chore: bump aquasecurity/trivy-action

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 97e0b3872f55f89b95b2f65b3dbab56962816478 to ed142fd0673e97e23eac54620cfb913e5ce36c25.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](97e0b3872f...ed142fd067)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: ed142fd0673e97e23eac54620cfb913e5ce36c25
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/release.yaml

@@ -10,7 +10,7 @@ on:
     types:
       - closed
     branches:
-      - main
+      - "update/**"
 
 permissions:
   contents: write # For creating releases.
@@ -26,9 +26,7 @@ jobs:
   package-linux:
     name: ${{ format('linux-{0}', matrix.vscode_arch) }}
     runs-on: ubuntu-22.04
-    if: >-
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/'))
 
     strategy:
       matrix:
@@ -119,7 +117,7 @@ jobs:
           files: package.tar.gz
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}
-          body_path: .cache/release-notes
+          body: .cache/release-notes
 
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
@@ -135,9 +133,7 @@ jobs:
   package-macos:
     name: ${{ matrix.vscode_target }}
     runs-on: ${{ matrix.os }}
-    if: >-
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request_merged == true
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/'))
     strategy:
       matrix:
         include:

.github/workflows/security.yaml

@@ -51,7 +51,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # latest
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # latest
         with:
           scan-type: "fs"
           scan-ref: "."

.github/workflows/trivy-docker.yaml

@@ -18,6 +18,8 @@ on:
       - .github/workflows/trivy-docker.yaml
 
   schedule:
+    # Run at 10:15 am UTC (3:15am PT/5:15am CT)
+    # Run at 0 minutes 0 hours of every day.
     - cron: "15 10 * * *"
 
   workflow_dispatch:
@@ -49,7 +51,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run Trivy vulnerability scanner in image mode
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # latest
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # latest
         with:
           image-ref: "docker.io/codercom/code-server:latest"
           ignore-unfixed: true

.github/workflows/update.yaml

@@ -63,10 +63,10 @@ jobs:
           git config --global user.email opensource@coder.com
           git checkout -b "update/$VERSION"
           git add .
-          git commit -m "Update Code to $VERSION"
+          git commit -m "Update VS Code to $VERSION"
           git push -u origin "$(git branch --show)"
           gh pr create \
             --repo coder/code-server \
-            --title "Update Code to $VERSION" \
+            --title "Update VS Code to $VERSION" \
             --body-file .cache/checklist \
             --draft

CHANGELOG.md

@@ -22,11 +22,13 @@ Code v99.99.999
 
 ## Unreleased
 
-Code v1.121.0
+## [4.119.0](https://github.com/coder/code-server/releases/tag/v4.119.0) - 2026-05-07
+
+Code v1.119.0
 
 ### Changed
 
-- Update to Code 1.121.0
+- Update to Code 1.119.0
 
 ## [4.118.0](https://github.com/coder/code-server/releases/tag/v4.118.0) - 2026-05-06
 

ci/build/update-vscode.sh

@@ -19,8 +19,7 @@ function update_vscode() {
   pushd lib/vscode
   if ! git checkout 2>&1 "$target_vscode_version" ; then
     echo "$target_vscode_version does not exist locally, fetching..."
-    git fetch --all --prune --tags
+    git fetch --all --prune
-    echo "Checking out $target_vscode_version again..."
     git checkout "$target_vscode_version"
   fi
   popd
@@ -132,12 +131,12 @@ function main() {
     fi
     target_vscode_version="${VERSION#v}"
     steps+=(
-      "Update Code to $target_vscode_version" "update_vscode"
+      "Update VS Code to $target_vscode_version" "update_vscode"
-      "Refresh Code patches" "refresh_patches"
+      "Refresh VS Code patches" "refresh_patches"
     )
   else
     target_vscode_version="$(git -C lib/vscode describe --tags --exact-match)"
-    echo "Detected Code version $target_vscode_version"
+    echo "Detected VS Code version $target_vscode_version"
   fi
 
