v2.35.3

triggerdotdev/trigger.devv2.35.3Jul 27, 2026by github-actions[bot]

AI Summary

This release focuses on bug fixes and security improvements, including dependency updates and enhanced OAuth2 validation.

Key Highlights

Hardened OAuth2 redirect validation on the server side
Updated Go version to 1.26.5 and chi/v5 to 5.3.1
Replaced ansi-to-html library in the dashboard log viewer
Fixed a double 'v' issue in the release calendar link

Full Release Notes

## Changelog

> [!NOTE]
> This is a mainline Coder release. We advise enterprise customers without a staging environment to install our [latest stable release](https://github.com/coder/coder/releases/latest) while we refine this version. Learn more about our [Release Schedule](https://coder.com/docs/install/releases).

### Bug fixes

- Bump github.com/go-chi/chi/v5 v5.2.4 to v5.3.1 (#27147, abe4d01bbd)
- Bump Go version from 1.26.4 to 1.26.5 (backport 2.35) (#27159, ae1d4ef8bc)
- fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27259, f2653d491b)
- Dashboard: Replace ansi-to-html in the log viewer (#27206, 17cbc269d2) (@aslilac)
- Server: Harden oauth2 redirect validation (#27274, 65e2bfbb46) (@aslilac)

Compare: [`v2.35.2...v2.35.3`](https://github.com/coder/coder/compare/v2.35.2...v2.35.3)

## Container image

- `docker pull ghcr.io/coder/coder:2.35.3`

## Install/upgrade

Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below.