chore(deps): bump github.com/coder/coder/v2 from 2.34.0-rc.0.0.20260929082031-faa9815cd6a5 to 2.38.0

[dependabot]

Bumps github.com/coder/coder/v2 from 2.34.0-rc.0.0.20260929082031-faa9815cd6a5 to 2.38.0.

Release notes

Sourced from github.com/coder/coder/v2's releases.

v2.38.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Tasks fully deprecated and removed

  Tasks are fully deprecated and removed in Coder v2.38.

  Migration: Users who rely on Tasks can stay on the v2.34 Extended Support Release during the support period.

• Experimental chat API mounts removed (#29548)

  The experimental chat API mounts have been removed. The new /api/v2 routes are now the only supported path.

  Migration: Update any clients or automation that call the experimental chat API mounts to use the /api/v2 routes.

• MCP servers on internal networks must be allowlisted (#28242)

  Connections to MCP servers on internal networks now require their address ranges to be allowlisted with --mcp-allowed-private-cidrs.

  Migration: After upgrading, add the CIDRs of any internal MCP servers to --mcp-allowed-private-cidrs, or those connections will fail.

• Embedded NATS is now the default pubsub between coderd replicas (#29283)

  Coder now carries real-time events between coderd replicas over embedded NATS by default, instead of Postgres LISTEN/NOTIFY. Each replica runs an embedded NATS server and meshes with the others, with automatic mutual TLS for Enterprise. The API, CLI, and dashboard are unchanged. The nats_pubsub experiment has been removed.

  Migration: Before upgrading HA deployments, allow TCP port 6222 in both directions between every pair of replicas. With custom relays, set CODER_CLUSTER_HOST, or Coder falls back to Postgres pubsub. To stay on Postgres pubsub, enable the no_nats_pubsub experiment and restart coderd. No data migration is needed. See the high availability docs.

Features

Coder Agents

New models and org-wide defaults

• Support for GPT-6 Sol, GPT-6 Luna, GPT-6.1 Sol, Claude Opus 5.5, and Claude Sonnet 5.5 (docs)
• Non-Anthropic models via AWS Bedrock Mantle
• Admins can set an org-wide default model under AI > Coder Agents settings; new chats use the org default instead of each user's last pick (docs)

Large file uploads

• Files outside the inline attachment allowlist (zips, datasets, tarballs, etc.) stream directly to the workspace filesystem with no size cap; the model only sees a path reference, not the file bytes
• Works from both existing chats and the new chat page; the UI routes attachment-compatible types inline and everything else to the workspace

Chat management

• Filter chats by status and PR status, including "no PR" (docs)

... (truncated)

Commits

• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/coder/coder/v2	[>= 2.15.0.a, < 2.15.1]
github.com/coder/coder/v2	[>= 2.18.0.a, < 2.18.1]
github.com/coder/coder/v2	[>= 2.35.a, < 2.36]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)