Skip to content

Bump the vendored Coder SDK to v2.37.x #150

Closed

Description

@ThomasK33

Goal: move github.com/coder/coder/v2 from v2.35.8 to an exact v2.37.x release.

Why: the AI provider, chat model and MCP server APIs live in v2.37 (chats moved from /api/experimental to /api/v2). The E2E backend already runs Coder v2.37.2.

Acceptance:

  1. Exact pin, go mod tidy and go mod vendor, make verify-vendor clean.
  2. Test, lint, build, vulnerability scan and full Kind E2E pass.
  3. Note any SDK behavior changes that affect existing resources (workspaces, templates).
  4. Non-publishing GoReleaser check stays clean.

Owner: maintainer desk. Work starts now. Prerequisite for the AI resources.


Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium

Activity

  1. self-assigned this
    on Oct 2, 2026
  2. ThomasK33 commented on Oct 12, 2026

    @ThomasK33
    MemberAuthor

    Done by #163, merged as f20b552. github.com/coder/coder/v2 is pinned to exactly v2.37.3.

    Maintainer decision (2026-10-12): v2.37.3 ships as an exception to Coder's stable channel (v2.36.6). The AI resources (#154-#156) need the v2.37 APIs.

    Acceptance:

    1. Exact pin. go mod tidy and go mod vendor were run, and make verify-vendor is clean. CI's vendor check also passed.
    2. Test, lint, build, govulncheck (0 called vulnerabilities, after 🤖 fix: bump Go to 1.26.9 and golang.org/x/net to v0.60.0 #222) and the full Kind E2E (7 min 37 s, every step ran) passed on the merged head.
    3. SDK behavior changes are listed in the 🤖 deps: bump Coder SDK to v2.37.3 #163 description. One change needed a fix: a 2xx answer with a body that is not JSON now arrives as *codersdk.Error. Workspace start and stop now treat it as an uncertain result instead of answering 500. CoderTemplateTest already sends it to its "confirming create" path, and tests cover both cases.
    4. A non-publishing GoReleaser v2.13.3 run on f20b552 (in a throwaway clone with pushes disabled, --skip=announce,publish,docker) exited 0 and left the tree clean.

    Small follow-ups, not blocking: use the MCP SDK's built-in CrossOriginProtection option instead of the outer wrapper. Give a clearer message than a plain 500 when an aggregated create ends in a 2xx error.


    Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

dependenciesPull requests that update a dependency file

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions