Bump @eslint/compat from 1.4.1 to 2.1.1

Bumps [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) from 1.4.1 to 2.1.1.
- [Release notes](https://github.com/eslint/rewrite/releases)
- [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md)
- [Commits](https://github.com/eslint/rewrite/commits/compat-v2.1.1/packages/compat)

---
updated-dependencies:
- dependency-name: "@eslint/compat"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/security.yaml

@@ -89,4 +89,4 @@ jobs:
         uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

CHANGELOG.md

@@ -22,28 +22,6 @@ Code v99.99.999
 
 ## Unreleased
 
-## [4.144.0](https://github.com/coder/code-server/releases/tag/v4.144.0) - 2026-10-29
-
-Code v1.144.0
-
-### Changed
-
-- Update to Code 1.144.0
-
-### Fixed
-
-- `--socket-fd` now works: the inherited socket is passed on to the process
-  that listens, and the address is logged as `fd:<n>`. Previously code-server
-  failed with `listen EEXIST` or `Server has no address`.
-- The cookie domain was not being set against the shared root host of proxy
-  domains when proxy domains contained template variables like `{{port}}`,
-  resulting in having to sign in multiple times per domain instead of only once
-  as originally intended.
-- When doing the web socket origin check, if the host does not already contain a
-  port, fall back to `X-Forwarded-Port`.
-- Fix default ports not matching in the web socket origin check (for example
-  `https://coder.com` will now match `https://coder.com:443`).
-
 ## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
 
 Code v1.143.1

ci/build/update-vscode.sh

@@ -101,14 +101,6 @@ function update_csp() {
     echo "Calculated hash as $hash"
     # Use octothorpe as a delimiter since the hash may contain a slash.
     sed -i.bak "s#'sha256-[^']\+'#'sha256-$hash'#" "$file"
-    # For the web worker extension host iframe, there is a matching sha in the
-    # web server.
-    if [[ $file == */webWorkerExtensionHostIframe.html ]] ; then
-      quilt add ./lib/vscode/src/vs/server/node/webClientServer.ts
-      sed -i.bak \
-          "s#webWorkerExtensionHostIframeScriptSHA = 'sha256-[^']\+'#webWorkerExtensionHostIframeScriptSHA = 'sha256-$hash'#" \
-          ./lib/vscode/src/vs/server/node/webClientServer.ts
-    fi
   done
 
   quilt refresh

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.58.0
+version: 3.57.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.144.0
+appVersion: 4.143.1

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.144.0'
+  tag: '4.143.1'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a

package-lock.json

@@ -35,7 +35,7 @@
         "code-server": "out/node/entry.js"
       },
       "devDependencies": {
-        "@eslint/compat": "^1.2.0",
+        "@eslint/compat": "^2.1.1",
         "@eslint/eslintrc": "^3.1.0",
         "@eslint/js": "^9.12.0",
         "@types/compression": "^1.7.3",
@@ -170,19 +170,19 @@
       }
     },
     "node_modules/@eslint/compat": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.1.tgz",
-      "integrity": "sha512-cfO82V9zxxGBxcQDr1lfaYB7wykTa0b00mGa36FrJl7iTFd0Z2cHfEYuxcBRP/iNijCsWsEkA+jzT8hGYmv33w==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.1.tgz",
+      "integrity": "sha512-rMcy8GSrwNzcISX/BlTDY/GLB4eCopEuy9woIls3To+15OLxykZrxxq+WUcylCPCQ6F4MujjBM1DX5V1aqI3Vw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^0.17.0"
+        "@eslint/core": "^1.2.1"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "peerDependencies": {
-        "eslint": "^8.40 || 9"
+        "eslint": "^8.40 || 9 || 10"
       },
       "peerDependenciesMeta": {
         "eslint": {
@@ -190,6 +190,19 @@
         }
       }
     },
+    "node_modules/@eslint/compat/node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@eslint/config-array": {
       "version": "0.21.1",
       "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",

package.json

@@ -36,7 +36,7 @@
   },
   "main": "out/node/entry.js",
   "devDependencies": {
-    "@eslint/compat": "^1.2.0",
+    "@eslint/compat": "^2.1.1",
     "@eslint/eslintrc": "^3.1.0",
     "@eslint/js": "^9.12.0",
     "@types/compression": "^1.7.3",

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -262,7 +262,9 @@ class RemoteAuthoritiesImpl {
+@@ -256,7 +256,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,

patches/copilot.diff

@@ -2,7 +2,7 @@ Index: code-server/lib/vscode/build/gulpfile.extensions.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
 +++ code-server/lib/vscode/build/gulpfile.extensions.ts
-@@ -283,6 +283,29 @@ export const compileCopilotExtensionBuil
+@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
  task.task(compileCopilotExtensionBuildTask);
  
  /**

patches/csp-hashes.diff

@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-Q3Tfcw0dGu/YD4dGBrRqBeOnmRMAH8HbKxArK4YSXBc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-BmcTt6YZr75RujSQ3gF/UQL77e1RrOx62jNeikpwtxc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-7cKy9iQfWRXcgRS74x6I4q5cRDkv8nQz51jecqMmQ5w=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-FYdHnaDkSHwSK3TmWDrs/tT+X4bK+aaoa9yy432BONk=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"
@@ -24,16 +24,3 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWor
  			connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
  	</head>
  	<body>
-Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-===================================================================
---- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
-+++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -114,7 +114,7 @@ const APP_ROOT = dirname(FileAccess.asFi
- const STATIC_PATH = `/static`;
- const CALLBACK_PATH = `/callback`;
- const WEB_EXTENSION_PATH = `/web-extension-resource`;
--const webWorkerExtensionHostIframeScriptSHA = 'sha256-daEgfo2VIXpx2Np71KqCCbkeQwv+68vPrx54XRcbdcs=';
-+const webWorkerExtensionHostIframeScriptSHA = 'sha256-gfjiOVjAlxqrivZAfTq2d83mOaz0fnAxbGaFpj5IjD8=';
- 
- /**
-  * Substitutes the `{{...}}` placeholders of a workbench template. Placeholders must only ever

patches/getting-started.diff

@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { renderFormattedText } from '../../../../base/browser/formattedTextRenderer.js';
  import { status } from '../../../../base/browser/ui/aria/aria.js';
  import { StandardKeyboardEvent } from '../../../../base/browser/keyboardEvent.js';
-@@ -56,7 +56,7 @@ import { IRecentFolder, IRecentWorkspace
+@@ -55,7 +55,7 @@ import { IRecentFolder, IRecentWorkspace
  import { OpenRecentAction } from '../../../browser/actions/windowActions.js';
  import { OpenFileFolderAction, OpenFolderAction, OpenFolderViaWorkspaceAction } from '../../../browser/actions/workspaceActions.js';
  import { EditorPane } from '../../../browser/parts/editor/editorPane.js';
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -944,6 +944,72 @@ export class GettingStartedPage extends
+@@ -930,6 +930,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -1000,6 +1066,9 @@ export class GettingStartedPage extends
+@@ -980,6 +1046,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}

patches/integration.diff

@@ -169,7 +169,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -65,6 +65,7 @@ import { IOpenerService } from '../../pl
+@@ -64,6 +64,7 @@ import { IOpenerService } from '../../pl
  import { mixin, safeStringify } from '../../base/common/objects.js';
  import { IndexedDB } from '../../base/browser/indexedDB.js';
  import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js';
@@ -177,7 +177,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -141,6 +142,9 @@ export class BrowserMain extends Disposa
+@@ -140,6 +141,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
  

patches/marketplace.diff

@@ -77,7 +77,7 @@ Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/ext
  import { TargetPlatform } from '../../extensions/common/extensions.js';
  import { ExtensionGalleryResourceType, getExtensionGalleryManifestResourceUri, IExtensionGalleryManifest, IExtensionGalleryManifestService } from '../../extensionManagement/common/extensionGalleryManifest.js';
  import { ILogService } from '../../log/common/log.js';
-@@ -167,9 +166,9 @@ export abstract class AbstractExtensionR
+@@ -163,9 +162,9 @@ export abstract class AbstractExtensionR
  	}
  
