Update Code to 1.145.0

CHANGELOG.md

@@ -22,12 +22,27 @@ Code v99.99.999
 
 ## Unreleased
 
+Code v1.145.0
+
+### Security
+
+- Strip code-server's cookie from web socket requests going over the built-in
+  proxy. We were already doing this for regular proxied HTTP requests, but not
+  for proxied web sockets.
+- Add HttpOnly to cookies to prevent them from being accessed by JavaScript
+  proxied over the built-in proxy.
+
+### Changed
+
+- Update to Code 1.145.0
+
 ### Added
 
-- `--disable-file-cache` keeps workspace files out of the browser cache. It
-  stops the webview service worker from storing them in Cache Storage and
-  serves them from `/vscode-remote-resource` with `Cache-Control: no-store`.
-  Extension files stay cached.
+- Vietnamese locale.
+- New flag `--disable-file-cache` that keeps workspace files out of the browser
+  cache. It stops the webview service worker from storing them in Cache Storage
+  and serves them from `/vscode-remote-resource` with `Cache-Control: no-store`.
+  Extension files will still be cached.
 
 ## [4.144.0](https://github.com/coder/code-server/releases/tag/v4.144.0) - 2026-10-29
 

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -262,7 +262,9 @@ class RemoteAuthoritiesImpl {
+@@ -263,7 +263,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,

patches/csp-hashes.diff

@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
 
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-Q3Tfcw0dGu/YD4dGBrRqBeOnmRMAH8HbKxArK4YSXBc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-BmcTt6YZr75RujSQ3gF/UQL77e1RrOx62jNeikpwtxc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-29YeDbmHnhN2BgMJKVq7vDCMiuya6rpEctI6SkJFfJc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-PrK0S1PGjGJseEIewxhvBTIw2x6Ci21IJIkOZ3gFWMg=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"

patches/disable-file-cache.diff

@@ -113,8 +113,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl
 +import { IBrowserWorkbenchEnvironmentService } from '../../../services/environment/browser/environmentService.js';
  import { IWorkbenchEnvironmentService } from '../../../services/environment/common/environmentService.js';
  import { IRemoteAgentService } from '../../../services/remote/common/remoteAgentService.js';
- import { decodeAuthority, webviewGenericCspSource, webviewRootResourceAuthority } from '../common/webview.js';
-@@ -864,6 +865,8 @@ export class WebviewElement extends Disp
+ import { decodeAuthority, webviewGenericCspSource, webviewMouseActivityEvent, webviewRootResourceAuthority } from '../common/webview.js';
+@@ -868,6 +869,8 @@ export class WebviewElement extends Disp
  					const rangeHeader = range
  						? `bytes ${range.start}-${rangeEnd}/${result.size}`
  						: undefined;
@@ -123,7 +123,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl
  					if (WebviewElement._supportsTransferableStreams.value) {
  						let controller: ReadableStreamDefaultController<Uint8Array<ArrayBuffer>> | undefined;
  						let closed = false;
-@@ -915,7 +918,7 @@ export class WebviewElement extends Disp
+@@ -919,7 +922,7 @@ export class WebviewElement extends Disp
  							status: range ? 206 : 200,
  							path: uri.path,
  							mime: result.mimeType,
@@ -132,7 +132,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl
  							mtime: result.mtime,
  							range: rangeHeader,
  							stream,
-@@ -927,7 +930,7 @@ export class WebviewElement extends Disp
+@@ -931,7 +934,7 @@ export class WebviewElement extends Disp
  							status: range ? 206 : 200,
  							path: uri.path,
  							mime: result.mimeType,
@@ -141,7 +141,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/webviewEl
  							mtime: result.mtime,
  							range: rangeHeader,
  						});
-@@ -984,6 +987,14 @@ export class WebviewElement extends Disp
+@@ -988,6 +991,14 @@ export class WebviewElement extends Disp
  		});
  	}
 

