
- Disable
extensions.worktreeConfigwhen disablingsparse-checkoutby@jww3in actions/checkout#1692- Add dependabot config by
@cory-millerin actions/checkout#1688- Bump the minor-actions-dependencies group with 2 updates by
@dependabotin actions/checkout#1693- Bump word-wrap from 1.2.3 to 1.2.5 by
@dependabotin actions/checkout#1643v4.1.3
- Check git version before attempting to disable
sparse-checkoutby@jww3in actions/checkout#1656- Add SSH user parameter by
@cory-millerin actions/checkout#1685- Update
actions/checkoutversion inupdate-main-version.ymlby@jww3in actions/checkout#1650
... (truncated)
Commits
08eba0bPrepare release v4.3.0 (#2237)631c7dcUpdate package dependencies (#2236)8edcb1bUpdate CODEOWNERS for actions (#2224)09d2acaUpdate README.md (#2194)85e6279Adjust positioning of user email note and permissions heading (#2044)009b9aeDocumentation update - add recommended permissions to Readme (#2043)cbb7224Update README.md (#1977)3b9b8c8docs: update README.md (#1971)- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Commits
42faf79Merge pull request #138 from thaJeztah/sockets_move_unix_options9ffab7esockets: make NewUnixSocket, WithChown, WithChmod unix-only6bb1d15Merge pull request #135 from thaJeztah/rename_test_filesb6c843dsockets: rename files to be considered test files80898b6Merge pull request #133 from thaJeztah/deprecate_socket_dialpipea4399e5socket: deprecate DialPipeb071e04Merge pull request #128 from thaJeztah/remove_old_cyphers578bfdeMerge pull request #132 from thaJeztah/optimize_ParsePortSpecdeccd71tlsconfig: align client and server defaults, remove weak CBC ciphers30b91c8nat: ParsePortSpec: combine some conditions- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/coder/coder/v2's releases.
v2.25.1
Changelog
[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.
Bug fixes
- Upgrade to 1.24.6 to fix race in lib/pq queries (#19214) (#19218, 079328d87)
⚠ Resolves CVE-2025-47907, details can be found here in golang/go. Additionally, see our blog about this vulnerability.
Compare:
v2.25.0...v2.25.1Container image
docker pull ghcr.io/coder/coder:v2.25.1Install/upgrade
Refer to our docs to install or upgrade Coder, or use a release asset below.
v2.25.0
Changelog
[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.
BREAKING CHANGES
- Route connection logs to Connection log instead of Audit log (#18340, 08e17a07f) (
@ethanndickson)Connections to workspaces (via SSH, workspace apps, or browser port-forwarding) will no longer create entries in the audit log. Those events will now be included in the 'Connection Log'. Please see the 'Connection Log' page in the dashboard, and the Connection Log documentation for details. Those with permission to view the Audit Log will also be able to view the Connection Log. The new Connection Log has the same licensing restrictions as the Audit Log, and requires a Premium Coder deployment.
- Delete old connection events from audit log (#18735, f42de9fe1) (
@ethanndickson)With new connection events appearing in the Connection Log, connection events older than 90 days will now be deleted from the Audit Log. If you require this legacy data, we recommend querying it from the REST API or making a backup of the database/these events before upgrading your Coder deployment. Please see the PR for details on what exactly will be deleted. Note: There are currently no plans to delete connection events from the Connection Log.
- Add ability to cancel pending workspace build (#18713, 8202514ce) (
@kacpersaw)CancelWorkspaceBuild method in codersdk now accepts an optional
requestparameter.- Use devcontainer ID when rebuilding a devcontainer (#18604, f2d229eed) (
@DanielleMaywood)Minor breaking change for workspaces enabled by our devcontainer integration. Allows rebuilding a devcontainer without a valid devcontainer ID.
- CLI: Add CLI support for creating workspace with presets (#18912, b975d6d9b) (
@ssncferreira)This breaking change impacts the
coder createCLI command only for templates which contain presets.It introduces a
--presetflag to the create command, which modifies the behavior when no preset is explicitly provided:
- If the template includes presets and a default preset, the default will be automatically applied. The user will be notified, but not prompted.
- If the template includes presets without a default, the user will be prompted to choose a preset.
This breaks existing workflows for templates with presets that:
- Expect the create command to proceed without applying a preset
- Rely on non-interactive scripts or automated workflows, which will now fail or hang due to unexpected prompts
... (truncated)
Commits
3bf6a00chore: revert CLI binary publishing for releases.coder.com (#19236)9eb5fc6chore: fix CLI binary publishing for releases.coder.com (#19230)079328dfix: upgrade to 1.24.6 to fix race in lib/pq queries (#19214) (#19218)e68ffe8ci: bump xcode version to 16.1.0 (#19125) (#19221)e6ec957Cherry-pick for release 2.25 (#19169)f1cf81cchore: add openai icon (cherry-pick #19118) (#19176)4bced62chore: add site/ CODEOWNERS (#19086)3a3972cchore: add catalog-info.yaml for backstage integration (#19085)558e25dfeat: support shift+enter in terminal (#19021)71738f6feat(site): support icon and description in preset (#19063)- Additional commits viewable in compare view
Most Recent Ignore Conditions Applied to This Pull Request
| Dependency Name | Ignore Conditions | | --- | --- | | github.com/coder/coder/v2 | [>= 2.15.0.a, < 2.15.1] | | github.com/coder/coder/v2 | [>= 2.18.0.a, < 2.18.1] |Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/hashicorp/terraform-plugin-framework's releases.
v1.15.1
BUG FIXES:
- all: Fixed bug with
UseStateForUnknownwhere known null state values were not preserved during update plans. (#1117)
Changelog
Sourced from github.com/hashicorp/terraform-plugin-framework's changelog.
1.15.1 (July 31, 2025)
BUG FIXES:
- all: Fixed bug with
UseStateForUnknownwhere known null state values were not preserved during update plans. (#1117)
Commits
4781d13Update changeloga3a4370all: AdjustUseStateForUnknownplan modifiers to preserve known null state ...- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show
Release notes
Sourced from github.com/docker/docker's releases.
v28.3.3
28.3.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506.
Packaging updates
- Update Buildx to v0.26.1. docker/docker-ce-packaging#1230
- Update Compose to v2.39.1. docker/docker-ce-packaging#1234
- Update Docker Model CLI plugin to v0.1.36. docker/docker-ce-packaging#1233
Go SDK
- cli/command/formatter: add
TrunateID()utility as alternative forgithub.com/docker/docker/pkg/stringid.TrunateID(). docker/cli#6180
Commits
bea959cMerge pull request #50506 from robmry/backport-28.x/fix_firewalld_reload3e9ff78bridge: Reapply endpoint iptables rules on firewalld reload29ed80abridge: Trigger firewalld reload during bridge integration testsda489a1Merge pull request #50478 from thaJeztah/28.x_backport_gha_bump_bkf173e45Merge pull request #50480 from austinvazquez/cherry-pick-ea29dffaa541289591aa...e4b1f89daemon/server: remove compatibility with API v1.4 auth-config on push0c9e14dhack/buildkit-ref: temporarily bump BuildKit to head of v0.23 branchbf6d688Merge pull request #50471 from austinvazquez/cherry-pick-b1ce0c89f0214cc6711c...4205776client: always send (empty) body on push- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show