v2.34.7

triggerdotdev/trigger.devv2.34.7Jul 28, 2026by github-actions[bot]

AI Summary

This release focuses on bug fixes and security hardening for the Coder platform. It includes dependency updates, dashboard improvements, and fixes for OAuth2 validation and client IP resolution.

Key Highlights

Bumped Go version to 1.26.5
Hardened OAuth2 redirect validation to prevent security risks
Replaced ansi-to-html in the log viewer for better performance
Fixed client IP resolution logic from X-Forwarded-For entries

Full Release Notes

## Changelog

### Bug fixes

- Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) (#27148, e77a5be245)
- Bump Go version from 1.26.4 to 1.26.5 (backport 2.34) (#27158, e885cf3534)
- fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27261, 744439f729)
- Resolve client IP from the rightmost untrusted X-Forwarded-For entry (backport 2.34) (#27236, eda3747cef)
- Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, ee17a3bdd3)
- Dashboard: Replace ansi-to-html in the log viewer (#27206, ffa50fb18d) (@aslilac)
- Server: Harden oauth2 redirect validation (#27274, 58e20abbd5) (@aslilac)
- Remove 403 from key failover and cooldown on 401 (#27419, b7d2742adc) (@ssncferreira)

### Documentation

- Documentation: Fix bmcp_ described as suffix instead of prefix (#27392, 2b9e328f9d) (@nickvigilante)

Compare: [`v2.34.6...v2.34.7`](https://github.com/coder/coder/compare/v2.34.6...v2.34.7)

## Container image

- `docker pull ghcr.io/coder/coder:2.34.7`

## Install/upgrade

Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below.