Bump typescript-eslint from 8.69.0 to 8.72.0

Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.69.0 to 8.72.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: typescript-eslint
  dependency-version: 8.70.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

CHANGELOG.md

@@ -22,6 +22,8 @@ Code v99.99.999
 
 ## Unreleased
 
+## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
+
 Code v1.143.1
 
 ### Changed

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.56.1
+version: 3.57.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.141.1
+appVersion: 4.143.1

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.141.1'
+  tag: '4.143.1'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a

package-lock.json

@@ -269,9 +269,9 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-      "version": "4.3.1",
+      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
@@ -857,17 +857,17 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
-      "integrity": "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA==",
+      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/type-utils": "8.69.0",
+        "@typescript-eslint/type-utils": "8.72.0",
-        "@typescript-eslint/utils": "8.69.0",
+        "@typescript-eslint/utils": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -880,15 +880,15 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.69.0",
+        "@typescript-eslint/parser": "^8.72.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
-      "version": "7.0.8",
+      "version": "7.0.13",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.13.tgz",
-      "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
+      "integrity": "sha512-2E8Q6rh+1RRSq/YdaGsNfXsEZy9FVqv6BSSrkmZJP7BnaoPnRfKL+YaofPvP+5rzdk144qSm6i4+hvPgUcbV4Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -896,16 +896,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
-      "integrity": "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw==",
+      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -921,14 +921,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
-      "integrity": "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==",
+      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.69.0",
+        "@typescript-eslint/tsconfig-utils": "^8.72.0",
-        "@typescript-eslint/types": "^8.69.0",
+        "@typescript-eslint/types": "^8.72.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -943,14 +943,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
-      "integrity": "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==",
+      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.69.0"
+        "@typescript-eslint/visitor-keys": "8.72.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -961,9 +961,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
-      "integrity": "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==",
+      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -978,15 +978,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
-      "integrity": "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA==",
+      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.69.0",
+        "@typescript-eslint/utils": "8.72.0",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -1003,9 +1003,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
-      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
+      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1017,16 +1017,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
-      "integrity": "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==",
+      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.69.0",
+        "@typescript-eslint/project-service": "8.72.0",
-        "@typescript-eslint/tsconfig-utils": "8.69.0",
+        "@typescript-eslint/tsconfig-utils": "8.72.0",
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -1084,16 +1084,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
-      "integrity": "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw==",
+      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.69.0"
+        "@typescript-eslint/typescript-estree": "8.72.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1108,13 +1108,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
-      "integrity": "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==",
+      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/types": "8.72.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -1735,18 +1735,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
+      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -1759,9 +1759,9 @@
       }
     },
     "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
+      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -3703,9 +3703,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
+      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -3777,9 +3777,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.7.2",
+      "version": "10.7.5",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -4270,9 +4270,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "5.4.1",
+      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
       "funding": [
         {
           "type": "github",
@@ -5366,9 +5366,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.16.0",
+      "version": "6.16.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
@@ -6373,16 +6373,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.69.0",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.69.0.tgz",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.72.0.tgz",
-      "integrity": "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA==",
+      "integrity": "sha512-r26Fkc8As+mZvqp7SLsMmNFyYUup/6CjK7/eHBHmhOw6GH6n6YFxHVFrG0jN1c5CMpDzelLPxvgeCOzx7BjN+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.69.0",
+        "@typescript-eslint/eslint-plugin": "8.72.0",
-        "@typescript-eslint/parser": "8.69.0",
+        "@typescript-eslint/parser": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.69.0"
+        "@typescript-eslint/utils": "8.72.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"

src/node/http.ts

@@ -381,19 +381,20 @@ export function authenticateOrigin(req: express.Request): void {
     return
   }
 
-  let origin: string
+  let originUrl: URL
   try {
-    origin = new URL(originRaw).host.trim().toLowerCase()
+    originUrl = new URL(originRaw)
   } catch (error) {
     throw new Error(`unable to parse malformed origin "${originRaw}"`)
   }
+  const origin = originUrl.host.trim().toLowerCase()
 
   const trustedOrigins = req.args["trusted-origins"] || []
   if (isTrustedOrigin(origin, trustedOrigins)) {
     return
   }
 
-  const host = getHost(req)
+  const host = getHost(req, true)
   if (typeof host === "undefined") {
     // A missing host likely means the reverse proxy has not been configured to
     // forward the host which means we cannot perform the check.  Emit an error
@@ -403,15 +404,64 @@ export function authenticateOrigin(req: express.Request): void {
     throw new Error("no host headers found")
   }
 
-  if (host !== origin) {
+  if (!hostMatchesOrigin(host, originUrl)) {
     throw new Error(`host "${host}" does not match origin "${origin}"`)
   }
 }
 
