Remove unused imports

.node-version

@@ -1 +1 @@
-24.22.1
+24.21.0

CHANGELOG.md

@@ -22,15 +22,6 @@ Code v99.99.999
 
 ## Unreleased
 
-### Security
-
-- Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the
-  Brotli decoder (CVE-2026-111497).
-- Reject compressed request bodies (`Content-Encoding: br`, `gzip`, or
-  `deflate`) instead of decompressing them.
-
-## [4.141.0](https://github.com/coder/code-server/releases/tag/v4.141.0) - 2026-10-08
-
 Code v1.141.0
 
 ### Added

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.56.0
+version: 3.55.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.141.0
+appVersion: 4.140.0

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.141.0'
+  tag: '4.140.0'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a

package-lock.json

@@ -1055,9 +1055,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1779,9 +1779,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

patches/node-version.diff

@@ -1,33 +0,0 @@
-Bump the bundled Node.js version
-
-Pull in Node.js security fixes (Brotli decoder RCE) ahead of upstream. Drop
-this patch once upstream targets this version or newer.
-
-Index: code-server/lib/vscode/remote/.npmrc
-===================================================================
---- code-server.orig/lib/vscode/remote/.npmrc
-+++ code-server/lib/vscode/remote/.npmrc
-@@ -1,5 +1,5 @@
- disturl="https://nodejs.org/dist"
--target="24.21.0"
-+target="24.22.1"
- ms_build_id="474716"
- runtime="node"
- build_from_source="true"
-Index: code-server/lib/vscode/build/checksums/nodejs.txt
-===================================================================
---- code-server.orig/lib/vscode/build/checksums/nodejs.txt
-+++ code-server/lib/vscode/build/checksums/nodejs.txt
-@@ -1,6 +1,6 @@
--bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057  node-v24.21.0-darwin-arm64.tar.gz
--1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097  node-v24.21.0-darwin-x64.tar.gz
--724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5  node-v24.21.0-linux-arm64.tar.gz
--6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff  node-v24.21.0-linux-x64.tar.gz
--dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7  win-arm64/node.exe
--ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32  win-x64/node.exe
-+89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7  node-v24.22.1-darwin-arm64.tar.gz
-+d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035  node-v24.22.1-darwin-x64.tar.gz
-+33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3  node-v24.22.1-linux-arm64.tar.gz
-+eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c  node-v24.22.1-linux-x64.tar.gz
-+8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00  win-arm64/node.exe
-+d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5  win-x64/node.exe

patches/series

@@ -27,4 +27,3 @@ app-name.diff
 remote-storage.diff
 remote-secret-storage.diff
 csp-hashes.diff
-node-version.diff

src/node/cli.ts

@@ -3,7 +3,7 @@ import * as crypto from "crypto"
 import { promises as fs } from "fs"
 import { load } from "js-yaml"
 import * as path from "path"
-import { expandTilde, generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
+import { generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
 import { EditorSessionManagerClient } from "./vscodeSocket"
 
 export enum Feature {
@@ -436,11 +436,7 @@ export const parse = (
 
       const option = options[key]
       if (option.type === "boolean") {
-        // Booleans set to false (for example `--flag=false`, which is also how
-        // false values from the config file are passed in) are ignored.
-        if (value !== "false") {
-          ;(args[key] as boolean) = true
-        }
+        ;(args[key] as boolean) = true
         continue
       }
 
@@ -466,7 +462,7 @@ export const parse = (
       }
 
       if (option.path) {
-        value = path.resolve(expandTilde(value))
+        value = path.resolve(value)
       }
 
       switch (option.type) {

src/node/i18n/index.ts

@@ -3,7 +3,6 @@ import i18next, { init } from "i18next"
 import * as en from "./locales/en.json"
 import * as ja from "./locales/ja.json"
 import * as th from "./locales/th.json"
-import * as tr from "./locales/tr.json"
 import * as ur from "./locales/ur.json"
 import * as zhCn from "./locales/zh-cn.json"
 
