v2.34.7

zaidmukaddam/scirav2.34.7Jul 28, 2026by github-actions[bot]

AI Summary

This is a backport release for version 2.34 that includes dependency updates, dashboard improvements, and security hardening measures like OAuth2 validation.

Key Highlights

Dependency updates (Chi and Go versions)
Server hardening for OAuth2 redirect validation
Dashboard log viewer improvement (ansi-to-html replacement)
Fix for client IP resolution from X-Forwarded-For headers

Full Release Notes

## Changelog

### Bug fixes

- Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) (#27148, e77a5be245)
- Bump Go version from 1.26.4 to 1.26.5 (backport 2.34) (#27158, e885cf3534)
- fix(scripts/releaser): remove doubled "v" in release calendar latest release link (#27261, 744439f729)
- Resolve client IP from the rightmost untrusted X-Forwarded-For entry (backport 2.34) (#27236, eda3747cef)
- Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, ee17a3bdd3)
- Dashboard: Replace ansi-to-html in the log viewer (#27206, ffa50fb18d) (@aslilac)
- Server: Harden oauth2 redirect validation (#27274, 58e20abbd5) (@aslilac)
- Remove 403 from key failover and cooldown on 401 (#27419, b7d2742adc) (@ssncferreira)

### Documentation

- Documentation: Fix bmcp_ described as suffix instead of prefix (#27392, 2b9e328f9d) (@nickvigilante)

Compare: [`v2.34.6...v2.34.7`](https://github.com/coder/coder/compare/v2.34.6...v2.34.7)

## Container image

- `docker pull ghcr.io/coder/coder:2.34.7`

## Install/upgrade

Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below.