v2.34.7

1b5d/llm-apiv2.34.7Jul 28, 2026by github-actions[bot]

AI Summary

A maintenance release focusing on security hardening, dependency updates, and dashboard improvements.

Key Highlights

Hardened OAuth2 redirect validation to improve security
Updated Go to 1.26.5 and chi/v5 to 5.3.1
Replaced ansi-to-html in the log viewer for better performance
Fixed client IP resolution from X-Forwarded-For headers

Full Release Notes

## Changelog

### Bug fixes

- Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) (#27148, e77a5be245)
- Bump Go version from 1.26.4 to 1.26.5 (backport 2.34) (#27158, e885cf3534)
- fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27261, 744439f729)
- Resolve client IP from the rightmost untrusted X-Forwarded-For entry (backport 2.34) (#27236, eda3747cef)
- Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, ee17a3bdd3)
- Dashboard: Replace ansi-to-html in the log viewer (#27206, ffa50fb18d) (@aslilac)
- Server: Harden oauth2 redirect validation (#27274, 58e20abbd5) (@aslilac)
- Remove 403 from key failover and cooldown on 401 (#27419, b7d2742adc) (@ssncferreira)

### Documentation

- Documentation: Fix bmcp_ described as suffix instead of prefix (#27392, 2b9e328f9d) (@nickvigilante)

Compare: [`v2.34.6...v2.34.7`](https://github.com/coder/coder/compare/v2.34.6...v2.34.7)

## Container image

- `docker pull ghcr.io/coder/coder:2.34.7`

## Install/upgrade

Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below.