@@ -17,9 +16,6 @@ const defaultResources = {
   th: {
     translation: th,
   },
-  tr: {
-    translation: tr,
-  },
   ja: {
     translation: ja,
   },

src/node/i18n/locales/tr.json

@@ -1,13 +0,0 @@
-{
-  "LOGIN_TITLE": "{{app}} girişi",
-  "LOGIN_BELOW": "Lütfen aşağıdan giriş yapın.",
-  "WELCOME": "{{app}} uygulamasına hoş geldiniz",
-  "LOGIN_PASSWORD": "Parola için yapılandırma dosyasını kontrol edin.",
-  "LOGIN_USING_ENV_PASSWORD": "Parola $PASSWORD ortam değişkeninden ayarlandı.",
-  "LOGIN_USING_HASHED_PASSWORD": "Parola $HASHED_PASSWORD ortam değişkeninden ayarlandı.",
-  "SUBMIT": "GÖNDER",
-  "PASSWORD_PLACEHOLDER": "PAROLA",
-  "LOGIN_RATE_LIMIT": "Giriş denemesi sınırına ulaşıldı!",
-  "MISS_PASSWORD": "Parola eksik",
-  "INCORRECT_PASSWORD": "Parola yanlış."
-}

src/node/routes/index.ts

@@ -132,10 +132,8 @@ export const register = async (
     })
   })
 
-  // Reject compressed request bodies so unauthenticated requests cannot reach
-  // the zlib/Brotli decoders. Browsers never compress request bodies.
-  app.router.use(express.json({ inflate: false }))
-  app.router.use(express.urlencoded({ extended: true, inflate: false }))
+  app.router.use(express.json())
+  app.router.use(express.urlencoded({ extended: true }))
 
   app.router.use(
     "/_static",

src/node/util.ts

@@ -511,18 +511,3 @@ export function splitOnFirstEquals(str: string): [string, string | undefined] {
   const split = str.split(/=(.+)?/, 2)
   return [split[0], split[1]]
 }
-
-/**
- * Expand a leading `~` to the home directory.  The shell does this for
- * command-line arguments but values from the config file are not expanded.
- * `~user` forms are left alone.
- */
-export function expandTilde(p: string): string {
-  if (p === "~") {
-    return os.homedir()
-  }
-  if (p.startsWith("~/") || p.startsWith(`~${path.sep}`)) {
-    return path.join(os.homedir(), p.slice(2))
-  }
-  return p
-}

src/node/vscodeSocket.ts

@@ -38,7 +38,7 @@ export async function makeEditorSessionManagerServer(
 ): Promise<http.Server> {
   const router = express()
 
-  router.use(express.json({ inflate: false }))
+  router.use(express.json())
 
   router.get<{}, GetSessionResponse | string | unknown, undefined, { filePath?: string }>(
     "/session",

test/e2e/models/CodeServer.ts

@@ -363,14 +363,13 @@ export class CodeServerPage {
   }
 
   /**
-   * Checks if the test extension loaded by waiting for its notification.  Once
-   * it appears, dismiss the notification.
+   * Checks if the test extension loaded
    */
   async waitForTestExtensionLoaded(): Promise<void> {
+    const selector = "text=test extension loaded"
     this.codeServer.logger.debug("Waiting for test extension to load...")
-    const locator = this.page.getByRole("dialog", { name: "Info: test extension loaded" })
-    await locator.hover()
-    await locator.getByLabel("Clear Notification (Del)").click()
+
+    await this.page.waitForSelector(selector)
   }
 
   /**

test/e2e/storage.test.ts

@@ -39,21 +39,20 @@ for (const tc of tests) {
 
       const storageFile = path.join(userDir, dirs[0], "state.vscdb")
       if (tc.args.includes("--enable-remote-storage")) {
-        // The sqlite database should exist.
-        fs.stat(storageFile)
+        // And a sqlite database that has the opened file in it.
+        const content = await fs.readFile(storageFile, "utf8")
+        expect(content).toContain(file)
       } else {
         // But no sqlite database.
         expect(() => fs.stat(storageFile)).rejects.toThrow("ENOENT")
       }
 
-      // Reload using a command so it has a chance to flush storage.
-      await codeServerPage.executeCommandViaMenus("Developer: Reload Window")
-      await codeServerPage.waitForTestExtensionLoaded()
-
-      // Should see the same file.
+      // Should see the same file open after a reload.
+      await codeServerPage.page.reload({ waitUntil: "load" })
       await codeServerPage.waitForTab(file)
 
       // Should be able to retrieve the secret.
+      await codeServerPage.waitForTestExtensionLoaded()
       await codeServerPage.executeCommandViaMenus("code-server: Get test secret")
       await expect(codeServerPage.page.getByText(`Info: get secret: ${secret}`)).toBeVisible()
     })

test/e2e/typescript.test.ts

@@ -1,6 +1,6 @@
 import { promises as fs } from "fs"
 import * as path from "path"
-import { describe, test, expect } from "./baseFixture"
+import { describe, test } from "./baseFixture"
 
 const args = ["--disable-workspace-trust"]
 
