chore(deps): bump the coder-image group across 2 directories with 1 update

[dependabot]

Bumps the coder-image group with 1 update in the /heroku directory: coder/coder.
Bumps the coder-image group with 1 update in the /render directory: coder/coder.

Updates coder/coder from v2.35.3 to v2.36.0

Release notes

Sourced from coder/coder's releases.

v2.36.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Dynamic client registration disabled by default (#27316)

  POST /oauth2/register (RFC 7591 Dynamic Client Registration) is now controlled by a persistent admin setting, oauth2_dcr_enabled, independent of the experiment system. The setting defaults to disabled. A new audited GET/PUT /api/v2/oauth2-provider/settings endpoint lets an owner toggle it live without a restart. When disabled, new registrations are rejected with an RFC 7591-shaped 403, and registration_endpoint is omitted from discovery metadata.

  Migration: Deployments that rely on dynamic client registration must explicitly enable the new setting via the API or UI after upgrading. Existing registered clients are unaffected; only new registrations are gated.

• login_type=none deprecated; existing accounts converted to password login (#26851)

  login_type=none (legacy passwordless machine users) is deprecated in favor of premium service accounts. A database migration (000554) automatically converts existing non-system login_type=none accounts to login_type=password. Creation of new login_type=none accounts via POST /users and coder users create (including the deprecated --disable-login flag) is now rejected unless a service account is explicitly requested.

  Migration: Automatic for existing users. Legacy login_type=none accounts will be migrated to password login on first startup after upgrading. Review any automation that creates users with login_type=none and update it to use service accounts instead.

• chat_model_configs.provider column removed (#26877)

  The provider column has been dropped from the chat_model_configs table. Provider type is now derived exclusively from the linked ai_providers row via ai_provider_id. The experimental HTTP/SDK response for model configs drops the provider field and makes ai_provider_id required; consumers should resolve provider type by joining against the AI providers listing. Telemetry continues to emit provider via a JOIN, so BigQuery columns and Nexus dashboards are unaffected.

  Migration: Update any custom queries or SDK consumers that read chat_model_configs.provider directly. Resolve provider type via ai_provider_id and the AI providers listing instead.

Features

AI Governance

Budget tracking and enforcement

User and group AI spend is now tracked, enforced, and exposed across the platform.

• Record user daily AI spend on token usage and enforce budgets on the pre-request path (#26741, #26562, #26915)
• User AI spend endpoint and group/member spend endpoints (#26978, #27123, #27130, #27568)
• Prometheus metrics for AI Governance cost control (#27490)
• CSV export for AI spend data (#27491)
• Budget threshold notifications for users and admins (#27346, #27415)
• Fall back to the Everyone group for AI spend attribution (#27364)
• Dashboard: show spend for unlimited and zero AI budgets; announce cost controls in AI Governance (#27458, #27543)
• Dashboard: polished AI budget members table (#26805)
• Network calls column and badges added to AI sessions table (#27269, #27341)

Seat counting

• Count only workspace-capable users toward license seats (#27279)
• Exclude AI Bridge usage from AI Governance seat counting (#27280)

Standalone AI Gateway

... (truncated)

Commits

• a300a06 fix: correct native usage-limit docs and spend UI details for 2.36 (#27827)
• 17773d3 fix: remove native usage-limit controls from 2.36 (#27825)
• 46dd810 fix(helm/ai-gateway): render service nodePort with an explicit if guard (#27795)
• 503124b docs: add standalone AI Gateway docs (#27794)
• a33140d chore: backport AI session network calls to 2.36 (#27417, #27418, #27425, #27...
• 8f24c4a fix: support adding multiline secrets via the UI (#27253) (#27808)
• 79a22f6 docs: note user secret target uniqueness and delivery boundary (#27532) (#27809)
• 5cd6ebb docs: lead with env vars in admin docs and add configuration reference (#2682...
• 19be37f feat(site): label AI spend as estimated (#27584) (#27793)
• 49aeca7 fix(site): link spend page alert to cost control migration section (#27782) (...
• Additional commits viewable in compare view

