v2.36.4

coder/coderv2.36.4Sep 1, 2026by coder-release-publisher[bot]

AI Summary

This is a maintenance release focused on security and stability, featuring fixes for markdown injection, email templates, and agent request handling, along with improvements to Copilot integration and OpenAI cache accounting.

Key Highlights

Security fixes to prevent markdown injection and HTML-escape email templates
Server improvements to reject agent requests from suspended owners
Enhanced Copilot HTTP transport fallback support

Full Release Notes

> ## Stable (since September 1, 2026)

## Changelog

> [!NOTE]
> This is a mainline Coder release. We advise enterprise customers without a staging environment to install our [latest stable release](https://github.com/coder/coder/releases/latest) while we refine this version. Learn more about our [Release Schedule](https://coder.com/docs/install/releases).

### Bug fixes

- Prevent markdown injection in notifications (#28340, 7bb00a1ce6)
- Server: HTML-escape the email template values (#28397, 36654e67b4)
- Server: Reject agent requests from suspended owners (#28513, c257214a67)
- Enable Copilot HTTP transport fallback (#28494, 3076b0c48f) (@ssncferreira)
- Add cache write accounting to OpenAI interceptors (#28716, ca8ef6c811)

### Chores

- Purge identified terraform modules via dbpurge (#28802, 10fd510ada) (@Emyrk)

Compare: [`v2.36.3...v2.36.4`](https://github.com/coder/coder/compare/v2.36.3...v2.36.4)

## Container image

- `docker pull ghcr.io/coder/coder:2.36.4`

## Install/upgrade

Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below.