v2.29.17

Changelog

BREAKING CHANGES

• Only trust x-forwarded-host from configured trusted proxies (#26204, 77896dd) (@geokat)
• fix(coderd)!: restrict OIDC email fallback to first-time account linking (#25712, ed7e924)
• fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713, 3db810c)
• fix!: validate HostnameSuffix and SSHConfigOptions' (#26154, 320e549)

Bug fixes

• Server: Verify workspace owner matches app username (#26085, e01d3f4)
• Reject oversized and invalid zip uploads (#25877, 069f6cf)
• Escape agent log HTML (#25808, a51dbcf)
• Agent: Prevent command injection in shell execer (#26235, 4aa84f2) (@zedkipp)
• Server: Prevent user-admin from resetting owner password (#25709, 833eaf8)
• Validate FileSize in NewDataBuilder to prevent OOM DoS (#25710, 6f5ff1b)
• Validate agent-supplied AllowedIPs in coordinator (backport #26144) (#26295, 9181b84)
• Server: Prevent cross-tenant workspace app rebinding (#26103, c05b4d9) (@dylanhuff-at-coder)
• CLI: Prevent session token exfiltration via external app URLs (#26146, 2044599) (@zedkipp)
• Clamp template port sharing level in SubAgentAPI (#26061, c1889d0)
• Server: Use a random value for a simulated hash for built-in users (#26205, 0951f90)
• Server: Require update permission to recreate devcontainers (#25812, 18ded82)
• Dashboard: Escape appearance values in HTML output (#25804, 77253bf)

Compare: v2.29.16...v2.29.17

Container image

• docker pull ghcr.io/coder/coder:2.29.17

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.