Affected by GO-2026-5169 and 19 other vulnerabilities

GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

apiversion

package

v2.29.2 Latest Latest Go to latest Published: Jan 21, 2026 License: AGPL-3.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Overview ¶

Package apiversion provides an API version type that can be used to validate compatibility between two API versions.

NOTE: API VERSIONS ARE NOT SEMANTIC VERSIONS.

API versions are represented as major.minor where major and minor are both positive integers.

API versions are not directly tied to a specific release of the software. Instead, they are used to represent the capabilities of the server. For example, a server that supports API version 1.2 should be able to handle requests from clients that support API version 1.0, 1.1, or 1.2. However, a server that supports API version 2.0 is not required to handle requests from clients that support API version 1.x. Clients may need to negotiate with the server to determine the highest supported API version.

When making a change to the API, use the following rules to determine the next API version:

If the change is backward-compatible, increment the minor version. Examples of backward-compatible changes include adding new fields to a response or adding new endpoints.
If the change is not backward-compatible, increment the major version. Examples of non-backward-compatible changes include removing or renaming fields.

Index ¶

func Parse(version string) (major int, minor int, err error)
type APIVersion
- func New(maj, minor int) *APIVersion

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Parse ¶

func Parse(version string) (major int, minor int, err error)

Parse parses a valid major.minor version string into (major, minor). Both major and minor must be valid integers separated by a period '.'.

Types ¶

type APIVersion ¶

type APIVersion struct {
	// contains filtered or unexported fields
}

func New ¶

func New(maj, minor int) *APIVersion

New returns an *APIVersion with the given major.minor and additional supported major versions.

func (*APIVersion) String ¶

func (v *APIVersion) String() string

func (*APIVersion) Validate ¶

func (v *APIVersion) Validate(version string) error

Validate validates the given version against the given constraints: A given major.minor version is valid iff:

The requested major version is contained within v.supportedMajors
If the requested major version is the 'current major', then the requested minor version must be less than or equal to the supported minor version.

For example, given majors {1, 2} and minor 2, then: - 0.x is not supported, - 1.x is supported, - 2.0, 2.1, and 2.2 are supported, - 2.3+ is not supported.

func (*APIVersion) WithBackwardCompat ¶

func (v *APIVersion) WithBackwardCompat(majs ...int) *APIVersion

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL