Bump follow-redirects from 1.16.0 to 1.16.2

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.0 to 1.16.2. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.0...v1.16.2) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bump ip-address from 10.7.2 to 10.7.5 (#8080 )
2026-11-02 22:09:11 +01:00 · 2026-10-27 01:04:15 +00:00 · 2026-10-26 17:01:48 -08:00 · 2026-10-26 17:01:24 -08:00 · 2026-10-26 16:42:24 -08:00 · 2026-10-26 15:47:26 -08:00
23 changed files with 259 additions and 63 deletions
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.21.0
+24.22.1
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,36 @@ Code v99.99.999

 ## Unreleased

+## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
+
+Code v1.143.1
+
+### Changed
+
+- Update to Code 1.143.1
+
+## [4.141.1](https://github.com/coder/code-server/releases/tag/v4.141.1) - 2026-10-23
+
+### Security
+
+- Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the
+  Brotli decoder (CVE-2026-111497).
+- Reject compressed request bodies (`Content-Encoding: br`, `gzip`, or
+  `deflate`) instead of decompressing them.
+
+### Fixed
+
+- Boolean flags in the `--flag=false` form and in the config file now respect
+  being set to false.
+
+### Added
+
+- Turkish locale.
+
+### Changed
+
+- Expand values from path options in the config file that start with a tilde.
+
 ## [4.141.0](https://github.com/coder/code-server/releases/tag/v4.141.0) - 2026-10-08

 Code v1.141.0
--- a/ci/helm-chart/Chart.yaml
+++ b/ci/helm-chart/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.56.0
+version: 3.57.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.141.0
+appVersion: 4.143.1
--- a/ci/helm-chart/values.yaml
+++ b/ci/helm-chart/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: codercom/code-server
-  tag: '4.141.0'
+  tag: '4.143.1'
  pullPolicy: Always

 # Specifies one or more secrets to be used when pulling images from a
--- a/lib/vscode
+++ b/lib/vscode
--- a/package-lock.json
+++ b/package-lock.json
@@ -269,9 +269,9 @@
      }
    },
    "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
      "dev": true,
      "funding": [
        {
@@ -1735,18 +1735,18 @@
      }
    },
    "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
      "license": "MIT",
      "dependencies": {
        "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
        "debug": "^4.4.3",
        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
        "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
        "raw-body": "^3.0.2",
        "type-is": "^2.1.0"
      },
@@ -1759,9 +1759,9 @@
      }
    },
    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -3245,9 +3245,9 @@
      "license": "ISC"
    },
    "node_modules/follow-redirects": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
-      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz",
+      "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==",
      "funding": [
        {
          "type": "individual",
@@ -3703,9 +3703,9 @@
      }
    },
    "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
      "license": "MIT",
      "dependencies": {
        "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -3777,9 +3777,9 @@
      }
    },
    "node_modules/ip-address": {
-      "version": "10.7.2",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "version": "10.7.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
      "license": "MIT",
      "engines": {
        "node": ">= 12"
@@ -4270,9 +4270,9 @@
      "license": "ISC"
    },
    "node_modules/js-yaml": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
      "funding": [
        {
          "type": "github",
@@ -5366,9 +5366,9 @@
      }
    },
    "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "es-define-property": "^1.0.1",
--- a/patches/copilot.diff
+++ b/patches/copilot.diff
@@ -2,7 +2,7 @@ Index: code-server/lib/vscode/build/gulpfile.extensions.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
 +++ code-server/lib/vscode/build/gulpfile.extensions.ts
-@@ -291,6 +291,29 @@ export const compileCopilotExtensionBuil
+@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
 task.task(compileCopilotExtensionBuildTask);
 
 /**
--- a/patches/csp-hashes.diff
+++ b/patches/csp-hashes.diff
@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 	<meta charset="UTF-8">
 
 	<meta http-equiv="Content-Security-Policy"
-		content="default-src 'none'; script-src 'sha256-FFQoOVVa2tOE3uqUvirwaMNT20TZmrHcL2aaOjJ8BUo=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-24QqbpzqcqSyIGvg/ZwFRy5pPlhmVBa8CkUREEIUnBw=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-7cKy9iQfWRXcgRS74x6I4q5cRDkv8nQz51jecqMmQ5w=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+		content="default-src 'none'; script-src 'sha256-FYdHnaDkSHwSK3TmWDrs/tT+X4bK+aaoa9yy432BONk=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
 	<!-- Disable pinch zooming -->
 	<meta name="viewport"
--- a/patches/disable-builtin-ext-update.diff
+++ b/patches/disable-builtin-ext-update.diff
@@ -7,7 +7,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -343,6 +343,10 @@ export class Extension implements IExten
+@@ -344,6 +344,10 @@ export class Extension implements IExten
 			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
 				return false;
 			}
--- a/patches/display-language.diff
+++ b/patches/display-language.diff
@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
 import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
 import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -418,6 +418,9 @@ export async function setupServerService
+@@ -444,6 +444,9 @@ export async function setupServerService
 
 		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
 
--- a/patches/external-file-actions.diff
+++ b/patches/external-file-actions.diff
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
-@@ -65,6 +65,7 @@ import { timeout } from '../../../../../
+@@ -62,6 +62,7 @@ import { defaultCountBadgeStyles } from
 import { IFilesConfigurationService } from '../../../../services/filesConfiguration/common/filesConfigurationService.js';
 import { mainWindow } from '../../../../../base/browser/window.js';
 import { IExplorerFileContribution, explorerFileContribRegistry } from '../explorerFileContrib.js';
@@ -290,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
 import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
 import { CancellationToken } from '../../../../../base/common/cancellation.js';
-@@ -1587,7 +1588,8 @@ export class FileDragAndDrop implements
+@@ -1515,7 +1516,8 @@ export class FileDragAndDrop implements
 		@IConfigurationService private configurationService: IConfigurationService,
 		@IInstantiationService private instantiationService: IInstantiationService,
 		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -300,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 	) {
 		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
 			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1812,15 +1814,17 @@ export class FileDragAndDrop implements
+@@ -1740,15 +1742,17 @@ export class FileDragAndDrop implements
 
 			// External file DND (Import/Upload file)
 			if (data instanceof NativeDragAndDropData) {
--- a/patches/getting-started.diff
+++ b/patches/getting-started.diff
@@ -115,7 +115,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
 +++ code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
-@@ -60,6 +60,15 @@
+@@ -63,6 +63,15 @@
 	display: block;
 }
 
--- a/patches/integration.diff
+++ b/patches/integration.diff
@@ -33,7 +33,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 -delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
 -
 -const REMOTE_DATA_FOLDER = args['server-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
-const USER_DATA_PATH = join(REMOTE_DATA_FOLDER, 'data');
+-const USER_DATA_PATH = args['user-data-dir'] || join(REMOTE_DATA_FOLDER, 'data');
 -const APP_SETTINGS_HOME = join(USER_DATA_PATH, 'User');
 -const GLOBAL_STORAGE_HOME = join(APP_SETTINGS_HOME, 'globalStorage');
 -const LOCAL_HISTORY_HOME = join(APP_SETTINGS_HOME, 'History');
--- a/patches/remote-storage.diff
+++ b/patches/remote-storage.diff
@@ -104,7 +104,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -105,6 +105,10 @@ import { McpManagementChannel } from '..
+@@ -106,6 +106,10 @@ import { McpManagementChannel } from '..
 import { AllowedMcpServersService } from '../../platform/mcp/common/allowedMcpServersService.js';
 import { IMcpGalleryManifestService } from '../../platform/mcp/common/mcpGalleryManifest.js';
 import { McpGalleryManifestIPCService } from '../../platform/mcp/common/mcpGalleryManifestServiceIpc.js';
@@ -115,7 +115,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { SANDBOX_HELPER_CHANNEL_NAME, SandboxHelperChannel } from '../../platform/sandbox/common/sandboxHelperIpc.js';
 import { SandboxHelperService } from '../../platform/sandbox/node/sandboxHelper.js';
 
-@@ -238,6 +242,21 @@ export async function setupServerService
+@@ -244,6 +248,21 @@ export async function setupServerService
 	services.set(IMcpGatewayService, new SyncDescriptor(McpGatewayService));
 
 	const instantiationService: IInstantiationService = new InstantiationService(services);
@@ -137,7 +137,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 	services.set(ILanguagePackService, instantiationService.createInstance(NativeLanguagePackService));
 
 	const ptyHostStarter = instantiationService.createInstance(
-@@ -420,6 +439,7 @@ export async function setupServerService
+@@ -446,6 +465,7 @@ export async function setupServerService
 
 		const languagePackChannel = ProxyChannel.fromService<RemoteAgentConnectionContext>(accessor.get(ILanguagePackService), disposables);
 		socketServer.registerChannel('languagePacks', languagePackChannel);
--- a/patches/telemetry.diff
+++ b/patches/telemetry.diff
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { NullPolicyService } from '../../platform/policy/common/policy.js';
 import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
 import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -179,11 +180,23 @@ export async function setupServerService
+@@ -184,11 +185,23 @@ export async function setupServerService
 	const requestService = new RequestService('remote', configurationService, environmentService, logService);
 	services.set(IRequestService, requestService);
 
--- a/patches/unique-db.diff
+++ b/patches/unique-db.diff
@@ -21,7 +21,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/storage/browser/storageS
 
 export class BrowserStorageService extends AbstractStorageService {
 
-@@ -354,7 +355,11 @@ export class IndexedDBStorageDatabase ex
+@@ -365,7 +366,11 @@ export class IndexedDBStorageDatabase ex
 	}
 
 	static async createWorkspaceStorage(workspaceId: string, logService: ILogService): Promise<IIndexedDBStorageDatabase> {
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -53,7 +53,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
 +++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
-@@ -253,7 +253,7 @@
+@@ -266,7 +266,7 @@
 			}
 
 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
@@ -62,7 +62,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 				.then(async registration => {
 					if (navigator.serviceWorker.controller) {
 						// A previous SW is already controlling. Force an update
-@@ -332,6 +332,12 @@
+@@ -345,6 +345,12 @@
 
 				const hostname = location.hostname;
 
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -381,19 +381,20 @@ export function authenticateOrigin(req: express.Request): void {
    return
  }

-  let origin: string
+  let originUrl: URL
  try {
-    origin = new URL(originRaw).host.trim().toLowerCase()
+    originUrl = new URL(originRaw)
  } catch (error) {
    throw new Error(`unable to parse malformed origin "${originRaw}"`)
  }
+  const origin = originUrl.host.trim().toLowerCase()

  const trustedOrigins = req.args["trusted-origins"] || []
  if (isTrustedOrigin(origin, trustedOrigins)) {
    return
  }

-  const host = getHost(req)
+  const host = getHost(req, true)
  if (typeof host === "undefined") {
    // A missing host likely means the reverse proxy has not been configured to
    // forward the host which means we cannot perform the check.  Emit an error
@@ -403,15 +404,64 @@ export function authenticateOrigin(req: express.Request): void {
    throw new Error("no host headers found")
  }

-  if (host !== origin) {
+  if (!hostMatchesOrigin(host, originUrl)) {
    throw new Error(`host "${host}" does not match origin "${origin}"`)
  }
 }

+const defaultPorts: { [protocol: string]: string } = {
+  "http:": "80",
+  "https:": "443",
+}
+
+/**
+ * Parse a host like `example.com:8080` or `[::1]:8080`.  A non-special scheme
+ * keeps the port as written instead of dropping default ports.
+ */
+function parseHost(host: string): URL | undefined {
+  try {
+    return new URL(`host://${host}`)
+  } catch (error) {
+    return undefined
+  }
+}
+
+/**
+ * Check whether the host from the request headers matches the origin.
+ *
+ * This is an exact match, except that a default port (80 for http, 443 for
+ * https) is the same as no port, since `example.com:443` and
+ * `https://example.com` are the same origin.
+ */
+export function hostMatchesOrigin(host: string, origin: URL): boolean {
+  const parsed = parseHost(host)
+  if (!parsed) {
+    return false
+  }
+  const port = parsed.port === defaultPorts[origin.protocol] ? "" : parsed.port
+  return parsed.hostname === origin.hostname.toLowerCase() && port === origin.port
+}
+
+/**
+ * Add the port from X-Forwarded-Port to a host that does not have one.  Some
+ * reverse proxies (for example nginx with `$host`) forward the host without
+ * the port and send the port separately.
+ */
+function addForwardedPort(req: express.Request, host: string): string {
+  const port = getFirstHeader(req, "x-forwarded-port")?.split(",")[0].trim()
+  if (!port || !/^\d+$/.test(port) || parseHost(host)?.port !== "") {
+    return host
+  }
+  return `${host}:${port}`
+}
+
 /**
 * Get the host from headers.  It will be trimmed and lowercased.
+ *
+ * If `withForwardedPort` is set and the host comes from X-Forwarded-Host
+ * without a port, the port from X-Forwarded-Port is added.
 */
-export function getHost(req: express.Request): string | undefined {
+export function getHost(req: express.Request, withForwardedPort = false): string | undefined {
  // Honor Forwarded if present.
  const forwardedRaw = getFirstHeader(req, "forwarded")
  if (forwardedRaw) {
@@ -430,7 +480,8 @@ export function getHost(req: express.Request): string | undefined {
  if (xHost) {
    const firstXHost = xHost.split(",")[0]
    if (firstXHost) {
-      return firstXHost.trim().toLowerCase()
+      const host = firstXHost.trim().toLowerCase()
+      return withForwardedPort ? addForwardedPort(req, host) : host
    }
  }

--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -132,8 +132,10 @@ export const register = async (
    })
  })

-  app.router.use(express.json())
-  app.router.use(express.urlencoded({ extended: true }))
+  // Reject compressed request bodies so unauthenticated requests cannot reach
+  // the zlib/Brotli decoders. Browsers never compress request bodies.
+  app.router.use(express.json({ inflate: false }))
+  app.router.use(express.urlencoded({ extended: true, inflate: false }))

  app.router.use(
    "/_static",
--- a/src/node/vscodeSocket.ts
+++ b/src/node/vscodeSocket.ts
@@ -38,7 +38,7 @@ export async function makeEditorSessionManagerServer(
 ): Promise<http.Server> {
  const router = express()

-  router.use(express.json())
+  router.use(express.json({ inflate: false }))

  router.get<{}, GetSessionResponse | string | unknown, undefined, { filePath?: string }>(
    "/session",
--- a/test/unit/node/http.test.ts
+++ b/test/unit/node/http.test.ts
@@ -68,6 +68,43 @@ describe("http", () => {
        host: "localhost:8081",
        expected: "does not match",
      },
+      {
+        origin: "https://example.com",
+        host: "example.com:443", // Explicit default port.
+      },
+      {
+        origin: "http://example.com",
+        host: "example.com:80",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:80", // Default port of the other protocol.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com:8080",
+        host: "example.com", // Missing port is not ignored.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:8443",
+        expected: "does not match",
+      },
+      {
+        origin: "http://example.com:8080",
+        host: "other.com",
+        expected: "does not match",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8080",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8081",
+        expected: "does not match",
+      },
      {
        origin: "localhost:8080",
        host: "localhost:8080",
@@ -122,6 +159,75 @@ describe("http", () => {
        })
      })
    })
+
+    describe("x-forwarded-port", () => {
+      ;[
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "443" },
+        },
+        {
+          origin: "http://[::1]:8080",
+          headers: { "x-forwarded-host": "[::1]", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080, 443" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8081" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com:8081", "x-forwarded-port": "8080" },
+          expected: "does not match", // The port in the host wins.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "foo" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { host: "example.com", "x-forwarded-port": "8080" },
+          expected: "does not match", // Only used with X-Forwarded-Host.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { forwarded: "host=example.com", "x-forwarded-port": "8080" },
+          expected: "does not match",
+        },
+      ].forEach((test) => {
+        it(`${test.origin} -> ${JSON.stringify(test.headers)}`, () => {
+          const req = getMockReq({
+            originalUrl: "localhost:8080",
+            headers: {
+              origin: test.origin,
+              ...test.headers,
+            },
+            args: {},
+          })
+          if (typeof test.expected === "string") {
+            expect(() => http.authenticateOrigin(req)).toThrow(test.expected)
+          } else {
+            expect(() => http.authenticateOrigin(req)).not.toThrow()
+          }
+        })
+      })
+
+      it("should not add the port to the host for other uses", () => {
+        const req = getMockReq({
+          headers: { "x-forwarded-host": "code-8080.example.com", "x-forwarded-port": "443" },
+        })
+        expect(http.getHost(req)).toBe("code-8080.example.com")
+      })
+    })
  })

  describe("constructRedirectPath", () => {
--- a/test/unit/node/i18n.test.ts
+++ b/test/unit/node/i18n.test.ts
@@ -1,13 +1,9 @@
 import { promises as fs } from "fs"
 import * as os from "os"
 import * as path from "path"
-import i18n, { loadCustomStrings } from "../../../src/node/i18n"
+import { loadCustomStrings } from "../../../src/node/i18n"

 describe("i18n", () => {
-  it("includes Turkish translations", () => {
-    expect(i18n.getResource("tr", "translation", "WELCOME")).toBe("{{app}} uygulamasına hoş geldiniz")
-  })
-
  let tempDir: string
  let validJsonFile: string
  let invalidJsonFile: string
--- a/test/unit/node/routes/login.test.ts
+++ b/test/unit/node/routes/login.test.ts
@@ -75,6 +75,17 @@ describe("login", () => {
      expect(htmlContent).toContain("Missing password")
    })

+    it("should reject compressed request bodies", async () => {
+      for (const encoding of ["br", "gzip", "deflate"]) {
+        const resp = await codeServer().fetch("/login", {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Encoding": encoding },
+          body: "password=test",
+        })
+        expect(resp.status).toBe(415)
+      }
+    })
+
    it("should return HTML with 'Incorrect password' message", async () => {
      const params = new URLSearchParams()
      params.append("password", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
Author	SHA1	Message	Date
dependabot[bot]	5977ad7c1d	Bump follow-redirects from 1.16.0 to 1.16.2 Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.0 to 1.16.2. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.0...v1.16.2) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-27 01:04:15 +00:00
dependabot[bot]	9d0eee156e	Bump ip-address from 10.7.2 to 10.7.5 (#8080 )	2026-10-26 17:01:48 -08:00
dependabot[bot]	b87ae88bc6	Bump body-parser from 2.3.0 to 2.4.0 (#8079 )	2026-10-26 17:01:24 -08:00
Harsh Bhanushali	89cba83cb4	Normalize default ports and use X-Forwarded-Port in the origin check (#8059 ) The origin check compared the host header to the origin's host as plain strings, so `example.com:443` did not match `https://example.com`, and a proxy forwarding `$host` (no port) together with X-Forwarded-Port failed on any non-default port. Default ports (80 for http, 443 for https) are now treated as no port, and when X-Forwarded-Host has no port the port from X-Forwarded-Port is used. Everything else is still an exact match. getHost() is unchanged for the domain proxy.	2026-10-26 16:42:24 -08:00
dependabot[bot]	b45f29491d	Bump js-yaml from 4.3.1 to 5.4.3 (#8054 )	2026-10-26 15:47:26 -08:00
cdrci	4677c9d865	Update Helm chart and changelog with 4.143.1 (#8072 )	2026-10-23 15:32:11 -08:00
cdrci	22ddf60dbc	Update Code to 1.143.1 (#8069 ) * Remove Node patch * Update patches Just one conflict, they use user-data-dir now which is something we already have been doing for a long time.	2026-10-23 22:15:00 +00:00
cdrci	e777c1f963	Update Helm chart and changelog with 4.141.1 (#8071 )	2026-10-23 13:49:22 -08:00
Dean Sheather	279b5702aa	Merge pull request #8070 from coder/upgrade-node-checksums Fix Node 24.22.1 checksums	2026-10-24 04:50:00 +11:00
Dean Sheather	27baccf843	Fix Node 24.22.1 checksums	2026-10-23 17:35:56 +00:00
Dean Sheather	8aab1b0d72	Merge pull request #8068 from coder/upgrade-node Upgrade Node to 24.22.1	2026-10-24 02:35:35 +11:00
Dean Sheather	777c493a9b	Upgrade Node to 24.22.1	2026-10-23 15:06:41 +00:00
@@ -1 +1 @@
 .21.0
 .22.1