#27148)

## Summary

Backport [go-chi/chi](https://github.com/go-chi/chi) v5.2.4 to v5.3.1 on
`release/2.34`, aligning with the upgrade already merged on `main` via
#27051.

## Security Advisories Addressed

chi v5.3.0 and v5.3.1 resolve the following advisories:

| Advisory | Description | Severity |
|----------|-------------|----------|
|
[GHSA-9g5q-2w5x-hmxf](GHSA-9g5q-2w5x-hmxf)
| IP spoofing via XFF in RemoteAddr resolution | — |
|
[GHSA-rjr7-jggh-pgcp](GHSA-rjr7-jggh-pgcp)
| RealIP allows IP spoofing via unvalidated XFF | — |
|
[GHSA-3fxj-6jh8-hvhx](GHSA-3fxj-6jh8-hvhx)
| IP spoofing in middleware.RealIP | Critical (9.3) |
|
[GHSA-mqqf-5wvp-8fh8](GHSA-mqqf-5wvp-8fh8)
| Open redirect in RedirectSlashes (CVE-2025-69725) | — |
|
[GHSA-vrw8-fxc6-2r93](GHSA-vrw8-fxc6-2r93)
| Host Header Injection in RedirectSlashes | — |

## Impact Assessment

Coder does **not** use the directly affected middleware:
- `middleware.RealIP` — Coder uses its own `httpmw.ExtractRealIP`
- `StripSlashes` / `RedirectSlashes` / `CleanPath` — Coder uses its own
`singleSlashMW`

The primary motivation for this backport is keeping `release/2.34`
aligned with `main` to prevent dependency drift and to satisfy IronBank
scanning requirements.

## Changes

- `go.mod` / `go.sum`: bump `github.com/go-chi/chi/v5` v5.2.4 to v5.3.1

## Related

- #27051 — original Dependabot upgrade on `main`
- #27147 — same backport on `release/2.35`

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Marcin Tojek <mtojek@users.noreply.github.com>

## Summary

Backport Go toolchain bump from 1.26.4 to 1.26.5 to `release/2.34`.

Go 1.26.5 ([released
2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes
security fixes to the `crypto/tls` and `os` packages, addressing:

- [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) —
`os` package
- [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) —
`crypto/tls` package

These were flagged by the IronBank scan of
`coder/coder-enterprise/coder-service-2:2.34.5`.

Main PR: #27157

## Changes

- `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor)
- `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is
what actually compiles the scanned artifact)
- `.github/actions/setup-go/action.yaml`: default Go version 1.26.4 to
1.26.5
- `scripts/should_deploy.sh`: remove ~62 lines of unreachable dead code
below an unconditional `if/else` that exits in both branches;
cherry-picked from `main` to clear a shellcheck SC2317 warning on the
Ubuntu 26.04 CI runner

## Nix flake fix cherry-picks

Two commits were cherry-picked from `main` to fix the `build_image
(nix)` CI job on `release/2.34`:

- `fccb238ec` (#26584): Upgrade nixpkgs from 24.11 to 25.05, pin
`protobuf_23_4`. Fixes a build failure caused by Google removing
`google-chrome-stable_138.0.7204.49-1_amd64.deb` from its CDN (Chrome
138 was end-of-lifed), which broke the nixpkgs 24.11 `google-chrome`
derivation.
- `ff71c1e82` (#26643): Build `go-migrate` with only the postgres
driver. Fixes a Snowflake driver compilation failure under the updated
nixpkgs.

These are already on `main` and have been cherry-picked to
`release/2.34` (via the base branch merge). Local validation confirmed
the nix build succeeds with these patches applied.

## Note on `should_deploy.sh`

The `should_deploy.sh` cleanup is behavior-preserving. The existing
`if/else` already exits with `DEPLOY` (main) or `NOOP` (any other
branch) in both branches, making all code below it unreachable. The old
release-branch deploy logic was already disabled by the short-circuit
added earlier. This commit removes the dead code and was cherry-picked
from `main` to fix a shellcheck SC2317 (unreachable code) warning that
started failing on the Ubuntu 26.04 runner.

Linear: ENT-130

---------

Co-authored-by: Marcin Tojek <mtojek@users.noreply.github.com>
Co-authored-by: George K <george@coder.com>

…release link (#27261)

## Problem

The interactive releaser (`scripts/releaser`) renders the "Latest
Release"
cell of the release calendar with a doubled version prefix, e.g.
`[vv2.35.0](.../tag/v2.35.0)`.

`version.String()` already returns a `v`-prefixed string (e.g.
`v2.35.0`),
but `updateCalendar` wrapped it in a `"[v%s]"` template, so the link
label
gained a second `v`. The tag URL was already correct because release
tags
carry the `v` prefix.

## Fix

Drop the extra `v` from the label template (`"[v%s]"` → `"[%s]"`). The
URL is
unchanged.

