Skip to content

chore(deps): bump the coder-image group across 2 directories with 1 update#266

Merged
matifali merged 1 commit into
mainfrom
dependabot/docker/heroku/coder-image-3af91a54b3
Jul 17, 2026
Merged

chore(deps): bump the coder-image group across 2 directories with 1 update#266
matifali merged 1 commit into
mainfrom
dependabot/docker/heroku/coder-image-3af91a54b3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the coder-image group with 1 update in the /heroku directory: coder/coder.
Bumps the coder-image group with 1 update in the /render directory: coder/coder.

Updates coder/coder from v2.34.4 to v2.35.1

Release notes

Sourced from coder/coder's releases.

v2.35.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Chat stream silence timeout error renamed (#25973)

    The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup. Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

  • OIDC login rejects non-boolean or absent email_verified (#25713)

    The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants. Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

  • OIDC/GitHub email fallback restricted to first-time linking (#25712)

    findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login. Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

  • HostnameSuffix and SSHConfigOptions validated at startup (#26154)

    Server-side validation has been added for CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS. Invalid values will now cause coderd to exit with an error on startup. Client-side, coder config-ssh will also exit with an error if it detects invalid config. Relevant CLI reference: https://github.com/coder/coder/blob/2778abec4be28ff2f582e1d4b8c1d5adbb6ea1d5/docs/reference/cli/server.md#--ssh-config-options Migration: Review your CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS values before upgrading. If they contain invalid characters or formatting, coderd will fail to start. Fix the values before or during the upgrade.

  • X-Forwarded-Host only trusted from configured proxies (#26204)

    X-Forwarded-Host was previously honored unconditionally for subdomain app routing. This allowed a share=authenticated app to forge the header and route requests to a victim's owner-only app. The header is now only trusted when the socket peer is in CODER_PROXY_TRUSTED_ORIGINS, matching the existing trust model for X-Forwarded-For and X-Forwarded-Proto. Migration: Deployments that rely on reverse proxies rewriting Host and forwarding the original in X-Forwarded-Host must configure CODER_PROXY_TRUSTED_ORIGINS with the proxy addresses. Without this, subdomain app routing will ignore X-Forwarded-Host and fall back to the received Host header.

  • AI provider name collision with settings routes prevented (#26688)

    The AI providers page has moved from /ai/settings/:providerId to /ai/settings/providers/:providerId (and /ai/settings/add to /ai/settings/providers/add). The old routes allowed a provider named models to collide with the static Models page. No backward-compatibility redirects were added because a catch-all redirect would reintroduce the collision. Migration: Update any bookmarked or automated links from /ai/settings/ to /ai/settings/providers/ and from /ai/settings/add to /ai/settings/providers/add.

  • Org membership required for user ACLs (#26852)

    Per-user ACL grants on org-scoped resources (templates, workspaces, chats) previously did not check organization membership. A user explicitly granted access retained it after being removed from the organization. The user-ACL rule now requires is_org_member, matching the existing group-ACL behavior. Migration: Users who have been removed from an organization but still have per-user ACL grants will lose access. Re-add them to the organization if access should be preserved.

  • Interceptions API and request logs view removed (#26213)

    The GET /api/v2/aibridge/interceptions endpoint, the coder aibridge interceptions list CLI command, and the Request Logs frontend page have been removed. These have been replaced by the session-based view. The /models, /clients, and /sessions endpoints remain. Migration: Switch any integrations using the interceptions API to the sessions API (/api/v2/aibridge/sessions). The sessions list page in the dashboard provides equivalent functionality.

  • Agents insights page removed (#26457)

... (truncated)

Commits
  • 8b44bd6 feat: add dry-run flag via CommandExecutor interface (#26422) (#27069)
  • a82f235 feat(site/src/pages/TemplateBuilder): add provisioner warning to Template Bui...
  • 3c0abf1 docs: update template creation docs for template builder (#26993) (#27062)
  • 58552cf fix(site/src/pages/TemplateBuilder): use variable defaults as field values, n...
  • 3a09323 fix: create agent firewall sessions without requiring agent read access (#27047)
  • da0515d fix(coderd): require deployment-wide workspace read permissions for WatchAllW...
  • 0402337 fix(coderd): declare project_id variable in GCP template builder bases (#2701...
  • a886024 fix(site): enable sticky positioning inside #main-content (#26907) (#27000)
  • 5f2b445 feat(site): clarify module listing's empty state copy if selected base templa...
  • e8c45da fix(site): set minimum width for TemplateCustomizationsStep (#26939) (#27001)
  • Additional commits viewable in compare view

