chore(deps): update dependency cdr/code-server to v4.132.0

[renovate]

This PR contains the following updates:

Package	Update	Change
cdr/code-server	minor	v4.7.0 → v4.132.0

---

Release Notes

cdr/code-server (cdr/code-server)

v4.132.0

Compare Source

Code v1.132.0

Changed

• Update to Code 1.132.0

Fixed

• When proxying, cookies were being decoded and re-encoded, which could cause
  issues for applications that encode differently. Cookies are now passed
  through unchanged (aside from stripping out code-server's session token).

v4.131.0

Compare Source

Code v1.131.0

Changed

• Update to Code 1.131.0

v4.130.0

Compare Source

Code v1.130.0

Changed

• Update to Code 1.130.0

v4.129.0

Compare Source

Code v1.129.0

Changed

• Update to Code 1.129.0

v4.128.0

Compare Source

Code v1.128.0

Changed

• Update to Code 1.128.0

v4.127.0

Compare Source

Code v1.127.0

Changed

• Update to Code 1.127.0

v4.126.0

Compare Source

Code v1.126.0

Changed

• Update to Code 1.126.0

v4.125.0

Compare Source

Code v1.125.0

Changed

• Update to Code 1.125.0

v4.124.2

Compare Source

Code v1.124.2

Security

• Strip code-server's session token from the cookie before proxying to a local
  port. Previously, when you used built-in password authentication, the cookie
  would be sent to the local proxied port, which meant if the service was
  malicious and not already running as your code-server user it could use the
  cookie to log into code-server and execute commands as your code-server user.

Changed

• Update to Code 1.124.2

v4.123.0

Compare Source

Code v1.123.0

Changed

• Update to Code 1.123.0
• Microsoft dropped support for armhf remotes so there will no longer be any
  builds for armhf.

v4.122.1

Compare Source

Code v1.122.1

Changed

• Update to Code 1.122.1

v4.122.0

Compare Source

Code v1.122.0

Changed

• Update to Code 1.122.0

Fixed

• --app-name will now affect window titles within the editor (it is now used
  as the value for ${appName} in the title template) as well as some other
  places like the help > about dialog.

Added

• App name can now be set with the CODE_SERVER_APP_NAME environment variable.

v4.121.0

Compare Source

Code v1.121.0

Changed

• Update to Code 1.121.0

v4.118.0

Compare Source

Code v1.118.0

Changed

• Update to Code 1.118.0

v4.117.0

Compare Source

Code v1.117.0

Changed

• Update to Code 1.117.0

v4.116.0

Compare Source

Code v1.116.0

Changed

• Update to Code 1.116.0

v4.115.0

Compare Source

Code v1.115.0

Changed

• Update to Code 1.115.0

v4.114.1

Compare Source

Code v1.114.0

Changed

• Ensure native modules are built from source so they use the correct version of
  glibc. This should bring down the requirement from 2.34 back down to 2.28.

v4.114.0

Compare Source

Code v1.114.0

Changed

• Updated to Code 1.114.0.

v4.113.1

Compare Source

Code v1.113.0

This is a re-release of v4.113.0 but with the correct Node binaries for arm64
and armv7l. Previously they were packaging the amd64 Node binary due to a
mistake while refactoring CI to use more of the upstream build scripts.

v4.113.0

Compare Source

Code v1.113.0

Changed

• Update to Code 1.113.0.
• Trusted origins can now begin with *.. For example, --trusted-origins '*.coder.com' will match both coder.com exactly and any domain that ends in
  .coder.com.