- Label before: `[vv2.35.0]`
- Label after: `[v2.35.0]`

## Test

Added `scripts/releaser/docs_test.go`:

- `TestUpdateCalendarLatestReleaseVersionPrefix` asserts the
`LatestRelease`
cell for a matching row on both a patch and a minor release. It fails on
the
  old code (`[vv2.35.x]`) and passes with the fix.
- `TestUpdateCalendarNotReleasedRowName` covers the `Not Released` →
`Mainline`
  promotion and the major.minor "Release name" link (patch omitted).

<details>
<summary>Investigation notes</summary>

- Entry path: `scripts/release.sh` → `go run ./scripts/releaser` →
  `runRelease` → `promptAndUpdateDocs` → `updateReleaseDocs` →
  `updateCalendarFile` → `updateCalendar` (`scripts/releaser/docs.go`).
- Root cause in `updateCalendar`: `fmt.Sprintf("[v%s](%s)",
newVer.String(), ...)`
  combined with `version.String()` returning `v%d.%d.%d`.
- Only the link label was affected; the `releaseTagURLFmt` URL was
correct
  because tags are `v`-prefixed.
- The standalone `scripts/update-release-calendar.sh` is a separate
implementation and is not affected (it strips the `v` before re-adding
one).
- Companion PRs: #27260 (`main`, file `scripts/releaser/v1/docs.go`),
  #27259 (`release/2.35`).

</details>

---
This PR was generated by Coder Agents.

…ntry (backport 2.34) (#27236)

Backports #26646 to release/2.34 (Stable/ESR).

A client could spoof its X-Forwarded-For value by prepending a fake IP;
`getRemoteAddress` took the leftmost comma-delimited token, so appending
proxies (nginx, ALB, Cloudflare) never overrode the spoofed value. This
fed `httpmw.RateLimit` (per-IP login throttling) and audit log
`IPAddress` fields, enabling rate-limit bypass and audit falsification.

This is the security fix tracked in PLAT-258 /
coder/security-disclosures#9 (SEC-FC61DF2BF7). It already shipped in
mainline (v2.35.0); this PR brings it to the Stable/ESR line.

Clean cherry-pick, no conflicts. `coderd/httpmw/realip_test.go` covers
the spoofing scenario.

Co-authored-by: Jon Ayers <jon@coder.com>

…#27083) (#27144)

> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Backport of #27083

Original PR: #27083 — fix(site): keep activity bump editable when
allow_user_autostop is on
Merge commit: 1eea4a7
Requested by: @rowansmithau

<details>
<summary>Cherry-pick conflict resolution</summary>

The automatic cherry-pick of the merge commit (`-m1`) conflicted because
its diff pulled in the **autostop reminder** feature
(`AutostopReminderHelperText`, the "Autostop reminder (hours)" field,
and `time_til_autostop_notify_ms`), which does not exist on
`release/2.34`.

Resolution: apply only PR #27083's actual change (the
`allow_user_autostop` / activity-bump fix) and drop the unrelated
autostop-reminder additions that the merge-commit diff dragged in.

- `TTLHelperText.tsx`: applied the `ActivityBumpHelperText`
`allowUserAutostop` change; did not add `AutostopReminderHelperText`.
- `TemplateScheduleForm.tsx`: applied the activity-bump `disabled` and
submit changes; did not add the autostop-reminder field.
- `TemplateSchedulePage.test.tsx`: removed the three superseded
activity-bump tests (auto-merged cleanly).
- `TemplateSchedulePageView.stories.tsx`: added the three activity-bump
stories; dropped the autostop-reminder stories.

Verified on 2.34: `TemplateSchedulePage.test.tsx` (20 tests) and the
`TemplateSchedulePageView` storybook interaction tests (6) pass; the
changed files type-check and lint cleanly.
</details>

---------

Co-authored-by: Jake Howell <jacob@coder.com>
Co-authored-by: Jake Howell <jake@hwll.me>

… of prefix (#27392) (#27393)

Backport of #27392

Original PR: #27392 — docs(docs/ai-coder/ai-gateway): fix bmcp_
described as suffix instead of prefix
Merge commit: f55be09
Requested by: @nickvigilante

Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>

Backport of #27206

Original PR: #27206 — fix(site): replace ansi-to-html in the log viewer
Merge commit: b377bec
Requested by: @aslilac

Co-authored-by: McKayla はな <mckayla@hey.com>

Backport of #27274

Original PR: #27274 — fix(coderd): harden oauth2 redirect validation
Merge commit: 2f87991
Requested by: @aslilac

Backport of #27419

Original PR: #27419 — fix: remove 403 from key failover and cooldown on
401
Merge commit: dba45ce
Requested by: @ssncferreira

Co-authored-by: Susana Ferreira <susana@coder.com>