@@ -12,8 +12,6 @@ describe("typescript extension", args, {}, () => {
     await codeServerPage.openFile(file)
 
     await codeServerPage.executeCommandViaMenus("Developer: Show Running Extensions")
-    await expect(
-      codeServerPage.page.getByLabel("typescript-language-features").getByText(/localhost:\d+/),
-    ).toBeVisible()
+    codeServerPage.page.getByLabel("typescript-language-features").getByText("localhost:").waitFor()
   })
 })

test/unit/node/cli.test.ts

@@ -1,6 +1,5 @@
 import { Level, logger } from "@coder/logger"
 import { promises as fs } from "fs"
-import * as os from "os"
 import * as path from "path"
 import {
   UserProvidedArgs,
@@ -576,33 +575,9 @@ describe("parser", () => {
       "install-extension": ["extension.number1", "extension.number2"],
     })
   })
-  it("should expand ~ in path options from the config file", () => {
-    const configContents = `
-      user-data-dir: ~/.config/code-server-data
-      extensions-dir: ~/extensions
-    `
-    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
-      config: "/fake-config-path",
-      "user-data-dir": path.join(os.homedir(), ".config/code-server-data"),
-      "extensions-dir": path.join(os.homedir(), "extensions"),
-    })
-  })
   it("should ignore optional strings set to false", async () => {
     expect(parse(["--cert=false"])).toEqual({})
   })
-  it("should ignore booleans set to false", async () => {
-    expect(parse(["--disable-telemetry=false"])).toEqual({})
-  })
-  it("should parse booleans set to false in the config file", () => {
-    const configContents = `
-      disable-telemetry: false
-      disable-update-check: true
-    `
-    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
-      config: "/fake-config-path",
-      "disable-update-check": true,
-    })
-  })
   it("should use last flag", async () => {
     expect(parse(["--port", "8081", "--port", "8082"])).toEqual({
       port: 8082,

test/unit/node/i18n.test.ts

@@ -1,13 +1,9 @@
 import { promises as fs } from "fs"
 import * as os from "os"
 import * as path from "path"
-import i18n, { loadCustomStrings } from "../../../src/node/i18n"
+import { loadCustomStrings } from "../../../src/node/i18n"
 
 describe("i18n", () => {
-  it("includes Turkish translations", () => {
-    expect(i18n.getResource("tr", "translation", "WELCOME")).toBe("{{app}} uygulamasına hoş geldiniz")
-  })
-
   let tempDir: string
   let validJsonFile: string
   let invalidJsonFile: string

test/unit/node/routes/login.test.ts

@@ -75,17 +75,6 @@ describe("login", () => {
       expect(htmlContent).toContain("Missing password")
     })
 
-    it("should reject compressed request bodies", async () => {
-      for (const encoding of ["br", "gzip", "deflate"]) {
-        const resp = await codeServer().fetch("/login", {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Encoding": encoding },
-          body: "password=test",
-        })
-        expect(resp.status).toBe(415)
-      }
-    })
-
     it("should return HTML with 'Incorrect password' message", async () => {
       const params = new URLSearchParams()
       params.append("password", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")

test/unit/node/util.test.ts

@@ -1,6 +1,5 @@
 import * as cp from "child_process"
 import { promises as fs } from "fs"
-import * as os from "os"
 import * as path from "path"
 import { generateUuid } from "../../../src/common/util"
 import { tmpdir } from "../../../src/node/constants"
@@ -624,18 +623,3 @@ describe("splitOnFirstEquals", () => {
     })
   })
 })
-
-describe("expandTilde", () => {
-  it("should expand a bare ~", () => {
-    expect(util.expandTilde("~")).toBe(os.homedir())
-  })
-  it("should expand a leading ~/", () => {
-    expect(util.expandTilde("~/.config/code-server")).toBe(path.join(os.homedir(), ".config/code-server"))
-  })
-  it("should leave other paths alone", () => {
-    expect(util.expandTilde("/tmp/~/data")).toBe("/tmp/~/data")
-    expect(util.expandTilde("relative/~")).toBe("relative/~")
-    expect(util.expandTilde("~user/data")).toBe("~user/data")
-    expect(util.expandTilde("")).toBe("")
-  })
-})