Added

• Add the --reconnection-grace-time flag and pass it through to VS Code. This
  configures how many seconds clients have to reconnect before the session is
  permanently killed and a new connection must be made by reloading the
  window. The default is 10800 (three hours).

v4.112.0

Compare Source

Code v1.112.0

Changed

• Update to Code 1.112.0
• Remove config file path from the login screen to avoid leaking information.

v4.111.0

Compare Source

Code v1.111.0

Changed

• Update to Code 1.111.0
• --app-name now affects the error page title.

v4.110.1

Compare Source

Code v1.110.1

Changed

• Update to Code 1.110.1

v4.110.0

Compare Source

Code v1.110.0

Changed

• Update to Code 1.110.0

v4.109.5

Compare Source

Code v1.109.5

Changed

• Update to Code 1.109.5

v4.109.2

Compare Source

Code v1.109.2

Changed

• Update to Code 1.109.2

v4.109.0

Compare Source

Code v1.109.0

Changed

• Update to Code 1.109.0

v4.108.2

Compare Source

Code v1.108.2

Changed

• Update to Code 1.108.2

v4.108.1

Compare Source

Code v1.108.1

Changed

• Update to Code 1.108.1

v4.108.0

Compare Source

Code v1.108.0

Changed

• Update to Code 1.108.0

v4.107.1

Compare Source

Code v1.107.1

Changed

• Update to Code 1.107.1

v4.107.0

Compare Source

Code v1.107.0

Changed

• Update to Code 1.107.0

Added

• New --cookie-suffix flag that can be used to add a suffix to the cookie when
  using the built-in password authentication. You can use this to avoid
  collisions with other instances of code-server.
• Support a new property authorizationHeaderToken on the extension gallery
  configuration. This will be added to marketplace requests as a bearer token
  using the Authorization header.

v4.106.3

Compare Source

Code v1.106.3

Changed

• Update to Code 1.106.3

v4.106.2

Compare Source

Code v1.106.2

Changed

• Update to Code 1.106.2

v4.106.0

Compare Source

Code v1.106.0

Changed

• Update to Code 1.106.0

v4.105.1

Compare Source

Code v1.105.1

Changed

• Update to Code 1.105.1

v4.105.0

Compare Source

Code v1.105.0

Changed

• Update to Code 1.105.0

v4.104.3

Compare Source

Code v1.104.3

Changed

• Update to Code 1.104.3.

v4.104.2

Compare Source

Code v1.104.2

Changed

• Update to Code 1.104.2.

v4.104.1

Compare Source

Code v1.104.1

Changed

• Update to Code 1.104.1.

v4.104.0

Compare Source

Code v1.104.0

Fixed

• Fix "extension not found" errors from Open VSX when trying to install the
  latest version of an extension.

Changed

• Update to Code 1.104.0.

v4.103.2

Compare Source

Code v1.103.2

Changed

• Update to Code 1.103.2.

v4.103.1

Compare Source

Code v1.103.1

Changed

• Update to Code 1.103.1.

v4.103.0

Compare Source

Code v1.103.0

Changed

• Update to Code 1.103.0.

v4.102.3

Compare Source

Code v1.102.3

Changed

• Update to Code 1.102.3.

v4.102.2

Compare Source

Code v1.102.2

Changed

• Update to Code 1.102.2.

v4.102.1

Compare Source

Code v1.102.1

Changed

• Update to Code 1.102.1.

v4.102.0

Compare Source

Code v1.102.0

Changed

• Update to Code 1.102.0.

Added

• Custom strings can be configured using the --i18n flag set to a JSON
  file. This can be used for either translation (and can be used alongside
  --locale) or for customizing the strings. See
  ./src/node/i18n/locales/en.json for the
  available keys.

v4.101.2

Compare Source

Code v1.101.2

Changed

• Update to Code 1.101.2.

Fixed

• Fix web views not loading due to 401 when requesting the service worker.

v4.101.1

Compare Source

Code v1.101.1

Changed

• Update to Code 1.101.1.

v4.101.0: 4.101.0

Compare Source

Code v1.101.0

Changed

• Update to Code 1.101.0.

v4.101.0

Compare Source

Code v1.101.0

Changed

• Update to Code 1.101.0.

v4.100.3

Compare Source

Code v1.100.3

Changed

• Update to Code 1.100.3.

v4.100.2

Compare Source

Code v1.100.2

Changed

• Update to Code 1.100.2.

v4.100.1

Compare Source

Code v1.100.1

Changed

• Update to Code 1.100.1.

v4.100.0

Compare Source

Code v1.100.0

Added

• Trusted domains for links can now be set at run-time by configuring
  linkProtectionTrustedDomains in the lib/vscode/product.json file or via
  the --link-protection-trusted-domains flag.