   steps+=(

ci/lib.sh

@@ -80,7 +80,6 @@ nodeArch() {
 
 run-steps() {
   local -i failed=0
-  mkdir -p .cache
   rm -f .cache/checklist
   while (( $# )) ; do
     local name=$1 ; shift

patches/clipboard.diff

@@ -78,7 +78,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
-@@ -146,6 +146,7 @@ export interface NativeParsedArgs {
+@@ -149,6 +149,7 @@ export interface NativeParsedArgs {
  	'disable-chromium-sandbox'?: boolean;
  	sandbox?: boolean;
  	'enable-coi'?: boolean;

patches/copilot.diff

@@ -44,7 +44,7 @@ Index: code-server/lib/vscode/build/lib/extensions.ts
  import vzip from 'gulp-vinyl-zip';
  
  import { createRequire } from 'module';
-@@ -492,6 +493,116 @@ export function packageCopilotExtensionS
+@@ -487,6 +488,116 @@ export function packageCopilotExtensionS
  	).pipe(util2.setExecutableBit(['**/*.sh']));
  }
  

patches/display-language.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
  import { ConfigurationService } from '../../platform/configuration/common/configurationService.js';
-@@ -358,6 +358,9 @@ export async function setupServerService
+@@ -301,6 +301,9 @@ export async function setupServerService
  
  		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
  
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/environmentServ
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/environmentService.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/environmentService.ts
-@@ -98,7 +98,7 @@ export abstract class AbstractNativeEnvi
+@@ -112,7 +112,7 @@ export abstract class AbstractNativeEnvi
  			return URI.file(join(vscodePortable, 'argv.json'));
  		}
  
@@ -198,7 +198,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -120,6 +121,7 @@ export interface ServerParsedArgs {
+@@ -116,6 +117,7 @@ export interface ServerParsedArgs {
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,

patches/external-file-actions.diff

@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -114,6 +116,8 @@ export interface ServerParsedArgs {
+@@ -110,6 +112,8 @@ export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
  	'auth'?: string;
@@ -207,7 +207,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -40,6 +40,9 @@ export const EmbedderIdentifierContext =
+@@ -41,6 +41,9 @@ export const EmbedderIdentifierContext =
  
  export const InAutomationContext = new RawContextKey<boolean>('inAutomation', false, localize('inAutomation', "Whether VS Code is running under automation/smoke test"));
  

patches/getting-started.diff

@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -928,6 +928,72 @@ export class GettingStartedPage extends
+@@ -925,6 +925,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -977,6 +1043,9 @@ export class GettingStartedPage extends
+@@ -974,6 +1040,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}
@@ -189,7 +189,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
+@@ -114,6 +115,7 @@ export interface ServerParsedArgs {
  	'auth'?: string;
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
@@ -234,7 +234,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -42,6 +42,7 @@ export const InAutomationContext = new R
+@@ -43,6 +43,7 @@ export const InAutomationContext = new R
  
  export const IsEnabledFileDownloads = new RawContextKey<boolean>('isEnabledFileDownloads', true, true);
  export const IsEnabledFileUploads = new RawContextKey<boolean>('isEnabledFileUploads', true, true);

patches/logout.diff

@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -112,6 +113,7 @@ export const serverOptions: OptionDescri
+@@ -108,6 +109,7 @@ export const serverOptions: OptionDescri
  export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;

patches/telemetry.diff

@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { NullPolicyService } from '../../platform/policy/common/policy.js';
  import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
  import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -176,11 +178,23 @@ export async function setupServerService
+@@ -174,11 +176,23 @@ export async function setupServerService
  	const requestService = new RequestService('remote', configurationService, environmentService, logService);
  	services.set(IRequestService, requestService);
  

patches/trusted-domains.diff

@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -122,6 +123,7 @@ export interface ServerParsedArgs {
+@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string

patches/update-check.diff

@@ -134,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -108,6 +110,8 @@ export const serverOptions: OptionDescri
+@@ -104,6 +106,8 @@ export const serverOptions: OptionDescri
  };
  
  export interface ServerParsedArgs {