Bump js-yaml from 4.3.0 to 5.2.2

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bump ip-address from 10.2.0 to 10.4.0 (#7931 )
2026-09-02 08:30:17 +02:00 · 2026-08-06 22:48:04 +00:00 · 2026-08-06 14:45:38 -08:00 · 2026-08-06 22:13:49 +00:00 · 2026-08-06 13:06:00 -08:00 · 2026-08-06 12:35:34 -08:00
14 changed files with 129 additions and 61 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,18 @@ Code v99.99.999

 ## Unreleased

+Code v1.132.0
+
+### Changed
+
+- Update to Code 1.132.0
+
+### Fixed
+
+- When proxying, cookies were being decoded and re-encoded, which could cause
+  issues for applications that encode differently. Cookies are now passed
+  through unchanged (aside from stripping out code-server's session token).
+
 ## [4.131.0](https://github.com/coder/code-server/releases/tag/v4.131.0) - 2026-07-30

 Code v1.131.0
--- a/lib/vscode
+++ b/lib/vscode
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,7 +20,7 @@
        "http-proxy": "^1.18.1",
        "httpolyglot": "^0.1.2",
        "i18next": "^26.3.1",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^5.2.2",
        "limiter": "^2.1.0",
        "pem": "^1.14.8",
        "proxy-agent": "^6.3.1",
@@ -44,7 +44,7 @@
        "@types/express": "^5.0.0",
        "@types/http-proxy": "1.17.7",
        "@types/js-yaml": "^4.0.6",
-        "@types/node": "22.x",
+        "@types/node": "24.x",
        "@types/pem": "^1.14.1",
        "@types/proxy-from-env": "^1.0.1",
        "@types/safe-compare": "^1.1.0",
@@ -65,7 +65,7 @@
        "typescript-eslint": "^8.8.0"
      },
      "engines": {
-        "node": "22"
+        "node": "24"
      }
    },
    "node_modules/@coder/logger": {
@@ -268,6 +268,29 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
    "node_modules/@eslint/js": {
      "version": "9.39.3",
      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.3.tgz",
@@ -652,13 +675,13 @@
      }
    },
    "node_modules/@types/node": {
-      "version": "22.19.13",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.13.tgz",
-      "integrity": "sha512-akNQMv0wW5uyRpD2v2IEyRSZiR+BeGuoB6L310EgGObO44HSMNT8z1xzio28V8qOrgYaopIDNA18YgdXd+qTiw==",
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": "~6.21.0"
+        "undici-types": "~7.18.0"
      }
    },
    "node_modules/@types/pem": {
@@ -3660,9 +3683,9 @@
      }
    },
    "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
      "license": "MIT",
      "engines": {
        "node": ">= 12"
@@ -4153,9 +4176,9 @@
      "license": "ISC"
    },
    "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
      "funding": [
        {
          "type": "github",
@@ -4171,7 +4194,7 @@
        "argparse": "^2.0.1"
      },
      "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
      }
    },
    "node_modules/json-buffer": {
@@ -6306,9 +6329,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
      "dev": true,
      "license": "MIT"
    },
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
    "@types/express": "^5.0.0",
    "@types/http-proxy": "1.17.7",
    "@types/js-yaml": "^4.0.6",
-    "@types/node": "22.x",
+    "@types/node": "24.x",
    "@types/pem": "^1.14.1",
    "@types/proxy-from-env": "^1.0.1",
    "@types/safe-compare": "^1.1.0",
@@ -76,7 +76,7 @@
    "http-proxy": "^1.18.1",
    "httpolyglot": "^0.1.2",
    "i18next": "^26.3.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^5.2.2",
    "limiter": "^2.1.0",
    "pem": "^1.14.8",
    "proxy-agent": "^6.3.1",
@@ -88,7 +88,7 @@
    "xdg-basedir": "^4.0.0"
  },
  "resolutions": {
-    "@types/node": "22.x"
+    "@types/node": "24.x"
  },
  "bin": {
    "code-server": "out/node/entry.js"
@@ -103,7 +103,7 @@
    "remote-development"
  ],
  "engines": {
-    "node": "22"
+    "node": "24"
  },
  "jest": {
    "transform": {
--- a/patches/base-path.diff
+++ b/patches/base-path.diff
@@ -146,7 +146,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 			embedderIdentifier: 'server-distro',
 			voiceWsUrl: this._productService.voiceWsUrl,
 			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
-@@ -402,7 +409,9 @@ export class WebClientServer {
+@@ -403,7 +410,9 @@ export class WebClientServer {
 			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
 			WORKBENCH_WEB_BASE_URL: staticRoute,
 			WORKBENCH_NLS_URL,
@@ -157,7 +157,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 		};
 
 		// DEV ---------------------------------------------------------------------------------------
-@@ -439,7 +448,7 @@ export class WebClientServer {
+@@ -440,7 +449,7 @@ export class WebClientServer {
 			'default-src \'self\';',
 			'img-src \'self\' https: data: blob:;',
 			'media-src \'self\';',
@@ -166,7 +166,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 			'child-src \'self\';',
 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
 			'worker-src \'self\' data: blob:;',
-@@ -512,3 +521,70 @@ export class WebClientServer {
+@@ -513,3 +522,70 @@ export class WebClientServer {
 		return void res.end(data);
 	}
 }
--- a/patches/display-language.diff
+++ b/patches/display-language.diff
@@ -161,7 +161,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 import { CharCode } from '../../base/common/charCode.js';
 import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
 import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -400,14 +401,22 @@ export class WebClientServer {
+@@ -401,14 +402,22 @@ export class WebClientServer {
 		};
 
 		const cookies = cookie.parse(req.headers.cookie || '');
@@ -272,7 +272,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
-@@ -474,9 +474,6 @@ export class InstallAction extends Exten
+@@ -475,9 +475,6 @@ export class InstallAction extends Exten
 		if (this.extension.isBuiltin) {
 			return;
 		}
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		if (this.extension.state !== ExtensionState.Uninstalled) {
 			return;
 		}
-@@ -781,7 +778,7 @@ export abstract class InstallInOtherServ
+@@ -782,7 +779,7 @@ export abstract class InstallInOtherServ
 		}
 
 		if (isLanguagePackExtension(this.extension.local.manifest)) {
@@ -291,7 +291,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		}
 
 		// Prefers to run on UI
-@@ -2282,17 +2279,6 @@ export class SetLanguageAction extends E
+@@ -2281,17 +2278,6 @@ export class SetLanguageAction extends E
 	update(): void {
 		this.enabled = false;
 		this.class = SetLanguageAction.DisabledClass;
@@ -309,7 +309,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 	}
 
 	override async run(): Promise<any> {
-@@ -2309,7 +2295,6 @@ export class ClearLanguageAction extends
+@@ -2308,7 +2294,6 @@ export class ClearLanguageAction extends
 	private static readonly DisabledClass = `${this.EnabledClass} disabled`;
 
 	constructor(
@@ -317,7 +317,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		@ILocaleService private readonly localeService: ILocaleService,
 	) {
 		super(ClearLanguageAction.ID, ClearLanguageAction.TITLE.value, ClearLanguageAction.DisabledClass, false);
-@@ -2319,17 +2304,6 @@ export class ClearLanguageAction extends
+@@ -2318,17 +2303,6 @@ export class ClearLanguageAction extends
 	update(): void {
 		this.enabled = false;
 		this.class = ClearLanguageAction.DisabledClass;
--- a/patches/external-file-actions.diff
+++ b/patches/external-file-actions.diff
@@ -27,7 +27,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -312,6 +312,16 @@ export interface IWorkbenchConstructionO
+@@ -319,6 +319,16 @@ export interface IWorkbenchConstructionO
 	 */
 	readonly userDataPath?: string
 
@@ -166,12 +166,12 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions
 import { AutoSaveAfterShortDelayContext } from '../../../services/filesConfiguration/common/filesConfigurationService.js';
 import { WorkbenchListDoubleSelection } from '../../../../platform/list/browser/listService.js';
 import { Schemas } from '../../../../base/common/network.js';
-import { DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
-+import { IsEnabledFileDownloads, IsEnabledFileUploads, DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
+-import { DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ActiveEditorDirtyContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
+import { IsEnabledFileDownloads, IsEnabledFileUploads, DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ActiveEditorDirtyContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
 import { IsWebContext } from '../../../../platform/contextkey/common/contextkeys.js';
 import { ServicesAccessor } from '../../../../platform/instantiation/common/instantiation.js';
 import { ThemeIcon } from '../../../../base/common/themables.js';
-@@ -571,13 +571,16 @@ MenuRegistry.appendMenuItem(MenuId.Explo
+@@ -573,13 +573,16 @@ MenuRegistry.appendMenuItem(MenuId.Explo
 		id: DOWNLOAD_COMMAND_ID,
 		title: DOWNLOAD_LABEL
 	},
@@ -195,7 +195,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions
 	)
 }));
 
-@@ -589,6 +592,7 @@ MenuRegistry.appendMenuItem(MenuId.Explo
+@@ -591,6 +594,7 @@ MenuRegistry.appendMenuItem(MenuId.Explo
 		title: UPLOAD_LABEL,
 	},
 	when: ContextKeyExpr.and(
--- a/patches/getting-started.diff
+++ b/patches/getting-started.diff
@@ -135,7 +135,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -322,6 +322,11 @@ export interface IWorkbenchConstructionO
+@@ -329,6 +329,11 @@ export interface IWorkbenchConstructionO
 	 */
 	readonly isEnabledFileUploads?: boolean
 
--- a/patches/local-storage.diff
+++ b/patches/local-storage.diff
@@ -30,7 +30,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -307,6 +307,11 @@ export interface IWorkbenchConstructionO
+@@ -314,6 +314,11 @@ export interface IWorkbenchConstructionO
 	 */
 	readonly configurationDefaults?: Record<string, unknown>;
 
--- a/patches/proxy-uri.diff
+++ b/patches/proxy-uri.diff
@@ -148,7 +148,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExpl
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
-@@ -84,8 +84,8 @@ export class ForwardedPortsView extends
+@@ -99,8 +99,8 @@ export class ForwardedPortsView extends
 	private async enableForwardedPortsFeatures() {
 		this.contextKeyListener.clear();
 
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -226,7 +226,7 @@ export class BrowserWorkbenchEnvironment
+@@ -234,7 +234,7 @@ export class BrowserWorkbenchEnvironment
 
 	@memoize
 	get webviewExternalEndpoint(): string {
--- a/src/node/proxy.ts
+++ b/src/node/proxy.ts
@@ -20,17 +20,31 @@ proxy.on("error", (error, _, res) => {
  }
 })

+function identity<T>(val: T): T {
+  return val
+}
+
 // Strip the code-server cookie if it exists to avoid transmitting the cookie
 // to potentially malicious local ports.
 proxy.on("proxyReq", (preq, req) => {
-  const cookieSessionName = getCookieSessionName((req as Request).args["cookie-suffix"])
-  preq.setHeader(
-    "Cookie",
-    cookie.stringifyCookie({
-      ...(req as Request).cookies,
-      [cookieSessionName]: undefined,
-    }),
-  )
+  if (req.headers.cookie) {
+    const cookieSessionName = getCookieSessionName((req as Request).args["cookie-suffix"])
+    // Encoding and decoding are no-ops; we just want to remove the token
+    // without changing anything else about the cookies because not all
+    // applications encode/decode the same way `cookie` here does.
+    preq.setHeader(
+      "Cookie",
+      cookie.stringifyCookie(
+        {
+          ...cookie.parseCookie(req.headers.cookie, { decode: identity }),
+          [cookieSessionName]: undefined,
+        },
+        {
+          encode: identity,
+        },
+      ),
+    )
+  }
 })

 // Intercept the response to rewrite absolute redirects against the base path.
--- a/test/unit/node/proxy.test.ts
+++ b/test/unit/node/proxy.test.ts
@@ -298,25 +298,44 @@ describe("proxy", () => {
    process.env.HASHED_PASSWORD = token
    codeServer = await integration.setup(["--auth=password"])

-    // Set up a listener that just prints the cookies it got.
    e.get("/wsup/cookies", (req, res) => {
      res.writeHead(HttpCode.Ok, { "Content-Type": "text/plain" })
      res.end(req.headers.cookie)
    })

-    // Send the token along with other cookies which should be preserved.
-    // Encode one to make sure they are being re-encoded properly.
-    const value = "hello=there"
-    const encodedValue = encodeURIComponent(value)
-    const resp = await codeServer.fetch(proxyPath + "/cookies", {
-      headers: {
-        cookie: `cookie1=${encodedValue}; code-server-session=${token}; cookie2=hello;`,
-      },
+    const cookies = [
+      "cookie2=hello",
+      // Cookies should pass through unchanged, neither encoded nor decoded.
+      `cookie1=${encodeURIComponent("hello=there")}`,
+      "cookie3=foo|bar",
+      `cookie4=${encodeURIComponent("foo|bar")}`,
+      `cookie5=${encodeURIComponent("bar;baz")}`,
+    ]
+
+    // Test each slot to ensure the token is found anywhere.
+    for (let i = 0; i <= cookies.length; ++i) {
+      const left = cookies.slice(0, i)
+      const right = cookies.slice(i)
+      const resp = await codeServer.fetch(proxyPath + "/cookies", {
+        headers: {
+          cookie: [...left, `code-server-session=${token}`, ...right].join("; "),
+        },
+      })
+      expect(resp.status).toBe(200)
+      expect(await resp.text()).toBe(cookies.join("; "))
+    }
+  })
+
+  it("should proxy when no cookies", async () => {
+    codeServer = await integration.setup(["--auth=none"])
+
+    e.get("/wsup/cookies", (req, res) => {
+      res.writeHead(HttpCode.Ok, { "Content-Type": "text/plain" })
+      res.end(req.headers.cookie || "no cookies")
    })

-    // The proxied listener should not have printed the code-server token.
+    const resp = await codeServer.fetch(proxyPath + "/cookies")
    expect(resp.status).toBe(200)
-    const text = await resp.text()
-    expect(text).toBe(`cookie1=${encodedValue}; cookie2=hello`)
+    expect(await resp.text()).toBe("no cookies")
  })
 })
--- a/test/unit/node/routes/vscode.test.ts
+++ b/test/unit/node/routes/vscode.test.ts
@@ -38,7 +38,7 @@ describe("vscode", () => {

  it("should require auth", async () => {
    codeServer = await integration.setup(["--auth=password"], "")
-    let resp = await codeServer.fetch("/mint-key", { method: "POST" })
+    const resp = await codeServer.fetch("/mint-key", { method: "POST" })
    expect(resp.status).toBe(401)
  })
 })
Author	SHA1	Message	Date
dependabot[bot]	90427af5d8	Bump js-yaml from 4.3.0 to 5.2.2 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-06 22:48:04 +00:00
dependabot[bot]	313bf0359b	Bump ip-address from 10.2.0 to 10.4.0 (#7931 )	2026-08-06 14:45:38 -08:00
cdrci	41cbd28c44	Update Code to 1.132.0 (#7933 )	2026-08-06 22:13:49 +00:00
Asher	208c81a072	Fix mistakenly encoding cookies to proxy We use the cookie parser to remove the code-server token but by default it encodes using encodeURIComponent, which encodes more than is strictly necessary and can break proxied applications. Now we pass the cookies through unchanged (other than removing the code-server token). Fixes #7927.	2026-08-06 13:06:00 -08:00
Asher	f836314954	Use const for unmutated let	2026-08-06 12:35:34 -08:00
Asher	1a370bb606	Update Node types to 24	2026-08-06 11:04:32 -08:00