Changed

• Update to Code 1.100.0.
• Disable extension signature verification, which previously was skipped by
  default (the package used for verification is not available to OSS builds of
  VS Code) but now reportedly throws hard errors making it impossible to install
  extensions.

Fixed

• Flags with repeatable options now work via the config file.

v4.99.4

Compare Source

Security

• Validate that ports in the path proxy are numbers, to prevent proxying to
  arbitrary domains.

v4.99.3

Compare Source

Code v1.99.3

Added

• Added --skip-auth-preflight flag to let preflight requests through the
  proxy.

Changed

• Update to Code 1.99.3.

v4.99.2

Compare Source

Code v1.99.2

Changed

• Update to Code 1.99.2.

v4.99.1

Compare Source

Code v1.99.1

Changed

• Update to Code 1.99.1.

v4.99.0

Compare Source

Code v1.99.0

Changed

• Update to Code 1.99.0.

v4.98.2

Compare Source

Code v1.98.2

Changed

• Update to Code 1.98.2.

v4.98.0

Compare Source

Code v1.98.0

Changed

• Update to Code 1.98.0.

v4.97.2

Compare Source

Code v1.97.2

Added

• Added back macOS amd64 builds.

Changed

• Update to Code 1.97.2.
• Softened dark mode login page colors.

v4.96.4

Compare Source

Code v1.96.4

Changed

• Update to Code 1.96.4.

v4.96.2

Compare Source

Code v1.96.2

Changed

• Update to Code 1.96.2.

v4.96.1

Compare Source

Code v1.96.1

Added

• Dark color scheme for login and error pages.

Changed

• Update to Code 1.96.1.

v4.95.3

Compare Source

Code v1.95.3

Changed

• Update to Code 1.95.3.

Sorry if you saw a confusing title, was trying to backspace but hit enter and that submitted the form. All fixed up now.

v4.95.2

Compare Source

Code v1.95.2

Changed

• Update to Code 1.95.2.

v4.95.1

Compare Source

Code v1.95.1

Changed

• Update to Code 1.95.1.

v4.93.1

Compare Source

Code v1.93.1

Changed

• Updated to Code 1.93.1.

Added

• Added --abs-proxy-base-path flag for when code-server is not at the root.

v4.92.2

Compare Source

Code v1.92.2

Breaking changes

• Dropped a patch that changed the compile target from es2022 to es2020 because
  it no longer works with the way VS Code uses static properties. This may break
  older browsers, so those browsers will either have to be updated or use an
  older version of code-server.

Changed

• Updated to Code 1.92.2.

v4.91.1

Compare Source

Code v1.91.1

Changed

• Updated to Code 1.91.1.

v4.91.0

Compare Source

Code v1.91.0

Changed

• Updated to Code 1.91.0.

v4.90.3

Compare Source

Changed

• Updated to Code 1.90.2.

Fixed

• When the log gets rotated it will no longer incorrectly be moved to a new
  directory created in the current working directory named with a date.
  Instead, the file itself is prepended with the date and kept in the same
  directory, as originally intended.

v4.90.2

Compare Source

Code v1.90.1

Changed

• Updated to Code 1.90.1.

v4.90.1

Compare Source

Code v1.90.0

Fixed

• Cache a call to get CPU information used in telemetry that could result in a
  lack responsiveness if it was particularly slow.

v4.90.0

Compare Source

Code v1.90.0

Changed

• Updated to Code 1.90.0.
• Updated Node to 20.11.1.

Added

• Send contents to the clipboard in the integrated terminal by piping to
  code-server --stdin-to-clipboard or code-server -c.

  You may want to make this an alias:

  alias xclip="code-server --stdin-to-clipboard"
  echo -n "hello world" | xclip
  

v4.89.1

Compare Source

Code v1.89.1

Changed

• Updated to Code 1.89.1.

v4.89.0

Compare Source

Code v1.89.0

Changed

• Updated to Code 1.89.0.

v4.23.1

Compare Source

Code v1.88.1

Changed

• Updated to Code 1.88.1.

v4.23.0

Compare Source

Code v1.88.0

Changed

• Updated to Code 1.88.0.
• Updated Node to 18.18.2.