Updates coder/coder from v2.34.4 to v2.35.1

Release notes

Sourced from coder/coder's releases.

v2.35.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Chat stream silence timeout error renamed (#25973)

    The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup. Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

  • OIDC login rejects non-boolean or absent email_verified (#25713)

    The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants. Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

  • OIDC/GitHub email fallback restricted to first-time linking (#25712)

    findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login. Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

  • HostnameSuffix and SSHConfigOptions validated at startup (#26154)

    Server-side validation has been added for CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS. Invalid values will now cause coderd to exit with an error on startup. Client-side, coder config-ssh will also exit with an error if it detects invalid config. Relevant CLI reference: https://github.com/coder/coder/blob/2778abec4be28ff2f582e1d4b8c1d5adbb6ea1d5/docs/reference/cli/server.md#--ssh-config-options Migration: Review your CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS values before upgrading. If they contain invalid characters or formatting, coderd will fail to start. Fix the values before or during the upgrade.

  • X-Forwarded-Host only trusted from configured proxies (#26204)

    X-Forwarded-Host was previously honored unconditionally for subdomain app routing. This allowed a share=authenticated app to forge the header and route requests to a victim's owner-only app. The header is now only trusted when the socket peer is in CODER_PROXY_TRUSTED_ORIGINS, matching the existing trust model for X-Forwarded-For and X-Forwarded-Proto. Migration: Deployments that rely on reverse proxies rewriting Host and forwarding the original in X-Forwarded-Host must configure CODER_PROXY_TRUSTED_ORIGINS with the proxy addresses. Without this, subdomain app routing will ignore X-Forwarded-Host and fall back to the received Host header.

  • AI provider name collision with settings routes prevented (#26688)

    The AI providers page has moved from /ai/settings/:providerId to /ai/settings/providers/:providerId (and /ai/settings/add to /ai/settings/providers/add). The old routes allowed a provider named models to collide with the static Models page. No backward-compatibility redirects were added because a catch-all redirect would reintroduce the collision. Migration: Update any bookmarked or automated links from /ai/settings/ to /ai/settings/providers/ and from /ai/settings/add to /ai/settings/providers/add.

  • Org membership required for user ACLs (#26852)

    Per-user ACL grants on org-scoped resources (templates, workspaces, chats) previously did not check organization membership. A user explicitly granted access retained it after being removed from the organization. The user-ACL rule now requires is_org_member, matching the existing group-ACL behavior. Migration: Users who have been removed from an organization but still have per-user ACL grants will lose access. Re-add them to the organization if access should be preserved.

  • Interceptions API and request logs view removed (#26213)

    The GET /api/v2/aibridge/interceptions endpoint, the coder aibridge interceptions list CLI command, and the Request Logs frontend page have been removed. These have been replaced by the session-based view. The /models, /clients, and /sessions endpoints remain. Migration: Switch any integrations using the interceptions API to the sessions API (/api/v2/aibridge/sessions). The sessions list page in the dashboard provides equivalent functionality.

  • Agents insights page removed (#26457)

... (truncated)

Commits
  • 8b44bd6 feat: add dry-run flag via CommandExecutor interface (#26422) (#27069)
  • a82f235 feat(site/src/pages/TemplateBuilder): add provisioner warning to Template Bui...
  • 3c0abf1 docs: update template creation docs for template builder (#26993) (#27062)
  • 58552cf fix(site/src/pages/TemplateBuilder): use variable defaults as field values, n...
  • 3a09323 fix: create agent firewall sessions without requiring agent read access (#27047)
  • da0515d fix(coderd): require deployment-wide workspace read permissions for WatchAllW...
  • 0402337 fix(coderd): declare project_id variable in GCP template builder bases (#2701...
  • a886024 fix(site): enable sticky positioning inside #main-content (#26907) (#27000)
  • 5f2b445 feat(site): clarify module listing's empty state copy if selected base templa...
  • e8c45da fix(site): set minimum width for TemplateCustomizationsStep (#26939) (#27001)
  • Additional commits viewable in compare view

Updates coder/coder from v2.34.4 to v2.35.1

Release notes

Sourced from coder/coder's releases.

v2.35.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Chat stream silence timeout error renamed (#25973)

    The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup. Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

  • OIDC login rejects non-boolean or absent email_verified (#25713)

    The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants. Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

  • OIDC/GitHub email fallback restricted to first-time linking (#25712)

    findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login. Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

  • HostnameSuffix and SSHConfigOptions validated at startup (#26154)

    Server-side validation has been added for CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS. Invalid values will now cause coderd to exit with an error on startup. Client-side, coder config-ssh will also exit with an error if it detects invalid config. Relevant CLI reference: https://github.com/coder/coder/blob/2778abec4be28ff2f582e1d4b8c1d5adbb6ea1d5/docs/reference/cli/server.md#--ssh-config-options Migration: Review your CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS values before upgrading. If they contain invalid characters or formatting, coderd will fail to start. Fix the values before or during the upgrade.

