Update Code to 1.136.2

.github/workflows/build.yaml

@@ -27,7 +27,7 @@ jobs:
       helm: ${{ steps.filter.outputs.helm }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |

.github/workflows/publish.yaml

@@ -110,7 +110,7 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:

.github/workflows/release.yaml

@@ -196,152 +196,3 @@ jobs:
           files: ./release-packages/*
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}
-
-  package-windows:
-    name: win32-x64
-    runs-on: windows-2022
-    if: >-
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/'))
-
-    defaults:
-      run:
-        shell: bash
-
-    env:
-      VSCODE_TARGET: win32-x64
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }}
-      # Ensure native modules are built from source to avoid prebuilds.
-      npm_config_build_from_source: true
-      OS: windows
-
-    steps:
-      # Git rewrites line endings on windows by default, which turns every
-      # shell script the build is made of into one bash cannot read, and
-      # every name in patches/series into one with a stray return.
-      - name: Keep line endings as they are in the repository
-        run: git config --global core.autocrlf false
-
-      - name: Strip update/ and v from tag and set major version
-        run: |
-          version=${TAG#update/}
-          version=${version#v}
-          version=4${version:1}
-          echo "VERSION=$version" >> $GITHUB_ENV
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          submodules: true
-
-      # quilt has no windows build. The patches are ordinary -p1 diffs
-      # against the repository root, so git applies them in series order.
-      - name: Apply patches
-        run: |
-          while read -r patch; do
-            case "$patch" in '' | '#'*) continue ;; esac
-            echo "applying $patch"
-            git apply --whitespace=nowarn "patches/$patch"
-          done < patches/series
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-
-      # npm hands every script it runs to cmd, which cannot run the shell
-      # scripts this repository is built out of. Point it at the same bash
-      # the steps here use rather than at a path, which moves between
-      # images.
-      - name: Let npm run shell scripts
-        run: echo "npm_config_script_shell=$(cygpath -w "$(command -v bash)")" >> $GITHUB_ENV
-
-      # The build merges json by handing jq a process substitution, which
-      # bash presents as a file under /dev/fd. The jq on this image is a
-      # windows program and cannot open those, so it reads the second input
-      # as nothing and the merge fails. Both the product and the package
-      # merge go through here.
-      - name: Let jq read what bash hands it
-        run: |
-          mkdir -p "$RUNNER_TEMP/shim"
-          cat > "$RUNNER_TEMP/shim/jq" <<'SHIM'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          args=()
-          for arg in "$@"; do
-            case $arg in
-              /dev/fd/* | /proc/*/fd/*)
-                copy=$(mktemp)
-                cat "$arg" > "$copy"
-                args+=("$copy")
-                ;;
-              *) args+=("$arg") ;;
-            esac
-          done
-          exec jq.exe "${args[@]}"
-          SHIM
-          chmod +x "$RUNNER_TEMP/shim/jq"
-          echo "$RUNNER_TEMP/shim" >> $GITHUB_PATH
-
-      # Stamping version details into the native binaries clears any
-      # signature they arrived with and asks signtool whether there is one.
-      # That only reads and removes, so it wants no certificate and signs
-      # nothing. It just has to be findable, and the sdk carrying it is not
-      # on the path.
-      - name: Put signtool on the path
-        run: |
-          sdk=$(ls -d "/c/Program Files (x86)/Windows Kits/10/bin"/*/x64 | sort -V | tail -1)
-          test -x "$sdk/signtool.exe"
-          cygpath -w "$sdk" >> $GITHUB_PATH
-
-      # build-release.sh copies the tree with rsync, which neither windows
-      # nor the git bash on this image has. MSYS2 is already here, just not
-      # on the path.
-      - name: Install rsync
-        shell: cmd
-        run: C:\msys64\usr\bin\pacman -Sy --noconfirm --needed rsync
-
-      # Only rsync crosses over. Putting msys2's /usr/bin in front instead
-      # breaks the release step: npm on the path is a shell script whose
-      # shebang reads /usr/bin/env bash, so with msys2 first it is msys2's
-      # bash that runs it, and crossing into a second msys runtime does not
-      # carry the environment. npm then sees no script-shell and falls back
-      # to cmd, which cannot run ./ci/build/build-release.sh, and
-      # KEEP_MODULES is dropped on the way. A forwarder avoids the whole
-      # class: rsync is a native exe that loads its runtime from beside
-      # itself, and nothing else on the path moves.
-      - name: Reach rsync without moving the path
-        run: |
-          cat > "$RUNNER_TEMP/shim/rsync" <<'SHIM'
-          #!/usr/bin/env bash
-          exec /c/msys64/usr/bin/rsync.exe "$@"
-          SHIM
-          chmod +x "$RUNNER_TEMP/shim/rsync"
-
-      - run: npm ci
-      - run: npm run build
-      - run: npm run build:vscode
-      - run: KEEP_MODULES=1 npm run release
-
-      # Of the two tars on this image it is git bash's GNU one that can
-      # rename the tree's top directory as it archives; the windows bsdtar
-      # is built without substitution support. Asserted rather than
-      # assumed, since the two are interchangeable everywhere except here.
-      - name: Package
-        run: |
-          case "$(tar --version | head -1)" in
-            *GNU*) ;;
-            *) echo "expected GNU tar for --transform, got $(tar --version | head -1)" >&2; exit 1 ;;
-          esac
-          npm run package
-
-      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
-        with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./release-packages/*
-          tag_name: v${{ env.VERSION }}
-          name: v${{ env.VERSION }}

.github/workflows/security.yaml

@@ -80,7 +80,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           config-file: ./.github/codeql-config.yml
           languages: javascript
@@ -89,4 +89,4 @@ jobs:
         uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

CHANGELOG.md

@@ -22,6 +22,12 @@ Code v99.99.999
 
 ## Unreleased
 
+Code v1.136.2
+
+### Changed
+
+- Update to Code 1.136.2
+
 ## [4.136.2](https://github.com/coder/code-server/releases/tag/v4.136.2) - 2026-09-08
 
 Code v1.136.1

package-lock.json

@@ -35,7 +35,7 @@
         "code-server": "out/node/entry.js"
       },
       "devDependencies": {
-        "@eslint/compat": "^2.1.0",
+        "@eslint/compat": "^1.2.0",
         "@eslint/eslintrc": "^3.1.0",
         "@eslint/js": "^9.12.0",
         "@types/compression": "^1.7.3",
@@ -170,19 +170,19 @@
       }
     },
     "node_modules/@eslint/compat": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.0.tgz",
-      "integrity": "sha512-LgaSCymEpw7tF53xvDw9SNsraPb1IBHxpdABIOM0hW8UAlP8znrjYtuxfR58FSJ3L9BhwD+FaPRFQpZq84Nh6g==",
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.1.tgz",
+      "integrity": "sha512-cfO82V9zxxGBxcQDr1lfaYB7wykTa0b00mGa36FrJl7iTFd0Z2cHfEYuxcBRP/iNijCsWsEkA+jzT8hGYmv33w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.2.1"
+        "@eslint/core": "^0.17.0"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "peerDependencies": {
-        "eslint": "^8.40 || 9 || 10"
+        "eslint": "^8.40 || 9"
       },
       "peerDependenciesMeta": {
         "eslint": {
@@ -190,19 +190,6 @@
         }
       }
     },
-    "node_modules/@eslint/compat/node_modules/@eslint/core": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
-      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      }
-    },
     "node_modules/@eslint/config-array": {
       "version": "0.21.1",
       "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
@@ -753,9 +740,9 @@
       "license": "MIT"
     },
     "node_modules/@types/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==",
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
       "dev": true,
       "license": "MIT"
     },
@@ -4203,9 +4190,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
+      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
       "funding": [
         {
           "type": "github",
@@ -5629,9 +5616,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.8.5",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
-      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"

package.json

@@ -36,7 +36,7 @@
   },
   "main": "out/node/entry.js",
   "devDependencies": {
-    "@eslint/compat": "^2.1.0",
+    "@eslint/compat": "^1.2.0",
     "@eslint/eslintrc": "^3.1.0",
     "@eslint/js": "^9.12.0",
     "@types/compression": "^1.7.3",