  	protected _isWebExtensionResourceEndPoint(uri: URI): boolean {

patches/proposed-api.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/common/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
-@@ -324,6 +324,10 @@ function extensionDescriptionArrayToMap(
+@@ -321,6 +321,10 @@ function extensionDescriptionArrayToMap(
  }
  
  export function isProposedApiEnabled(extension: IExtensionDescription, proposal: ApiProposalName): boolean {

patches/remote-storage.diff

@@ -179,7 +179,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -34,6 +34,7 @@ import { ISignService } from '../../plat
+@@ -33,6 +33,7 @@ import { ISignService } from '../../plat
  import { SignService } from '../../platform/sign/browser/signService.js';
  import { IWorkbenchConstructionOptions, IWorkbench, IWorkspace, ITunnel } from './web.api.js';
  import { BrowserStorageService } from '../services/storage/browser/storageService.js';
@@ -187,7 +187,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IStorageService } from '../../platform/storage/common/storage.js';
  import { toLocalISOString } from '../../base/common/date.js';
  import { isWorkspaceToOpen, isFolderToOpen } from '../../platform/window/common/window.js';
-@@ -488,7 +489,7 @@ export class BrowserMain extends Disposa
+@@ -482,7 +483,7 @@ export class BrowserMain extends Disposa
  				serviceCollection.set(IWorkbenchConfigurationService, service);
  				return service;
  			}),
@@ -196,7 +196,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  				serviceCollection.set(IStorageService, service);
  				return service;
  			})
-@@ -610,7 +611,21 @@ export class BrowserMain extends Disposa
+@@ -604,7 +605,21 @@ export class BrowserMain extends Disposa
  		}));
  	}
  

src/node/app.ts

@@ -111,14 +111,9 @@ export const createApp = async (args: DefaultedArgs): Promise<App> => {
  *
  * The address might be a URL or it might be a pipe or socket path.
  */
-export const ensureAddress = (server: http.Server, protocol: string, socketFd?: number): URL | string => {
+export const ensureAddress = (server: http.Server, protocol: string): URL | string => {
   const addr = server.address()
 
-  // Node reports no address for a Unix socket adopted by fd.
-  if (!addr && typeof socketFd === "number") {
-    return `fd:${socketFd}`
-  }
-
   if (!addr) {
     throw new Error("Server has no address")
   }

src/node/main.ts

@@ -141,7 +141,7 @@ export const runCodeServer = async (
 
   const app = await createApp(args)
   const protocol = args.cert ? "https" : "http"
-  const serverAddress = ensureAddress(app.server, protocol, args["socket-fd"])
+  const serverAddress = ensureAddress(app.server, protocol)
   const { disposeRoutes, heart } = await register(app, args)
 
   logger.info(`Using config file ${args.config}`)

src/node/wrapper.ts

@@ -8,9 +8,6 @@ import { paths } from "./util"
 
 const timeoutInterval = 10000 // 10s, matches VS Code's timeouts.
 
-// Fd 3 in the child is the IPC channel, so the inherited socket goes to fd 4.
-const CHILD_SOCKET_FD = 4
-
 /**
  * Listen to a single message from a process. Reject if the process errors,
  * exits, or times out.
@@ -337,14 +334,13 @@ export class ParentProcess extends Process {
   }
 
   private spawn(): cp.ChildProcess {
-    const socketFd = this.args?.["socket-fd"]
     return cp.fork(path.join(__dirname, "entry"), {
       env: {
         ...process.env,
         CODE_SERVER_PARENT_PID: process.pid.toString(),
         NODE_EXEC_PATH: process.execPath,
       },
-      stdio: typeof socketFd === "number" ? ["pipe", "pipe", "pipe", "ipc", socketFd] : ["pipe", "pipe", "pipe", "ipc"],
+      stdio: ["pipe", "pipe", "pipe", "ipc"],
     })
   }
 
@@ -363,8 +359,7 @@ export class ParentProcess extends Process {
       this.logger,
     )
     this.logger.debug("got message", field("message", message))
-    const args = typeof this.args["socket-fd"] === "number" ? { ...this.args, "socket-fd": CHILD_SOCKET_FD } : this.args
-    this.send(child, { type: "handshake", args })
+    this.send(child, { type: "handshake", args: this.args })
   }
 