  • X-Forwarded-Host only trusted from configured proxies (#26204)

    X-Forwarded-Host was previously honored unconditionally for subdomain app routing. This allowed a share=authenticated app to forge the header and route requests to a victim's owner-only app. The header is now only trusted when the socket peer is in CODER_PROXY_TRUSTED_ORIGINS, matching the existing trust model for X-Forwarded-For and X-Forwarded-Proto. Migration: Deployments that rely on reverse proxies rewriting Host and forwarding the original in X-Forwarded-Host must configure CODER_PROXY_TRUSTED_ORIGINS with the proxy addresses. Without this, subdomain app routing will ignore X-Forwarded-Host and fall back to the received Host header.

  • AI provider name collision with settings routes prevented (#26688)

    The AI providers page has moved from /ai/settings/:providerId to /ai/settings/providers/:providerId (and /ai/settings/add to /ai/settings/providers/add). The old routes allowed a provider named models to collide with the static Models page. No backward-compatibility redirects were added because a catch-all redirect would reintroduce the collision. Migration: Update any bookmarked or automated links from /ai/settings/ to /ai/settings/providers/ and from /ai/settings/add to /ai/settings/providers/add.

  • Org membership required for user ACLs (#26852)

    Per-user ACL grants on org-scoped resources (templates, workspaces, chats) previously did not check organization membership. A user explicitly granted access retained it after being removed from the organization. The user-ACL rule now requires is_org_member, matching the existing group-ACL behavior. Migration: Users who have been removed from an organization but still have per-user ACL grants will lose access. Re-add them to the organization if access should be preserved.

  • Interceptions API and request logs view removed (#26213)

    The GET /api/v2/aibridge/interceptions endpoint, the coder aibridge interceptions list CLI command, and the Request Logs frontend page have been removed. These have been replaced by the session-based view. The /models, /clients, and /sessions endpoints remain. Migration: Switch any integrations using the interceptions API to the sessions API (/api/v2/aibridge/sessions). The sessions list page in the dashboard provides equivalent functionality.

  • Agents insights page removed (#26457)

... (truncated)

Commits
  • 8b44bd6 feat: add dry-run flag via CommandExecutor interface (#26422) (#27069)
  • a82f235 feat(site/src/pages/TemplateBuilder): add provisioner warning to Template Bui...
  • 3c0abf1 docs: update template creation docs for template builder (#26993) (#27062)
  • 58552cf fix(site/src/pages/TemplateBuilder): use variable defaults as field values, n...
  • 3a09323 fix: create agent firewall sessions without requiring agent read access (#27047)
  • da0515d fix(coderd): require deployment-wide workspace read permissions for WatchAllW...
  • 0402337 fix(coderd): declare project_id variable in GCP template builder bases (#2701...
  • a886024 fix(site): enable sticky positioning inside #main-content (#26907) (#27000)
  • 5f2b445 feat(site): clarify module listing's empty state copy if selected base templa...
  • e8c45da fix(site): set minimum width for TemplateCustomizationsStep (#26939) (#27001)
  • Additional commits viewable in compare view

Updates coder/coder from v2.34.4 to v2.35.1

Release notes

Sourced from coder/coder's releases.

v2.35.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Chat stream silence timeout error renamed (#25973)

    The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup. Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

  • OIDC login rejects non-boolean or absent email_verified (#25713)

    The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants. Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

  • OIDC/GitHub email fallback restricted to first-time linking (#25712)

    findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login. Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

  • HostnameSuffix and SSHConfigOptions validated at startup (#26154)

    Server-side validation has been added for CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS. Invalid values will now cause coderd to exit with an error on startup. Client-side, coder config-ssh will also exit with an error if it detects invalid config. Relevant CLI reference: https://github.com/coder/coder/blob/2778abec4be28ff2f582e1d4b8c1d5adbb6ea1d5/docs/reference/cli/server.md#--ssh-config-options Migration: Review your CODER_CONFIGSSH_HOSTNAME_SUFFIX and CODER_SSH_CONFIG_OPTIONS values before upgrading. If they contain invalid characters or formatting, coderd will fail to start. Fix the values before or during the upgrade.

