Update Code to 1.140.0 (#8037 )

Document that Cloudflare Rocket Loader must be disabled (#8026 )
Bump ip-address from 10.4.0 to 10.7.2 (#8023 )
2026-11-03 06:19:13 +01:00 · 2026-10-01 12:42:33 -08:00 · 2026-09-30 14:55:09 -08:00 · 2026-09-29 14:54:16 -08:00 · 2026-09-29 14:53:43 -08:00 · 2026-09-28 14:45:26 -08:00
10 changed files with 53 additions and 16 deletions
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.20.0
+24.21.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,14 @@ Code v99.99.999

 ## Unreleased

+Code v1.140.0
+
+### Changed
+
+- Update to Code 1.140.0
+
+## [4.139.1](https://github.com/coder/code-server/releases/tag/v4.139.1) - 2026-09-26
+
 Code v1.139.1

 ### Changed
--- a/ci/helm-chart/Chart.yaml
+++ b/ci/helm-chart/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.53.0
+version: 3.54.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.138.0
+appVersion: 4.139.1
--- a/ci/helm-chart/values.yaml
+++ b/ci/helm-chart/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: codercom/code-server
-  tag: '4.138.0'
+  tag: '4.139.1'
  pullPolicy: Always

 # Specifies one or more secrets to be used when pulling images from a
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -9,6 +9,7 @@
  - [Using Let's Encrypt with NGINX](#using-lets-encrypt-with-nginx)
  - [Using a self-signed certificate](#using-a-self-signed-certificate)
  - [TLS 1.3 and Safari](#tls-13-and-safari)
+  - [Cloudflare Rocket Loader](#cloudflare-rocket-loader)
 - [External authentication](#external-authentication)
 - [HTTPS and self-signed certificates](#https-and-self-signed-certificates)
 - [Accessing web services](#accessing-web-services)
@@ -269,6 +270,26 @@ than TLS 1.3 you will need to add support for TLS 1.2 since Safari does not
 support TLS 1.3 for web sockets at the time of writing. If this is the case you
 should see OSSStatus: 9836 in the browser console.

+### Cloudflare Rocket Loader
+
+If you serve code-server through Cloudflare, disable Rocket Loader for that
+hostname. Rocket Loader rewrites inline `<script>` tags at the edge and
+re-injects them from its own loader, and the re-injected scripts do not carry
+the nonce in code-server's Content Security Policy, so the browser blocks them.
+The result is a blank page: every request returns HTTP 200 and the server logs
+look healthy, and the only console output is `Cannot determine URI for module
+id!`.
+
+Scope it with a Configuration Rule rather than turning it off zone-wide:
+
+```
+Expression: (http.host eq "code.example.com")
+Setting:    Rocket Loader -> Off
+```
+
+Adding `'unsafe-inline'` to the policy does not help, because CSP ignores it
+whenever a nonce or hash is present.
+
 ## External authentication

 If you want to use external authentication mechanism (e.g., Sign in with
--- a/docs/helm.md
+++ b/docs/helm.md
@@ -1,6 +1,6 @@
 # code-server Helm Chart

-[![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square)](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.8.0](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)
+[![Version: 3.54.0](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square)](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.139.1](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)

 [code-server](https://github.com/coder/code-server) code-server is VS Code running
 on a remote server, accessible through the browser.
@@ -62,10 +62,12 @@ and their default values.
 | Key                                         | Type   | Default                  |
 | ------------------------------------------- | ------ | ------------------------ |
 | affinity                                    | object | `{}`                     |
+| annotations                                 | object | `{}`                     |
 | extraArgs                                   | list   | `[]`                     |
 | extraConfigmapMounts                        | list   | `[]`                     |
 | extraContainers                             | string | `""`                     |
 | extraInitContainers                         | string | `""`                     |
+| extraPorts                                  | list   | `[]`                     |
 | extraSecretMounts                           | list   | `[]`                     |
 | extraVars                                   | list   | `[]`                     |
 | extraVolumeMounts                           | list   | `[]`                     |
@@ -73,26 +75,32 @@ and their default values.
 | hostnameOverride                            | string | `""`                     |
 | image.pullPolicy                            | string | `"Always"`               |
 | image.repository                            | string | `"codercom/code-server"` |
-| image.tag                                   | string | `"4.8.0"`                |
+| image.tag                                   | string | `"4.139.1"`              |
 | imagePullSecrets                            | list   | `[]`                     |
 | ingress.enabled                             | bool   | `false`                  |
+| ingress.ingressClassName                    | string | `""`                     |
+| lifecycle.enabled                           | bool   | `false`                  |
+| livenessProbe.enabled                       | bool   | `true`                   |
 | nameOverride                                | string | `""`                     |
 | nodeSelector                                | object | `{}`                     |
 | persistence.accessMode                      | string | `"ReadWriteOnce"`        |
 | persistence.annotations                     | object | `{}`                     |
 | persistence.enabled                         | bool   | `true`                   |
-| persistence.size                            | string | `"1Gi"`                  |
+| persistence.size                            | string | `"10Gi"`                 |
 | podAnnotations                              | object | `{}`                     |
 | podSecurityContext                          | object | `{}`                     |
+| priorityClassName                           | string | `""`                     |
+| readinessProbe.enabled                      | bool   | `true`                   |
 | replicaCount                                | int    | `1`                      |
 | resources                                   | object | `{}`                     |
 | securityContext.enabled                     | bool   | `true`                   |
 | securityContext.fsGroup                     | int    | `1000`                   |
 | securityContext.runAsUser                   | int    | `1000`                   |
-| service.port                                | int    | `8443`                   |
+| service.port                                | int    | `8080`                   |
 | service.type                                | string | `"ClusterIP"`            |
+| serviceAccount.annotations                  | object | `{}`                     |
 | serviceAccount.create                       | bool   | `true`                   |
-| serviceAccount.name                         | string | `nil`                    |
+| serviceAccount.name                         | string | `""`                     |
 | tolerations                                 | list   | `[]`                     |
 | volumePermissions.enabled                   | bool   | `true`                   |
 | volumePermissions.securityContext.runAsUser | int    | `0`                      |
@@ -114,7 +122,7 @@ can be provided while installing the chart. For example,
 $ helm upgrade --install code-server ci/helm-chart -f values.yaml
 ```

-> **Tip**: You can use the default [values.yaml](values.yaml)
+> **Tip**: You can use the default [values.yaml](../ci/helm-chart/values.yaml)

 # Extra Containers

--- a/lib/vscode
+++ b/lib/vscode
--- a/package-lock.json
+++ b/package-lock.json
@@ -3697,9 +3697,9 @@
      }
    },
    "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
      "license": "MIT",
      "engines": {
        "node": ">= 12"
--- a/patches/base-path.diff
+++ b/patches/base-path.diff
@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -251,7 +251,9 @@ class RemoteAuthoritiesImpl {
+@@ -256,7 +256,9 @@ class RemoteAuthoritiesImpl {
 		return URI.from({
 			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
 			authority: `${host}:${port}`,
--- a/patches/store-socket.diff
+++ b/patches/store-socket.diff
@@ -31,7 +31,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostExtensionService.
 import { ExtHostDiskFileSystemProvider } from './extHostDiskFileSystemProvider.js';
 import nodeModule from 'node:module';
 import { assertType } from '../../../base/common/types.js';
-@@ -175,6 +177,52 @@ export class ExtHostExtensionService ext
+@@ -176,6 +178,52 @@ export class ExtHostExtensionService ext
 
 		performance.mark('code/extHost/didInitAPI');
Author	SHA1	Message	Date
cdrci	ccc19adc2e	Update Code to 1.140.0 (#8037 )	2026-10-01 12:42:33 -08:00
Steven	f871c1663b	Document that Cloudflare Rocket Loader must be disabled (#8026 )	2026-09-30 14:55:09 -08:00
dependabot[bot]	fa7caee4dd	Bump ip-address from 10.4.0 to 10.7.2 (#8023 )	2026-09-29 14:54:16 -08:00
Zain Qureshi	2bb012c17a	Sync Helm docs table and badges with the chart (#8024 )	2026-09-29 14:53:43 -08:00
cdrci	96e468eaa6	Update Helm chart and changelog with 4.139.1 (#8022 )	2026-09-28 14:45:26 -08:00
@@ -1 +1 @@
 .20.0
 .21.0