Fixed

• Fix masking the exit code when failing to install extensions on the command
  line outside the integrated terminal. Installing extensions inside the
  integrated terminal still masks the exit code and is an upstream bug.

v4.22.1

Compare Source

Code v1.87.2

Changed

• Updated to Code 1.87.2.
• Enable keep-alive for proxy agent.

v4.22.0

Compare Source

Code v1.87.0

Changed

• Updated to Code 1.87.0.

v4.21.2

Compare Source

Code v1.86.2

Changed

• Updated to Code 1.86.2.

v4.21.1

Compare Source

Code v1.86.1

Changed

• Updated to Code 1.86.1.
• Updated to Node 18.17.1.

Added

• Docker images for Fedora and openSUSE.

v4.21.0

Compare Source

Code v1.86.0

Changed

• Updated to Code 1.86.0

v4.20.1

Compare Source

Code v1.85.2

Changed

• Updated to Code 1.85.2.

Fixed

• Query variables are no longer double-encoded when going over the path proxy.

v4.20.0

Compare Source

Code v1.85.1

Added

• New flag --disable-file-uploads to disable uploading files to the remote by
  drag and drop and to disable opening local files via the "show local" button
  in the file open prompt. Note that you can still open local files by drag and
  dropping the file onto the editor pane.
• Added wget to the release image.

Changed

• Updated to Code 1.85.1.
• The --disable-file-downloads flag will now disable the "show local" button
  in the file save prompt as well.
• Debian release image updated to use Bookworm.

v4.19.1

Compare Source

Code v1.84.2

Fixed

• Fixed an issue where parts of the editor would not load (like the file
  explorer, source control, etc) when using a workspace file.

v4.19.0

Compare Source

Code v1.84.2

Changed

• Updated to Code 1.84.2

v4.18.0

Compare Source

Code v1.83.1

Changed

• Updated to Code 1.83.1.

v4.17.1

Compare Source

Code v1.82.2

Fixed

• Make secret storage persistent. For example, logging in with GitHub should
  persist between browser refreshes and code-server restarts.
• Issues with argon2 on arm builds should be fixed now.

v4.17.0

Compare Source

Code v1.82.2

Added

• Japanese locale.
• CODE_SERVER_HOST environment variable.

Changed

• Update to Code 1.82.2. This includes an update to Node 18, which also means
  that the minimum glibc is now 2.28. If you need to maintain a lower glibc then
  you can take a version of Node 18 that is compiled with a lower glibc and use
  that to build code-server (or at a minimum rebuild the native modules).
• Display paths to config files in full rather than abbreviated. If you have
  trouble with the password not working please update and make sure the
  displayed config paths are what you expect.

Fixed

• Fix some dependency issues for the standalone arm64 and armv7l releases. If
  you had issues with missing or failing modules please try these new builds.

v4.16.1

Compare Source

Code v1.80.2

Changed

• Updated to Code 1.80.2.

v4.16.0

Compare Source

Code v1.80.1

Added

• --disable-proxy flag. This disables the domain and path proxies but it does not disable the ports panel in Code. That can be disabled by using remote.autoForwardPorts=false in your settings.

v4.15.0

Compare Source

Code v1.80.1

Changed

• Updated to Code 1.80.1.

Added

• --trusted-origin flag for specifying origins that you trust but do not control (for example a reverse proxy).

v4.14.1

Compare Source

Code v1.79.2

Security

• Remove extra write permissions on the Node binary bundled with the linux-amd64
  tarball. If you extract the tar without a umask this could mean the Node
  binary would be unexpectedly writable.

Fixed

• Inability to launch multiple instances of code-server for different users.

Added

• --session-socket CLI flag to configure the location of the session socket.
  By default it will be placed in <user data dir>/code-server-ipc.sock.

v4.14.0

Compare Source

Code v1.79.2

Added

• --domain-proxy now supports {{port}} and {{host}} template variables.