  • X-Forwarded-Host only trusted from configured proxies (#26204)

    X-Forwarded-Host was previously honored unconditionally for subdomain app routing. This allowed a share=authenticated app to forge the header and route requests to a victim's owner-only app. The header is now only trusted when the socket peer is in CODER_PROXY_TRUSTED_ORIGINS, matching the existing trust model for X-Forwarded-For and X-Forwarded-Proto. Migration: Deployments that rely on reverse proxies rewriting Host and forwarding the original in X-Forwarded-Host must configure CODER_PROXY_TRUSTED_ORIGINS with the proxy addresses. Without this, subdomain app routing will ignore X-Forwarded-Host and fall back to the received Host header.

  • AI provider name collision with settings routes prevented (#26688)

    The AI providers page has moved from /ai/settings/:providerId to /ai/settings/providers/:providerId (and /ai/settings/add to /ai/settings/providers/add). The old routes allowed a provider named models to collide with the static Models page. No backward-compatibility redirects were added because a catch-all redirect would reintroduce the collision. Migration: Update any bookmarked or automated links from /ai/settings/ to /ai/settings/providers/ and from /ai/settings/add to /ai/settings/providers/add.

  • Org membership required for user ACLs (#26852)

    Per-user ACL grants on org-scoped resources (templates, workspaces, chats) previously did not check organization membership. A user explicitly granted access retained it after being removed from the organization. The user-ACL rule now requires is_org_member, matching the existing group-ACL behavior. Migration: Users who have been removed from an organization but still have per-user ACL grants will lose access. Re-add them to the organization if access should be preserved.

  • Interceptions API and request logs view removed (#26213)

    The GET /api/v2/aibridge/interceptions endpoint, the coder aibridge interceptions list CLI command, and the Request Logs frontend page have been removed. These have been replaced by the session-based view. The /models, /clients, and /sessions endpoints remain. Migration: Switch any integrations using the interceptions API to the sessions API (/api/v2/aibridge/sessions). The sessions list page in the dashboard provides equivalent functionality.

  • Agents insights page removed (#26457)

... (truncated)

Commits
  • 8b44bd6 feat: add dry-run flag via CommandExecutor interface (#26422) (#27069)
  • a82f235 feat(site/src/pages/TemplateBuilder): add provisioner warning to Template Bui...
  • 3c0abf1 docs: update template creation docs for template builder (#26993) (#27062)
  • 58552cf fix(site/src/pages/TemplateBuilder): use variable defaults as field values, n...
  • 3a09323 fix: create agent firewall sessions without requiring agent read access (#27047)
  • da0515d fix(coderd): require deployment-wide workspace read permissions for WatchAllW...
  • 0402337 fix(coderd): declare project_id variable in GCP template builder bases (#2701...
  • a886024 fix(site): enable sticky positioning inside #main-content (#26907) (#27000)
  • 5f2b445 feat(site): clarify module listing's empty state copy if selected base templa...
  • e8c45da fix(site): set minimum width for TemplateCustomizationsStep (#26939) (#27001)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the coder-image group across 2 directories with 1 u…
e46cd6a 
…pdate

Bumps the coder-image group with 1 update in the /heroku directory: [coder/coder](https://github.com/coder/coder).
Bumps the coder-image group with 1 update in the /render directory: [coder/coder](https://github.com/coder/coder).


Updates `coder/coder` from v2.34.4 to v2.35.1
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.34.4...v2.35.1)

Updates `coder/coder` from v2.34.4 to v2.35.1
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.34.4...v2.35.1)

Updates `coder/coder` from v2.34.4 to v2.35.1
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.34.4...v2.35.1)

Updates `coder/coder` from v2.34.4 to v2.35.1
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@v2.34.4...v2.35.1)

---
updated-dependencies:
- dependency-name: coder/coder
  dependency-version: v2.35.1
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.35.1
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.35.1
  dependency-type: direct:production
  dependency-group: coder-image
- dependency-name: coder/coder
  dependency-version: v2.35.1
  dependency-type: direct:production
  dependency-group: coder-image
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Jul 13, 2026
@dependabot dependabot Bot mentioned this pull request Jul 13, 2026
Closed
@matifali
matifali merged commit 249861e into main Jul 17, 2026
1 check passed
@matifali
matifali deleted the dependabot/docker/heroku/coder-image-3af91a54b3 branch July 17, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update docker code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matifali