patches/external-file-actions.diff

@@ -239,8 +239,8 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
  		@IRemoteAgentService private readonly remoteAgentService: IRemoteAgentService,
  		@IPathService protected readonly pathService: IPathService,
  		@IKeybindingService private readonly keybindingService: IKeybindingService,
-@@ -362,21 +362,23 @@ export class SimpleFileDialog extends Di
- 			this.filePickBox.placeholder = nls.localize('remoteFileDialog.placeholder', "Folder path");
+@@ -365,21 +365,23 @@ export class SimpleFileDialog extends Di
+ 				: nls.localize('remoteFileDialog.placeholder', "Folder path");
  			this.filePickBox.ok = true;
  			this.filePickBox.okLabel = typeof this.options.openLabel === 'string' ? this.options.openLabel : this.options.openLabel?.withoutMnemonic;
 -			if ((this.scheme !== Schemas.file) && this.options && this.options.availableFileSystems && (this.options.availableFileSystems.length > 1) && (this.options.availableFileSystems.indexOf(Schemas.file) > -1)) {
@@ -290,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
  import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
  import { CancellationToken } from '../../../../../base/common/cancellation.js';
-@@ -1515,7 +1516,8 @@ export class FileDragAndDrop implements
+@@ -1543,7 +1544,8 @@ export class FileDragAndDrop implements
  		@IConfigurationService private configurationService: IConfigurationService,
  		@IInstantiationService private instantiationService: IInstantiationService,
  		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -300,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  	) {
  		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
  			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1740,15 +1742,17 @@ export class FileDragAndDrop implements
+@@ -1768,15 +1770,17 @@ export class FileDragAndDrop implements
 
  			// External file DND (Import/Upload file)
  			if (data instanceof NativeDragAndDropData) {

patches/integration.diff

@@ -169,15 +169,15 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -65,6 +65,7 @@ import { IOpenerService } from '../../pl
+@@ -67,6 +67,7 @@ import { IOpenerService } from '../../pl
  import { mixin, safeStringify } from '../../base/common/objects.js';
  import { IndexedDB } from '../../base/browser/indexedDB.js';
  import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js';
 +import { CodeServerClient } from '../../workbench/browser/client.js';
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -141,6 +142,9 @@ export class BrowserMain extends Disposa
+@@ -143,6 +144,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
 

patches/remote-storage.diff

@@ -196,7 +196,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  				serviceCollection.set(IStorageService, service);
  				return service;
  			})
-@@ -610,7 +611,21 @@ export class BrowserMain extends Disposa
+@@ -613,7 +614,21 @@ export class BrowserMain extends Disposa
  		}));
  	}
 
@@ -223,7 +223,7 @@ Index: code-server/lib/vscode/src/vs/sessions/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/sessions/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/sessions/browser/web.main.ts
-@@ -39,9 +39,9 @@ export class SessionsBrowserMain extends
+@@ -41,9 +41,9 @@ export class SessionsBrowserMain extends
  		_workspace: IAnyWorkspaceIdentifier,
  		environmentService: IBrowserWorkbenchEnvironmentService,
  		userDataProfileService: IUserDataProfileService,
@@ -235,7 +235,7 @@ Index: code-server/lib/vscode/src/vs/sessions/browser/web.main.ts
  		uriIdentityService: IUriIdentityService,
  		policyService: IPolicyService,
  		logService: ILogService,
-@@ -82,7 +82,7 @@ export class SessionsBrowserMain extends
+@@ -84,7 +84,7 @@ export class SessionsBrowserMain extends
  		serviceCollection.set(IWorkbenchConfigurationService, configurationService);
 
  		// Storage

patches/series

@@ -26,5 +26,5 @@ copilot.diff
 app-name.diff
 remote-storage.diff
 remote-secret-storage.diff
-csp-hashes.diff
 disable-file-cache.diff
+csp-hashes.diff

patches/webview.diff

@@ -53,7 +53,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
 +++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
-@@ -266,7 +266,7 @@
+@@ -272,7 +272,7 @@
  			}
 
  			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
@@ -62,7 +62,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  				.then(async registration => {
  					if (navigator.serviceWorker.controller) {
  						// A previous SW is already controlling. Force an update
-@@ -345,6 +345,12 @@
+@@ -351,6 +351,12 @@
 
  				const hostname = location.hostname;