[EhabY]

Bumps the version to 1.18.0 and moves the Unreleased changelog entries under v1.18.0, rewritten to be shorter and clearer.

• New Security section that links the four draft advisories (GHSA-x24p-7cw4-4qm4, GHSA-47qp-vp45-fhjf, GHSA-g92h-wph3-v9pm, GHSA-frg9-9vj4-2v84). The links work once they are published after the release.
• Covers every user-visible change since v1.17.2: fix(auth): fall back to token authentication with mTLS #1170, fix(headers): require valid header names from coder.headerCommand #1171, fix(websocket): time out stalled handshakes #1172, fix!: treat the deployment origin as its identity #1173, fix(auth): isolate requests across deployment sessions #1174, fix: key every per-deployment store by origin #1176, fix(oauth): keep OAuth endpoints and requests on the deployment origin #1177, fix!: set the minimum supported Coder version to 2.29.0 #1186, fix: show deployment-provided text in notifications as plain text #1187, fix(websocket): attach stream listeners before the socket opens #1189.
• Fixes a stale comment in agentMetadataTracker.ts that still said agent metadata is watched over SSE (removed in fix(websocket): attach stream listeners before the socket opens #1189).

Decisions

• Left out: the experimental Workspaces panel (feat(workspaces): implement the workspace panel components #1154; still behind coder.workspacesPanelEnabled), OIDC Marketplace publishing (chore: use oidc to publish to vs code marketplace #1167), and the dependency bump (chore(deps): bump 28 dependencies across 1 directory #1181).
• Dropped internal detail: compatibility code removal, CLI capability resolution for unknown versions, and watcher reconnect backoff.
• Added: the coder.useKeyring Open Settings hint fix from fix!: set the minimum supported Coder version to 2.29.0 #1186, which the Unreleased section didn't list.
• Kept the existing style: a > **Note:** blockquote instead of a GitHub alert, because the VS Code changelog tab doesn't render alerts.

---

Generated by Coder Agents on behalf of @EhabY.

[matifali]

post merge ✅