chore(deps): bump github.com/coder/coder/v2 from 2.28.4 to 2.29.1

[dependabot]

Bumps github.com/coder/coder/v2 from 2.28.4 to 2.29.1.

Release notes

Sourced from github.com/coder/coder/v2's releases.

v2.29.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Security Update

• Update react to apply patch for CVE-2025-55182 (#21084) (#21168, 59cdd7e21)

  Coder is not affected. This vulnerability specifically targets implementations using React Server Components. As Coder does not utilize Server Components, there is no exploitable attack surface. We are applying this patch proactively to limit security tooling noise and avoid unnecessary concerns.

Compare: v2.29.0...v2.29.1

Container image

• docker pull ghcr.io/coder/coder:v2.29.1

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.29.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

[!IMPORTANT] This release is also the next Extended Support Release for Coder. For guidance on upgrading from the first ESR, Coder 2.24, see the detailed upgrade notes here.

BREAKING CHANGES

• chore!: allow coder MCP tools to not be injected (#20713, 04f809f2d) (@​dannykopping)

  Coder MCP tools were previously automatically injected; this will now need to be explicitly enabled with CODER_AIBRIDGE_INJECT_CODER_MCP_TOOLS=true

• feat(cli)!: enable keyring usage by default (#20851, 6238a9927) (@​zedkipp)

  In order to move away from storing the CLI session token in plain text file, this change begins using the operating system keyring for CLI session token storage by default on Windows and macOS. This will be a breaking change for any users depending on the session token being stored to or read from disk. Users can opt-out and restore file usage via the --use-keyring=false flag.

• refactor!: remove TaskAppID from codersdk.WorkspaceBuild (#20583, d80b5fc8e) (@​DanielleMaywood)

  The task_app_id field has been removed from the codersdk.WorkspaceBuild struct and API responses. If your code or integrations rely on WorkspaceBuild.task_app_id to identify the task's associated app, you should migrate to using Task.WorkspaceAppID instead (available on the Task object directly). The deprecated ai_task_sidebar_app_id field remains temporarily but also points to the new location.

Features

Bridge

• Add page for ai-bridge interception logs (#20331, 3bb7975a1) (@​jakehwll)
• Add duration to the Request Logs details (#20756, f559e51d7) (@​jakehwll)

... (truncated)

Commits

• 59cdd7e chore: update react to apply patch for CVE-2025-55182 (#21084) (#21168)
• ba71b32 fix: remove a sensitive field from an agent log line (#20968) (#21063)
• c94c470 fix: pass context with authorization to agentapi (#21045)
• 8430dd6 fix(cli): remove defaulting to keyring when --global-config set (cherry-pick)...
• 0bd0990 feat: add notification warning alert to Tasks page (#20900) (#20981)
• 10e70f8 fix: show task display name in task topbar (#20957) (#20980)
• abe66a3 feat: implement agent socket api, client and cli (#20758) (#20976)
• cd9d3ef fix: ensure we check if the user can actually see ai bridge (#20964)
• c0a2522 fix(site): only show active tasks in waiting for input tab (#20933) (#20955)
• dfa25d5 chore: document bedrock setup process for aibridge (#20956) (#20966)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/coder/coder/v2	[>= 2.15.0.a, < 2.15.1]
github.com/coder/coder/v2	[>= 2.18.0.a, < 2.18.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)