   /**

test/integration/socketFd.test.ts

@@ -1,80 +0,0 @@
-import { ChildProcess, spawn } from "child_process"
-import { promises as fs } from "fs"
-import * as http from "http"
-import * as net from "net"
-import * as path from "path"
-import { clean, tmpdir } from "../utils/helpers"
-
-describe("--socket-fd", () => {
-  const testName = "socketFd"
-  const codeServerPath = process.env.CODE_SERVER_PATH || path.resolve("../../release-standalone/bin/code-server")
-  let tempDir: string
-  let socketDir: string | undefined
-  let child: ChildProcess | undefined
-
-  beforeEach(async () => {
-    await clean(testName)
-    tempDir = await tmpdir(testName)
-  })
-
-  afterEach(async () => {
-    if (child?.pid && child.exitCode === null) {
-      // Kill the process group so that the wrapper's inner process also stops.
-      process.kill(-child.pid, "SIGKILL")
-    }
-    if (socketDir) {
-      await fs.rm(socketDir, { force: true, recursive: true })
-      socketDir = undefined
-    }
-  })
-
-  // Give the listener to code-server as fd 3, as systemd socket activation does.
-  const getHealthzThroughFd = async (server: net.Server, target: http.RequestOptions): Promise<number> => {
-    const fd: number = (server as any)._handle.fd
-    let output = ""
-    child = spawn(
-      codeServerPath,
-      [
-        "--socket-fd=3",
-        "--auth=none",
-        `--user-data-dir=${path.join(tempDir, "data")}`,
-        `--config=${path.join(tempDir, "config.yaml")}`,
-      ],
-      { detached: true, stdio: ["ignore", "pipe", "pipe", fd] },
-    )
-    child.stdout?.on("data", (chunk) => (output += chunk))
-    child.stderr?.on("data", (chunk) => (output += chunk))
-    await new Promise((resolve) => server.close(resolve))
-
-    const exited = new Promise<never>((_, reject) => {
-      child?.once("exit", (code) => reject(new Error(`code-server exited with code ${code}:\n${output}`)))
-    })
-    const status = new Promise<number>((resolve, reject) => {
-      http
-        .get({ ...target, path: "/healthz" }, (res) => {
-          res.resume()
-          resolve(res.statusCode ?? 0)
-        })
-        .once("error", (error) => reject(new Error(`${error.message}:\n${output}`)))
-    })
-    return Promise.race([status, exited])
-  }
-
-  it("should serve requests on a Unix socket passed as a file descriptor", async () => {
-    // macOS limits socket paths to 104 bytes, and os.tmpdir() can be too long.
-    socketDir = await fs.mkdtemp("/tmp/cs-fd-")
-    const server = net.createServer()
-    await new Promise<void>((resolve) => server.listen(path.join(socketDir!, "listen.sock"), resolve))
-    // server.close() unlinks the socket path, so connect through a hard link.
-    const socketPath = path.join(socketDir, "connect.sock")
-    await fs.link(path.join(socketDir, "listen.sock"), socketPath)
-    expect(await getHealthzThroughFd(server, { socketPath })).toBe(200)
-  }, 60000)
-
-  it("should serve requests on a TCP socket passed as a file descriptor", async () => {
-    const server = net.createServer()
-    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
-    const { port } = server.address() as net.AddressInfo
-    expect(await getHealthzThroughFd(server, { host: "127.0.0.1", port })).toBe(200)
-  }, 60000)
-})

test/unit/node/app.test.ts

@@ -152,9 +152,6 @@ describe("ensureAddress", () => {
   it("should throw and error if no address", () => {
     expect(() => ensureAddress(mockServer, "http")).toThrow("Server has no address")
   })
-  it("should describe a --socket-fd listener by its fd when node reports no address", () => {
-    expect(ensureAddress(mockServer, "http", 4)).toBe("fd:4")
-  })
   it("should return the address if it's a string", async () => {
     mockServer.address = () => "/path/to/unix.sock"
     const address = ensureAddress(mockServer, "http")