Code v1.145.2

Changed

• Update to Code 1.145.2

Code v1.145.0

Security

• Strip code-server's cookie from web socket requests going over the built-in
  proxy. We were already doing this for regular proxied HTTP requests, but not
  for proxied web sockets.
• Add HttpOnly to cookies to prevent them from being accessed by JavaScript
  proxied over the built-in proxy.

Changed

• Update to Code 1.145.0

Added

• Vietnamese locale.
• New flag --disable-file-cache that keeps workspace files out of the browser
  cache. It stops the webview service worker from storing them in Cache Storage
  and serves them from /vscode-remote-resource with Cache-Control: no-store.
  Extension files will still be cached.

Code v1.144.0

Changed

• Update to Code 1.144.0

Fixed

• --socket-fd now works: the inherited socket is passed on to the process
  that listens, and the address is logged as fd:<n>. Previously code-server
  failed with listen EEXIST or Server has no address.
• The cookie domain was not being set against the shared root host of proxy
  domains when proxy domains contained template variables like {{port}},
  resulting in having to sign in multiple times per domain instead of only once
  as originally intended.
• When doing the web socket origin check, if the host does not already contain a
  port, fall back to X-Forwarded-Port.
• Fix default ports not matching in the web socket origin check (for example
  https://coder.com will now match https://coder.com:443).

Code v1.143.1

Changed

• Update to Code 1.143.1

Security

• Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the
  Brotli decoder (CVE-2026-111497).
• Reject compressed request bodies (Content-Encoding: br, gzip, or
  deflate) instead of decompressing them.

Fixed

• Boolean flags in the --flag=false form and in the config file now respect
  being set to false.

Added

• Turkish locale.

Changed

• Expand values from path options in the config file that start with a tilde.

Code v1.141.0

Added

• A new --enable-remote-storage flag can be used to make code-server persist
  workbench storage on the remote server instead of browser storage. Use this if
  you want to share storage between multiple devices.

Fixed

• The Typescript extension was trying to load as a browser extension even though
  we build the remote server version, causing it to fail to activate.

Changed

• Update to Code 1.141.0

Code v1.140.0

Changed

• Update to Code 1.140.0

Code v1.139.1

Changed

• Update to Code 1.139.1

Fixed

• --idle-timeout-seconds was only validated when passed as
  --idle-timeout-seconds=<value>; values of 60 or less passed as
  --idle-timeout-seconds <value> were silently accepted.

Code v1.138.0

Changed

• Update to Code 1.138.0

Fixed

• Preserve the original path, query parameters, and fragment when rewriting
  localhost URLs through the port proxy. If VSCODE_PROXY_URI has any query
  parameters or fragments, those will be lost.

Code v1.137.0

Changed

• Update to Code 1.137.0

Added

• Windows releases are now available.