Changed

• Updated to Code 1.79.2
• Files opened from an external terminal will now open in the most closely related window rather than in the last opened window.

v4.13.0

Compare Source

Code v1.78.2

Changed

• Updated to Code 1.78.2.

Fixed

• Proxying files that contain non-ASCII characters.
• Origin check when X-Forwarded-Host contains comma-separated hosts.

v4.12.0

Compare Source

Code v1.77.3

Changed

• Updated to Code 1.77.3
• Ports panel will use domain-based proxy (instead of the default path-based
  proxy) when set via --proxy-domain.
• Apply --app-name to the PWA title.

Added

• Thai translation for login page.
• Debug logs around the origin security check. If you are getting forbidden
  errors on web sockets please run code-server with --log debug to see why the
  requests are being blocked.

v4.11.0

Compare Source

Code v1.76.1

Changed

Updated to Code 1.76.1

v4.10.1

Compare Source

Code v1.75.1

Security

Added an origin check to web sockets to prevent cross-site hijacking attacks on
users using older or niche browser that do not support SameSite cookies and
attacks across sub-domains that share the same root domain.

The check requires the host header to be set so if you use a reverse proxy
ensure it forwards that information otherwise web sockets will be blocked.

v4.10.0

Compare Source

Code v1.75.1

Changed

• Updated to Code 1.75.1

Removed

• Removed --link (was deprecated over thirteen months ago in 4.0.1).

v4.9.1

Compare Source

Code v1.73.1

Changed

• Updated a couple steps in the build and release process to ensure we're using
  npm and yarn consistently depending on the step.

Fixed

• Fixed an issue with code-server version not displaying in the Help > About window.
• Fixed terminal not loading on macOS clients.

v4.9.0

Compare Source

Code v1.73.1

Changed

• Upgraded to Code 1.73.1

Added

• /security.txt added as a route with info on our security policy information thanks to @​ghuntley

Fixed

• Installing on majaro images should now work thanks to @​MrPeacockNLB for
  adding the --noconfirm flag in install.sh

Known Issues

• --cert on Ubuntu 22.04: OpenSSL v3 is used which breaks pem meaning the
  --cert feature will not work. Reference

v4.8.3

Compare Source

Code v1.72.1

Added

• install script now supports arch-like (i.e. manjaro, endeavourous, etc.)
  architectures

Changed

• Updated text in the Getting Started page.

v4.8.2

Compare Source

Code v1.72.1

Added

• New text in the Getting Started page with info about
  coder/coder. This is enabled by default but can be disabled by passing the CLI
  flag --disable-getting-started-override or setting
  CS_DISABLE_GETTING_STARTED_OVERRIDE=1 or
  CS_DISABLE_GETTING_STARTED_OVERRIDE=true.

v4.8.1

Compare Source

Code v1.72.1

Fixed

• Fixed CSP error introduced in 4.8.0 that caused issues with webviews and most
  extensions.

v4.8.0

Compare Source

Code v1.72.1

Added

• Support for the Ports panel which leverages code-server's built-in proxy. It
  also uses VSCODE_PROXY_URI where {{port}} is replace when forwarding a port.
  Example: VSCODE_PROXY_URI=https://{{port}}.kyle.dev would forward an
  application running on localhost:3000 to https://3000.kyle.dev
• Support for --disable-workspace-trust CLI flag
• Support for opening a file from the command line at a specific line:column
• Added Ubuntu-based images for Docker releases. If you run into issues with
  PATH being overwritten in Docker please try the Ubuntu image as this is a
  problem in the Debian base image.

Changed

• Updated Code to 1.72.1

Fixed

• Enabled BROWSER environment variable
• Patched asExternalUri to work so now extensions run inside code-server can use it

v4.7.1

Compare Source

Code v1.71.2

Changed

• Updated Code to 1.71.2

Fixed

• Fixed install script not upgrading code-server when already installed on RPM-based machines
• Fixed install script failing to gain root permissions on FreeBSD

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.