Updates coder/coder from v2.35.3 to v2.36.0

Release notes

Sourced from coder/coder's releases.

v2.36.0

Changelog

[!NOTE] This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

BREAKING CHANGES

• Dynamic client registration disabled by default (#27316)

  POST /oauth2/register (RFC 7591 Dynamic Client Registration) is now controlled by a persistent admin setting, oauth2_dcr_enabled, independent of the experiment system. The setting defaults to disabled. A new audited GET/PUT /api/v2/oauth2-provider/settings endpoint lets an owner toggle it live without a restart. When disabled, new registrations are rejected with an RFC 7591-shaped 403, and registration_endpoint is omitted from discovery metadata.

  Migration: Deployments that rely on dynamic client registration must explicitly enable the new setting via the API or UI after upgrading. Existing registered clients are unaffected; only new registrations are gated.

• login_type=none deprecated; existing accounts converted to password login (#26851)

  login_type=none (legacy passwordless machine users) is deprecated in favor of premium service accounts. A database migration (000554) automatically converts existing non-system login_type=none accounts to login_type=password. Creation of new login_type=none accounts via POST /users and coder users create (including the deprecated --disable-login flag) is now rejected unless a service account is explicitly requested.

  Migration: Automatic for existing users. Legacy login_type=none accounts will be migrated to password login on first startup after upgrading. Review any automation that creates users with login_type=none and update it to use service accounts instead.

• chat_model_configs.provider column removed (#26877)

  The provider column has been dropped from the chat_model_configs table. Provider type is now derived exclusively from the linked ai_providers row via ai_provider_id. The experimental HTTP/SDK response for model configs drops the provider field and makes ai_provider_id required; consumers should resolve provider type by joining against the AI providers listing. Telemetry continues to emit provider via a JOIN, so BigQuery columns and Nexus dashboards are unaffected.

  Migration: Update any custom queries or SDK consumers that read chat_model_configs.provider directly. Resolve provider type via ai_provider_id and the AI providers listing instead.

Features

AI Governance

Budget tracking and enforcement

User and group AI spend is now tracked, enforced, and exposed across the platform.

• Record user daily AI spend on token usage and enforce budgets on the pre-request path (#26741, #26562, #26915)
• User AI spend endpoint and group/member spend endpoints (#26978, #27123, #27130, #27568)
• Prometheus metrics for AI Governance cost control (#27490)
• CSV export for AI spend data (#27491)
• Budget threshold notifications for users and admins (#27346, #27415)
• Fall back to the Everyone group for AI spend attribution (#27364)
• Dashboard: show spend for unlimited and zero AI budgets; announce cost controls in AI Governance (#27458, #27543)
• Dashboard: polished AI budget members table (#26805)
• Network calls column and badges added to AI sessions table (#27269, #27341)

Seat counting

• Count only workspace-capable users toward license seats (#27279)
• Exclude AI Bridge usage from AI Governance seat counting (#27280)

Standalone AI Gateway

... (truncated)

Commits

• a300a06 fix: correct native usage-limit docs and spend UI details for 2.36 (#27827)
• 17773d3 fix: remove native usage-limit controls from 2.36 (#27825)
• 46dd810 fix(helm/ai-gateway): render service nodePort with an explicit if guard (#27795)
• 503124b docs: add standalone AI Gateway docs (#27794)
• a33140d chore: backport AI session network calls to 2.36 (#27417, #27418, #27425, #27...
• 8f24c4a fix: support adding multiline secrets via the UI (#27253) (#27808)
• 79a22f6 docs: note user secret target uniqueness and delivery boundary (#27532) (#27809)
• 5cd6ebb docs: lead with env vars in admin docs and add configuration reference (#2682...
• 19be37f feat(site): label AI spend as estimated (#27584) (#27793)
• 49aeca7 fix(site): link spend page alert to cost control migration section (#27782) (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions