Bump @eslint/compat from 1.4.1 to 2.1.1

Bumps [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) from 1.4.1 to 2.1.1. - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/compat-v2.1.1/packages/compat) --- updated-dependencies: - dependency-name: "@eslint/compat" dependency-version: 2.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Override basic-ftp to ^6.2.1 (#8086 )
2026-11-02 22:09:11 +01:00 · 2026-10-28 22:28:26 +00:00 · 2026-10-28 14:25:45 -08:00 · 2026-10-27 13:05:56 -08:00 · 2026-10-27 11:58:13 -08:00 · 2026-10-27 11:51:39 -08:00
29 changed files with 377 additions and 77 deletions
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.21.0
+24.22.1
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,36 @@ Code v99.99.999

 ## Unreleased

+## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
+
+Code v1.143.1
+
+### Changed
+
+- Update to Code 1.143.1
+
+## [4.141.1](https://github.com/coder/code-server/releases/tag/v4.141.1) - 2026-10-23
+
+### Security
+
+- Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the
+  Brotli decoder (CVE-2026-111497).
+- Reject compressed request bodies (`Content-Encoding: br`, `gzip`, or
+  `deflate`) instead of decompressing them.
+
+### Fixed
+
+- Boolean flags in the `--flag=false` form and in the config file now respect
+  being set to false.
+
+### Added
+
+- Turkish locale.
+
+### Changed
+
+- Expand values from path options in the config file that start with a tilde.
+
 ## [4.141.0](https://github.com/coder/code-server/releases/tag/v4.141.0) - 2026-10-08

 Code v1.141.0
--- a/ci/helm-chart/Chart.yaml
+++ b/ci/helm-chart/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.56.0
+version: 3.57.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.141.0
+appVersion: 4.143.1
--- a/ci/helm-chart/templates/service.yaml
+++ b/ci/helm-chart/templates/service.yaml
@@ -4,8 +4,13 @@ metadata:
  name: {{ include "code-server.fullname" . }}
  labels:
    {{- include "code-server.labels" . | nindent 4 }}
+  annotations:
+  {{- with .Values.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  type: {{ .Values.service.type }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
  ports:
    - port: {{ .Values.service.port }}
      targetPort: http
--- a/ci/helm-chart/values.yaml
+++ b/ci/helm-chart/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: codercom/code-server
-  tag: '4.141.0'
+  tag: '4.143.1'
  pullPolicy: Always

 # Specifies one or more secrets to be used when pulling images from a
@@ -48,6 +48,8 @@ priorityClassName: ""
 service:
  type: ClusterIP
  port: 8080
+  loadBalancerClass: null
+  annotations: {}

 ingress:
  enabled: false
--- a/lib/vscode
+++ b/lib/vscode
--- a/package-lock.json
+++ b/package-lock.json
@@ -35,7 +35,7 @@
        "code-server": "out/node/entry.js"
      },
      "devDependencies": {
-        "@eslint/compat": "^1.2.0",
+        "@eslint/compat": "^2.1.1",
        "@eslint/eslintrc": "^3.1.0",
        "@eslint/js": "^9.12.0",
        "@types/compression": "^1.7.3",
@@ -170,19 +170,19 @@
      }
    },
    "node_modules/@eslint/compat": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.1.tgz",
-      "integrity": "sha512-cfO82V9zxxGBxcQDr1lfaYB7wykTa0b00mGa36FrJl7iTFd0Z2cHfEYuxcBRP/iNijCsWsEkA+jzT8hGYmv33w==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.1.tgz",
+      "integrity": "sha512-rMcy8GSrwNzcISX/BlTDY/GLB4eCopEuy9woIls3To+15OLxykZrxxq+WUcylCPCQ6F4MujjBM1DX5V1aqI3Vw==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "@eslint/core": "^0.17.0"
+        "@eslint/core": "^1.2.1"
      },
      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
      },
      "peerDependencies": {
-        "eslint": "^8.40 || 9"
+        "eslint": "^8.40 || 9 || 10"
      },
      "peerDependenciesMeta": {
        "eslint": {
@@ -190,6 +190,19 @@
        }
      }
    },
+    "node_modules/@eslint/compat/node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
    "node_modules/@eslint/config-array": {
      "version": "0.21.1",
      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
@@ -269,9 +282,9 @@
      }
    },
    "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
      "dev": true,
      "funding": [
        {
@@ -1726,27 +1739,27 @@
      "license": "MIT"
    },
    "node_modules/basic-ftp": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz",
-      "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==",
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.3.tgz",
+      "integrity": "sha512-T7GYtQ2eKJUN5YORG7A8u2WfB9JMN0a4/wl3MI64qq2qTRfa3FXzoNq0DDojZDkDyStcL+TkfKsz4JHEZx5kGQ==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
      }
    },
    "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
      "license": "MIT",
      "dependencies": {
        "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
        "debug": "^4.4.3",
        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
        "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
        "raw-body": "^3.0.2",
        "type-is": "^2.1.0"
      },
@@ -1759,9 +1772,9 @@
      }
    },
    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -3245,9 +3258,9 @@
      "license": "ISC"
    },
    "node_modules/follow-redirects": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz",
+      "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==",
      "funding": [
        {
          "type": "individual",
@@ -3703,9 +3716,9 @@
      }
    },
    "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
      "license": "MIT",
      "dependencies": {
        "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -3777,9 +3790,9 @@
      }
    },
    "node_modules/ip-address": {
-      "version": "10.7.2",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "version": "10.7.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
      "license": "MIT",
      "engines": {
        "node": ">= 12"
@@ -4270,9 +4283,9 @@
      "license": "ISC"
    },
    "node_modules/js-yaml": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
      "funding": [
        {
          "type": "github",
@@ -5366,9 +5379,9 @@
      }
    },
    "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "es-define-property": "^1.0.1",
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
  },
  "main": "out/node/entry.js",
  "devDependencies": {
-    "@eslint/compat": "^1.2.0",
+    "@eslint/compat": "^2.1.1",
    "@eslint/eslintrc": "^3.1.0",
    "@eslint/js": "^9.12.0",
    "@types/compression": "^1.7.3",
@@ -90,6 +90,9 @@
  "resolutions": {
    "@types/node": "24.x"
  },
+  "overrides": {
+    "basic-ftp": "^6.2.1"
+  },
  "bin": {
    "code-server": "out/node/entry.js"
  },
--- a/patches/copilot.diff
+++ b/patches/copilot.diff
@@ -2,7 +2,7 @@ Index: code-server/lib/vscode/build/gulpfile.extensions.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
 +++ code-server/lib/vscode/build/gulpfile.extensions.ts
-@@ -291,6 +291,29 @@ export const compileCopilotExtensionBuil
+@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
 task.task(compileCopilotExtensionBuildTask);
 
 /**
--- a/patches/csp-hashes.diff
+++ b/patches/csp-hashes.diff
@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 	<meta charset="UTF-8">
 
 	<meta http-equiv="Content-Security-Policy"
-		content="default-src 'none'; script-src 'sha256-FFQoOVVa2tOE3uqUvirwaMNT20TZmrHcL2aaOjJ8BUo=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-24QqbpzqcqSyIGvg/ZwFRy5pPlhmVBa8CkUREEIUnBw=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-7cKy9iQfWRXcgRS74x6I4q5cRDkv8nQz51jecqMmQ5w=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+		content="default-src 'none'; script-src 'sha256-FYdHnaDkSHwSK3TmWDrs/tT+X4bK+aaoa9yy432BONk=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
 	<!-- Disable pinch zooming -->
 	<meta name="viewport"
--- a/patches/disable-builtin-ext-update.diff
+++ b/patches/disable-builtin-ext-update.diff
@@ -7,7 +7,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -343,6 +343,10 @@ export class Extension implements IExten
+@@ -344,6 +344,10 @@ export class Extension implements IExten
 			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
 				return false;
 			}
--- a/patches/display-language.diff
+++ b/patches/display-language.diff
@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
 import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
 import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -418,6 +418,9 @@ export async function setupServerService
+@@ -444,6 +444,9 @@ export async function setupServerService
 
 		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
 
--- a/patches/external-file-actions.diff
+++ b/patches/external-file-actions.diff
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
-@@ -65,6 +65,7 @@ import { timeout } from '../../../../../
+@@ -62,6 +62,7 @@ import { defaultCountBadgeStyles } from
 import { IFilesConfigurationService } from '../../../../services/filesConfiguration/common/filesConfigurationService.js';
 import { mainWindow } from '../../../../../base/browser/window.js';
 import { IExplorerFileContribution, explorerFileContribRegistry } from '../explorerFileContrib.js';
@@ -290,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
 import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
 import { CancellationToken } from '../../../../../base/common/cancellation.js';
-@@ -1587,7 +1588,8 @@ export class FileDragAndDrop implements
+@@ -1515,7 +1516,8 @@ export class FileDragAndDrop implements
 		@IConfigurationService private configurationService: IConfigurationService,
 		@IInstantiationService private instantiationService: IInstantiationService,
 		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -300,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 	) {
 		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
 			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1812,15 +1814,17 @@ export class FileDragAndDrop implements
+@@ -1740,15 +1742,17 @@ export class FileDragAndDrop implements
 
 			// External file DND (Import/Upload file)
 			if (data instanceof NativeDragAndDropData) {
--- a/patches/getting-started.diff
+++ b/patches/getting-started.diff
@@ -115,7 +115,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
 +++ code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
-@@ -60,6 +60,15 @@
+@@ -63,6 +63,15 @@
 	display: block;
 }
 
--- a/patches/integration.diff
+++ b/patches/integration.diff
@@ -33,7 +33,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 -delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
 -
 -const REMOTE_DATA_FOLDER = args['server-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
-const USER_DATA_PATH = join(REMOTE_DATA_FOLDER, 'data');
+-const USER_DATA_PATH = args['user-data-dir'] || join(REMOTE_DATA_FOLDER, 'data');
 -const APP_SETTINGS_HOME = join(USER_DATA_PATH, 'User');
 -const GLOBAL_STORAGE_HOME = join(APP_SETTINGS_HOME, 'globalStorage');
 -const LOCAL_HISTORY_HOME = join(APP_SETTINGS_HOME, 'History');
--- a/patches/remote-storage.diff
+++ b/patches/remote-storage.diff
@@ -104,7 +104,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -105,6 +105,10 @@ import { McpManagementChannel } from '..
+@@ -106,6 +106,10 @@ import { McpManagementChannel } from '..
 import { AllowedMcpServersService } from '../../platform/mcp/common/allowedMcpServersService.js';
 import { IMcpGalleryManifestService } from '../../platform/mcp/common/mcpGalleryManifest.js';
 import { McpGalleryManifestIPCService } from '../../platform/mcp/common/mcpGalleryManifestServiceIpc.js';
@@ -115,7 +115,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { SANDBOX_HELPER_CHANNEL_NAME, SandboxHelperChannel } from '../../platform/sandbox/common/sandboxHelperIpc.js';
 import { SandboxHelperService } from '../../platform/sandbox/node/sandboxHelper.js';
 
-@@ -238,6 +242,21 @@ export async function setupServerService
+@@ -244,6 +248,21 @@ export async function setupServerService
 	services.set(IMcpGatewayService, new SyncDescriptor(McpGatewayService));
 
 	const instantiationService: IInstantiationService = new InstantiationService(services);
@@ -137,7 +137,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 	services.set(ILanguagePackService, instantiationService.createInstance(NativeLanguagePackService));
 
 	const ptyHostStarter = instantiationService.createInstance(
-@@ -420,6 +439,7 @@ export async function setupServerService
+@@ -446,6 +465,7 @@ export async function setupServerService
 
 		const languagePackChannel = ProxyChannel.fromService<RemoteAgentConnectionContext>(accessor.get(ILanguagePackService), disposables);
 		socketServer.registerChannel('languagePacks', languagePackChannel);
--- a/patches/telemetry.diff
+++ b/patches/telemetry.diff
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { NullPolicyService } from '../../platform/policy/common/policy.js';
 import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
 import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -179,11 +180,23 @@ export async function setupServerService
+@@ -184,11 +185,23 @@ export async function setupServerService
 	const requestService = new RequestService('remote', configurationService, environmentService, logService);
 	services.set(IRequestService, requestService);
 
--- a/patches/unique-db.diff
+++ b/patches/unique-db.diff
@@ -21,7 +21,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/storage/browser/storageS
 
 export class BrowserStorageService extends AbstractStorageService {
 
-@@ -354,7 +355,11 @@ export class IndexedDBStorageDatabase ex
+@@ -365,7 +366,11 @@ export class IndexedDBStorageDatabase ex
 	}
 
 	static async createWorkspaceStorage(workspaceId: string, logService: ILogService): Promise<IIndexedDBStorageDatabase> {
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -53,7 +53,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
 +++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
-@@ -253,7 +253,7 @@
+@@ -266,7 +266,7 @@
 			}
 
 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
@@ -62,7 +62,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 				.then(async registration => {
 					if (navigator.serviceWorker.controller) {
 						// A previous SW is already controlling. Force an update
-@@ -332,6 +332,12 @@
+@@ -345,6 +345,12 @@
 
 				const hostname = location.hostname;
 
--- a/src/node/cli.ts
+++ b/src/node/cli.ts
@@ -3,7 +3,7 @@ import * as crypto from "crypto"
 import { promises as fs } from "fs"
 import { load } from "js-yaml"
 import * as path from "path"
-import { generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
+import { expandTilde, generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
 import { EditorSessionManagerClient } from "./vscodeSocket"

 export enum Feature {
@@ -466,7 +466,7 @@ export const parse = (
      }

      if (option.path) {
-        value = path.resolve(value)
+        value = path.resolve(expandTilde(value))
      }

      switch (option.type) {
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -235,7 +235,16 @@ export const getCookieDomain = (host: string, proxyDomains: string[]): string |
    return undefined
  }

-  proxyDomains.forEach((domain) => {
+  proxyDomains.forEach((proxyDomain) => {
+    // Proxy domains are patterns like `{{port}}.domain.tld` or
+    // `prefix-{{port}}-suffix.domain.tld` so use the part after the label that
+    // contains the port.
+    const portIndex = proxyDomain.indexOf("{{port}}")
+    const domain = portIndex === -1 ? proxyDomain : proxyDomain.substring(proxyDomain.indexOf(".", portIndex) + 1)
+    // Skip patterns we cannot turn into a domain, like `{{port}}.{{host}}`.
+    if (!domain || domain.includes("{{")) {
+      return
+    }
    if (host.endsWith(domain) && domain.length < host.length) {
      host = domain
    }
@@ -381,19 +390,20 @@ export function authenticateOrigin(req: express.Request): void {
    return
  }

-  let origin: string
+  let originUrl: URL
  try {
-    origin = new URL(originRaw).host.trim().toLowerCase()
+    originUrl = new URL(originRaw)
  } catch (error) {
    throw new Error(`unable to parse malformed origin "${originRaw}"`)
  }
+  const origin = originUrl.host.trim().toLowerCase()

  const trustedOrigins = req.args["trusted-origins"] || []
  if (isTrustedOrigin(origin, trustedOrigins)) {
    return
  }

-  const host = getHost(req)
+  const host = getHost(req, true)
  if (typeof host === "undefined") {
    // A missing host likely means the reverse proxy has not been configured to
    // forward the host which means we cannot perform the check.  Emit an error
@@ -403,15 +413,64 @@ export function authenticateOrigin(req: express.Request): void {
    throw new Error("no host headers found")
  }

-  if (host !== origin) {
+  if (!hostMatchesOrigin(host, originUrl)) {
    throw new Error(`host "${host}" does not match origin "${origin}"`)
  }
 }

+const defaultPorts: { [protocol: string]: string } = {
+  "http:": "80",
+  "https:": "443",
+}
+
+/**
+ * Parse a host like `example.com:8080` or `[::1]:8080`.  A non-special scheme
+ * keeps the port as written instead of dropping default ports.
+ */
+function parseHost(host: string): URL | undefined {
+  try {
+    return new URL(`host://${host}`)
+  } catch (error) {
+    return undefined
+  }
+}
+
+/**
+ * Check whether the host from the request headers matches the origin.
+ *
+ * This is an exact match, except that a default port (80 for http, 443 for
+ * https) is the same as no port, since `example.com:443` and
+ * `https://example.com` are the same origin.
+ */
+export function hostMatchesOrigin(host: string, origin: URL): boolean {
+  const parsed = parseHost(host)
+  if (!parsed) {
+    return false
+  }
+  const port = parsed.port === defaultPorts[origin.protocol] ? "" : parsed.port
+  return parsed.hostname === origin.hostname.toLowerCase() && port === origin.port
+}
+
+/**
+ * Add the port from X-Forwarded-Port to a host that does not have one.  Some
+ * reverse proxies (for example nginx with `$host`) forward the host without
+ * the port and send the port separately.
+ */
+function addForwardedPort(req: express.Request, host: string): string {
+  const port = getFirstHeader(req, "x-forwarded-port")?.split(",")[0].trim()
+  if (!port || !/^\d+$/.test(port) || parseHost(host)?.port !== "") {
+    return host
+  }
+  return `${host}:${port}`
+}
+
 /**
 * Get the host from headers.  It will be trimmed and lowercased.
+ *
+ * If `withForwardedPort` is set and the host comes from X-Forwarded-Host
+ * without a port, the port from X-Forwarded-Port is added.
 */
-export function getHost(req: express.Request): string | undefined {
+export function getHost(req: express.Request, withForwardedPort = false): string | undefined {
  // Honor Forwarded if present.
  const forwardedRaw = getFirstHeader(req, "forwarded")
  if (forwardedRaw) {
@@ -430,7 +489,8 @@ export function getHost(req: express.Request): string | undefined {
  if (xHost) {
    const firstXHost = xHost.split(",")[0]
    if (firstXHost) {
-      return firstXHost.trim().toLowerCase()
+      const host = firstXHost.trim().toLowerCase()
+      return withForwardedPort ? addForwardedPort(req, host) : host
    }
  }

--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -132,8 +132,10 @@ export const register = async (
    })
  })

-  app.router.use(express.json())
-  app.router.use(express.urlencoded({ extended: true }))
+  // Reject compressed request bodies so unauthenticated requests cannot reach
+  // the zlib/Brotli decoders. Browsers never compress request bodies.
+  app.router.use(express.json({ inflate: false }))
+  app.router.use(express.urlencoded({ extended: true, inflate: false }))

  app.router.use(
    "/_static",
--- a/src/node/util.ts
+++ b/src/node/util.ts
@@ -511,3 +511,18 @@ export function splitOnFirstEquals(str: string): [string, string | undefined] {
  const split = str.split(/=(.+)?/, 2)
  return [split[0], split[1]]
 }
+
+/**
+ * Expand a leading `~` to the home directory.  The shell does this for
+ * command-line arguments but values from the config file are not expanded.
+ * `~user` forms are left alone.
+ */
+export function expandTilde(p: string): string {
+  if (p === "~") {
+    return os.homedir()
+  }
+  if (p.startsWith("~/") || p.startsWith(`~${path.sep}`)) {
+    return path.join(os.homedir(), p.slice(2))
+  }
+  return p
+}
--- a/src/node/vscodeSocket.ts
+++ b/src/node/vscodeSocket.ts
@@ -38,7 +38,7 @@ export async function makeEditorSessionManagerServer(
 ): Promise<http.Server> {
  const router = express()

-  router.use(express.json())
+  router.use(express.json({ inflate: false }))

  router.get<{}, GetSessionResponse | string | unknown, undefined, { filePath?: string }>(
    "/session",
--- a/test/unit/node/cli.test.ts
+++ b/test/unit/node/cli.test.ts
@@ -1,5 +1,6 @@
 import { Level, logger } from "@coder/logger"
 import { promises as fs } from "fs"
+import * as os from "os"
 import * as path from "path"
 import {
  UserProvidedArgs,
@@ -575,6 +576,17 @@ describe("parser", () => {
      "install-extension": ["extension.number1", "extension.number2"],
    })
  })
+  it("should expand ~ in path options from the config file", () => {
+    const configContents = `
+      user-data-dir: ~/.config/code-server-data
+      extensions-dir: ~/extensions
+    `
+    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
+      config: "/fake-config-path",
+      "user-data-dir": path.join(os.homedir(), ".config/code-server-data"),
+      "extensions-dir": path.join(os.homedir(), "extensions"),
+    })
+  })
  it("should ignore optional strings set to false", async () => {
    expect(parse(["--cert=false"])).toEqual({})
  })
--- a/test/unit/node/http.test.ts
+++ b/test/unit/node/http.test.ts
@@ -68,6 +68,43 @@ describe("http", () => {
        host: "localhost:8081",
        expected: "does not match",
      },
+      {
+        origin: "https://example.com",
+        host: "example.com:443", // Explicit default port.
+      },
+      {
+        origin: "http://example.com",
+        host: "example.com:80",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:80", // Default port of the other protocol.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com:8080",
+        host: "example.com", // Missing port is not ignored.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:8443",
+        expected: "does not match",
+      },
+      {
+        origin: "http://example.com:8080",
+        host: "other.com",
+        expected: "does not match",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8080",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8081",
+        expected: "does not match",
+      },
      {
        origin: "localhost:8080",
        host: "localhost:8080",
@@ -122,6 +159,104 @@ describe("http", () => {
        })
      })
    })
+
+    describe("x-forwarded-port", () => {
+      ;[
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "443" },
+        },
+        {
+          origin: "http://[::1]:8080",
+          headers: { "x-forwarded-host": "[::1]", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080, 443" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8081" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com:8081", "x-forwarded-port": "8080" },
+          expected: "does not match", // The port in the host wins.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "foo" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { host: "example.com", "x-forwarded-port": "8080" },
+          expected: "does not match", // Only used with X-Forwarded-Host.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { forwarded: "host=example.com", "x-forwarded-port": "8080" },
+          expected: "does not match",
+        },
+      ].forEach((test) => {
+        it(`${test.origin} -> ${JSON.stringify(test.headers)}`, () => {
+          const req = getMockReq({
+            originalUrl: "localhost:8080",
+            headers: {
+              origin: test.origin,
+              ...test.headers,
+            },
+            args: {},
+          })
+          if (typeof test.expected === "string") {
+            expect(() => http.authenticateOrigin(req)).toThrow(test.expected)
+          } else {
+            expect(() => http.authenticateOrigin(req)).not.toThrow()
+          }
+        })
+      })
+
+      it("should not add the port to the host for other uses", () => {
+        const req = getMockReq({
+          headers: { "x-forwarded-host": "code-8080.example.com", "x-forwarded-port": "443" },
+        })
+        expect(http.getHost(req)).toBe("code-8080.example.com")
+      })
+    })
+  })
+
+  describe("getCookieDomain", () => {
+    it("should use the proxy domain for the cookie", () => {
+      const proxyDomains = ["{{port}}.example.com", "code-{{port}}.test.com"]
+      expect(http.getCookieDomain("example.com", proxyDomains)).toBe("example.com")
+      expect(http.getCookieDomain("8080.example.com", proxyDomains)).toBe("example.com")
+      expect(http.getCookieDomain("8080.example.com:443", proxyDomains)).toBe("example.com")
+      expect(http.getCookieDomain("code-8080.test.com", proxyDomains)).toBe("test.com")
+    })
+
+    it("should use the highest level proxy domain", () => {
+      const proxyDomains = ["{{port}}.test.example.com", "{{port}}.example.com"]
+      expect(http.getCookieDomain("test.example.com", proxyDomains)).toBe("example.com")
+      expect(http.getCookieDomain("8080.test.example.com", proxyDomains)).toBe("example.com")
+    })
+
+    it("should use the host when no proxy domain matches", () => {
+      expect(http.getCookieDomain("code.other.com", ["{{port}}.example.com"])).toBe("code.other.com")
+      expect(http.getCookieDomain("8080.example.com", ["{{port}}.{{host}}"])).toBe("8080.example.com")
+      expect(http.getCookieDomain("8080.example.com", [])).toBe("8080.example.com")
+    })
+
+    it("should not set a domain for localhost or IP addresses", () => {
+      const proxyDomains = ["{{port}}.example.com"]
+      expect(http.getCookieDomain("localhost:8080", proxyDomains)).toBe(undefined)
+      expect(http.getCookieDomain("127.0.0.1:8080", proxyDomains)).toBe(undefined)
+      expect(http.getCookieDomain("8080.dev.localhost", proxyDomains)).toBe(undefined)
+    })
  })

  describe("constructRedirectPath", () => {
--- a/test/unit/node/i18n.test.ts
+++ b/test/unit/node/i18n.test.ts
@@ -1,13 +1,9 @@
 import { promises as fs } from "fs"
 import * as os from "os"
 import * as path from "path"
-import i18n, { loadCustomStrings } from "../../../src/node/i18n"
+import { loadCustomStrings } from "../../../src/node/i18n"

 describe("i18n", () => {
-  it("includes Turkish translations", () => {
-    expect(i18n.getResource("tr", "translation", "WELCOME")).toBe("{{app}} uygulamasına hoş geldiniz")
-  })
-
  let tempDir: string
  let validJsonFile: string
  let invalidJsonFile: string
--- a/test/unit/node/routes/login.test.ts
+++ b/test/unit/node/routes/login.test.ts
@@ -75,6 +75,17 @@ describe("login", () => {
      expect(htmlContent).toContain("Missing password")
    })

+    it("should reject compressed request bodies", async () => {
+      for (const encoding of ["br", "gzip", "deflate"]) {
+        const resp = await codeServer().fetch("/login", {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Encoding": encoding },
+          body: "password=test",
+        })
+        expect(resp.status).toBe(415)
+      }
+    })
+
    it("should return HTML with 'Incorrect password' message", async () => {
      const params = new URLSearchParams()
      params.append("password", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
--- a/test/unit/node/util.test.ts
+++ b/test/unit/node/util.test.ts
@@ -1,5 +1,6 @@
 import * as cp from "child_process"
 import { promises as fs } from "fs"
+import * as os from "os"
 import * as path from "path"
 import { generateUuid } from "../../../src/common/util"
 import { tmpdir } from "../../../src/node/constants"
@@ -623,3 +624,18 @@ describe("splitOnFirstEquals", () => {
    })
  })
 })
+
+describe("expandTilde", () => {
+  it("should expand a bare ~", () => {
+    expect(util.expandTilde("~")).toBe(os.homedir())
+  })
+  it("should expand a leading ~/", () => {
+    expect(util.expandTilde("~/.config/code-server")).toBe(path.join(os.homedir(), ".config/code-server"))
+  })
+  it("should leave other paths alone", () => {
+    expect(util.expandTilde("/tmp/~/data")).toBe("/tmp/~/data")
+    expect(util.expandTilde("relative/~")).toBe("relative/~")
+    expect(util.expandTilde("~user/data")).toBe("~user/data")
+    expect(util.expandTilde("")).toBe("")
+  })
+})
Author	SHA1	Message	Date
dependabot[bot]	6b77fe3666	Bump @eslint/compat from 1.4.1 to 2.1.1 Bumps [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) from 1.4.1 to 2.1.1. - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/compat-v2.1.1/packages/compat) --- updated-dependencies: - dependency-name: "@eslint/compat" dependency-version: 2.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-28 22:28:26 +00:00
Harsh Bhanushali	70fc911358	Override basic-ftp to ^6.2.1 (#8086 ) get-uri still depends on basic-ftp ^5.x, which has no patched release.	2026-10-28 14:25:45 -08:00
Raphael Fakhri	761b0d2a19	Fix cookie domain not being set against root host (#8076 )	2026-10-27 13:05:56 -08:00
Vincent Coffey	09012065c9	Support load balancer service in Helm chart (#8081 )	2026-10-27 11:58:13 -08:00
dependabot[bot]	e999549684	Bump follow-redirects from 1.16.0 to 1.16.2 (#8065 )	2026-10-27 11:51:39 -08:00
dependabot[bot]	9d0eee156e	Bump ip-address from 10.7.2 to 10.7.5 (#8080 )	2026-10-26 17:01:48 -08:00
dependabot[bot]	b87ae88bc6	Bump body-parser from 2.3.0 to 2.4.0 (#8079 )	2026-10-26 17:01:24 -08:00
Harsh Bhanushali	89cba83cb4	Normalize default ports and use X-Forwarded-Port in the origin check (#8059 ) The origin check compared the host header to the origin's host as plain strings, so `example.com:443` did not match `https://example.com`, and a proxy forwarding `$host` (no port) together with X-Forwarded-Port failed on any non-default port. Default ports (80 for http, 443 for https) are now treated as no port, and when X-Forwarded-Host has no port the port from X-Forwarded-Port is used. Everything else is still an exact match. getHost() is unchanged for the domain proxy.	2026-10-26 16:42:24 -08:00
dependabot[bot]	b45f29491d	Bump js-yaml from 4.3.1 to 5.4.3 (#8054 )	2026-10-26 15:47:26 -08:00
cdrci	4677c9d865	Update Helm chart and changelog with 4.143.1 (#8072 )	2026-10-23 15:32:11 -08:00
cdrci	22ddf60dbc	Update Code to 1.143.1 (#8069 ) * Remove Node patch * Update patches Just one conflict, they use user-data-dir now which is something we already have been doing for a long time.	2026-10-23 22:15:00 +00:00
cdrci	e777c1f963	Update Helm chart and changelog with 4.141.1 (#8071 )	2026-10-23 13:49:22 -08:00
Dean Sheather	279b5702aa	Merge pull request #8070 from coder/upgrade-node-checksums Fix Node 24.22.1 checksums	2026-10-24 04:50:00 +11:00
Dean Sheather	27baccf843	Fix Node 24.22.1 checksums	2026-10-23 17:35:56 +00:00
Dean Sheather	8aab1b0d72	Merge pull request #8068 from coder/upgrade-node Upgrade Node to 24.22.1	2026-10-24 02:35:35 +11:00
Dean Sheather	777c493a9b	Upgrade Node to 24.22.1	2026-10-23 15:06:41 +00:00
Harsh Bhanushali	f07405cba3	Expand ~ in path options from the config file (#8055 ) The shell expands ~ in command-line arguments, but values read from config.yaml were passed to path.resolve as-is, so `user-data-dir: ~/.config/code-server-data` resolved to `<cwd>/~/.config/code-server-data`.	2026-10-14 13:47:08 -08:00
@@ -1 +1 @@
 .21.0
 .22.1