+const defaultPorts: { [protocol: string]: string } = {
+  "http:": "80",
+  "https:": "443",
+}
+
+/**
+ * Parse a host like `example.com:8080` or `[::1]:8080`.  A non-special scheme
+ * keeps the port as written instead of dropping default ports.
+ */
+function parseHost(host: string): URL | undefined {
+  try {
+    return new URL(`host://${host}`)
+  } catch (error) {
+    return undefined
+  }
+}
+
+/**
+ * Check whether the host from the request headers matches the origin.
+ *
+ * This is an exact match, except that a default port (80 for http, 443 for
+ * https) is the same as no port, since `example.com:443` and
+ * `https://example.com` are the same origin.
+ */
+export function hostMatchesOrigin(host: string, origin: URL): boolean {
+  const parsed = parseHost(host)
+  if (!parsed) {
+    return false
+  }
+  const port = parsed.port === defaultPorts[origin.protocol] ? "" : parsed.port
+  return parsed.hostname === origin.hostname.toLowerCase() && port === origin.port
+}
+
+/**
+ * Add the port from X-Forwarded-Port to a host that does not have one.  Some
+ * reverse proxies (for example nginx with `$host`) forward the host without
+ * the port and send the port separately.
+ */
+function addForwardedPort(req: express.Request, host: string): string {
+  const port = getFirstHeader(req, "x-forwarded-port")?.split(",")[0].trim()
+  if (!port || !/^\d+$/.test(port) || parseHost(host)?.port !== "") {
+    return host
+  }
+  return `${host}:${port}`
+}
+
 /**
  * Get the host from headers.  It will be trimmed and lowercased.
+ *
+ * If `withForwardedPort` is set and the host comes from X-Forwarded-Host
+ * without a port, the port from X-Forwarded-Port is added.
  */
-export function getHost(req: express.Request): string | undefined {
+export function getHost(req: express.Request, withForwardedPort = false): string | undefined {
   // Honor Forwarded if present.
   const forwardedRaw = getFirstHeader(req, "forwarded")
   if (forwardedRaw) {
@@ -430,7 +480,8 @@ export function getHost(req: express.Request): string | undefined {
   if (xHost) {
     const firstXHost = xHost.split(",")[0]
     if (firstXHost) {
-      return firstXHost.trim().toLowerCase()
+      const host = firstXHost.trim().toLowerCase()
+      return withForwardedPort ? addForwardedPort(req, host) : host
     }
   }
 

test/unit/node/http.test.ts

@@ -68,6 +68,43 @@ describe("http", () => {
         host: "localhost:8081",
         expected: "does not match",
       },
+      {
+        origin: "https://example.com",
+        host: "example.com:443", // Explicit default port.
+      },
+      {
+        origin: "http://example.com",
+        host: "example.com:80",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:80", // Default port of the other protocol.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com:8080",
+        host: "example.com", // Missing port is not ignored.
+        expected: "does not match",
+      },
+      {
+        origin: "https://example.com",
+        host: "example.com:8443",
+        expected: "does not match",
+      },
+      {
+        origin: "http://example.com:8080",
+        host: "other.com",
+        expected: "does not match",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8080",
+      },
+      {
+        origin: "http://[::1]:8080",
+        host: "[::1]:8081",
+        expected: "does not match",
+      },
       {
         origin: "localhost:8080",
         host: "localhost:8080",
@@ -122,6 +159,75 @@ describe("http", () => {
         })
       })
     })
+
+    describe("x-forwarded-port", () => {
+      ;[
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "443" },
+        },
+        {
+          origin: "http://[::1]:8080",
+          headers: { "x-forwarded-host": "[::1]", "x-forwarded-port": "8080" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8080, 443" },
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "8081" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com:8081", "x-forwarded-port": "8080" },
+          expected: "does not match", // The port in the host wins.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { "x-forwarded-host": "example.com", "x-forwarded-port": "foo" },
+          expected: "does not match",
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { host: "example.com", "x-forwarded-port": "8080" },
+          expected: "does not match", // Only used with X-Forwarded-Host.
+        },
+        {
+          origin: "https://example.com:8080",
+          headers: { forwarded: "host=example.com", "x-forwarded-port": "8080" },
+          expected: "does not match",
+        },
+      ].forEach((test) => {
+        it(`${test.origin} -> ${JSON.stringify(test.headers)}`, () => {
+          const req = getMockReq({
+            originalUrl: "localhost:8080",
+            headers: {
+              origin: test.origin,
+              ...test.headers,
+            },
+            args: {},
+          })
+          if (typeof test.expected === "string") {
+            expect(() => http.authenticateOrigin(req)).toThrow(test.expected)
+          } else {
+            expect(() => http.authenticateOrigin(req)).not.toThrow()
+          }
+        })
+      })
+
+      it("should not add the port to the host for other uses", () => {
+        const req = getMockReq({
+          headers: { "x-forwarded-host": "code-8080.example.com", "x-forwarded-port": "443" },
+        })
+        expect(http.getHost(req)).toBe("code-8080.example.com")
+      })
+    })
   })
 
   describe("constructRedirectPath", () => {