Skip to content

chore(deps): bump the github-actions group across 1 directory with 3 updates#1020

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-3e9c490aee
Open

chore(deps): bump the github-actions group across 1 directory with 3 updates#1020
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-3e9c490aee

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates in the / directory: coder/coder/.github/actions/setup-tf, actions/setup-go and zizmorcore/zizmor-action.

Updates coder/coder/.github/actions/setup-tf from 2.34.5 to 2.35.2

Release notes

Sourced from coder/coder/.github/actions/setup-tf's releases.

v2.35.2

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

  • Bump coder/fantasy for gpt-5.6 Responses routing (#27132, d331a101b8) (@​ibetitsmike)
  • Correct gvisor replace directive to match module path (#26822, a330effad8)
  • Dashboard: Keep activity bump editable when allow_user_autostop is on (#27083, 5c2838a7fb) (@​jakehwll)

Documentation

  • Documentation: Update release calendar for v2.35.1 (#27128, 404826afec) (@​denisra)

Compare: v2.35.1...v2.35.2

Container image

  • docker pull ghcr.io/coder/coder:2.35.2

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

v2.35.1

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

  • Chat stream silence timeout error renamed (#25973)

    The Agents chat error kind startup_timeout has been renamed to stream_silence_timeout to reflect that the timeout now applies to any gap between provider stream parts, not just first-token startup. Migration: Clients matching on the startup_timeout error kind should update to stream_silence_timeout. This is a minor API-only change; the dashboard handles it automatically.

  • OIDC login rejects non-boolean or absent email_verified (#25713)

    The OIDC callback previously used a Go type assertion for email_verified that silently treated missing or string-typed values (e.g. "false") as verified. The check is now fail-closed: absent claims, unrecognized types, or non-truthy values are treated as unverified and rejected. The fix adds coerceEmailVerified() which handles bool, string ("true"/"false"/"1"/"0" via strconv.ParseBool), float64, json.Number, and integer variants. Migration: The migration is automatic for most of the deployments. However, if the IdP has non-static user IDs, then the admins may need to use the CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS. Please note that it is advised to not use this flag and allow for the automated migration to take care of things.

  • OIDC/GitHub email fallback restricted to first-time linking (#25712)

    findLinkedUser previously fell back to email-based lookup for all logins, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) could bypass linked_id and match to the victim's account. The fallback now returns no user when an existing user_link has a populated linked_id that differs from the current login. Accounts with empty (legacy, pre-migration) linked_id are unaffected and are backfilled on their next successful login. Migration: The most likely trigger is changing CODER_OIDC_ISSUER_URL (because linked_id is issuer||subject), or two IdP identities sharing one email. Affected users will see a 403 on login. Admins can use the new OIDC link repair CLI (coder exp oidc-link-repair) to re-link accounts. See also CODER_OIDC_INSECURE_EMAIL_FALLBACK for IdP broker scenarios (#26751).

  • HostnameSuffix and SSHConfigOptions validated at startup (#26154)

... (truncated)

Commits
  • 5c2838a fix(site): keep activity bump editable when allow_user_autostop is on (#27083...
  • a330eff fix: correct gvisor replace directive to match module path (#26822) (#27137)
  • d331a10 fix: bump coder/fantasy for gpt-5.6 Responses routing (#27132) (#27134)
  • 404826a docs(docs/install/releases): update release calendar for v2.35.1 (#27128) (#2...
  • 8b44bd6 feat: add dry-run flag via CommandExecutor interface (#26422) (#27069)
  • a82f235 feat(site/src/pages/TemplateBuilder): add provisioner warning to Template Bui...
  • 3c0abf1 docs: update template creation docs for template builder (#26993) (#27062)
  • 58552cf fix(site/src/pages/TemplateBuilder): use variable defaults as field values, n...
  • 3a09323 fix: create agent firewall sessions without requiring agent read access (#27047)
  • da0515d fix(coderd): require deployment-wide workspace read permissions for WatchAllW...
  • Additional commits viewable in compare view

Updates actions/setup-go from 6.5.0 to 7.0.0

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

Commits

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group across 1 directory with 3 …
b25065a 
…updates

Bumps the github-actions group with 3 updates in the / directory: [coder/coder/.github/actions/setup-tf](https://github.com/coder/coder), [actions/setup-go](https://github.com/actions/setup-go) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `coder/coder/.github/actions/setup-tf` from 2.34.5 to 2.35.2
- [Release notes](https://github.com/coder/coder/releases)
- [Changelog](https://github.com/coder/coder/blob/main/release.key)
- [Commits](coder/coder@c3dd41e...5c2838a)

Updates `actions/setup-go` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@924ae3a...b7ad1da)

Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...6599ee8)

---
updated-dependencies:
- dependency-name: coder/coder/.github/actions/setup-tf
  dependency-version: 2.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 20, 2026
@dependabot
dependabot Bot requested a review from jdomeracki-coder as a code owner July 20, 2026 07:16
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matifali matifali matifali approved these changes
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder jdomeracki-coder is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matifali