Update Code to 1.123

.github/dependabot.yaml

@@ -16,6 +16,8 @@ updates:
       interval: "monthly"
       time: "06:00"
       timezone: "America/Chicago"
+    commit-message:
+      prefix: "chore"
     labels: []
     ignore:
       # Ignore patch updates for all dependencies

.github/workflows/build.yaml

@@ -144,7 +144,7 @@ jobs:
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
       - run: npm run test:unit
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         if: success()
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -163,7 +163,7 @@ jobs:
 
     steps:
       - run: sudo apt update && sudo apt install -y libkrb5-dev
-      - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # latest
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
         with:
           packages: quilt
           version: 1.0

.github/workflows/publish.yaml

@@ -93,7 +93,7 @@ jobs:
         run: |
           git checkout -b update-version-${{ env.VERSION }}
           git add .
-          git commit -m "Update to ${{ env.VERSION }}"
+          git commit -m "chore: updating version to ${{ env.VERSION }}"
           git push -u origin $(git branch --show)
           gh pr create --repo coder/code-server-aur --title "chore: bump version to ${{ env.VERSION }}" --body "PR opened by @$GITHUB_ACTOR" --assignee $GITHUB_ACTOR
 
@@ -109,8 +109,8 @@ jobs:
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:

.github/workflows/release.yaml

@@ -39,6 +39,9 @@ jobs:
           - npm_arch: arm64
             vscode_arch: arm64
             package_arch: arm64
+          - npm_arch: arm
+            vscode_arch: armhf
+            package_arch: armv7l
 
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -59,7 +62,7 @@ jobs:
 
     steps:
       - run: sudo apt update && sudo apt install -y libkrb5-dev
-      - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # latest
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
         with:
           packages: quilt
           version: 1.0
@@ -110,7 +113,7 @@ jobs:
       - run: |
           sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
         if: ${{ matrix.vscode_arch == 'x64' }}
-      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
@@ -123,7 +126,7 @@ jobs:
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
       - run: npm run package
-      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
@@ -189,7 +192,7 @@ jobs:
       - run: npm run test:native
 
       - run: npm run package
-      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           draft: true
           discussion_category_name: "📣 Announcements"

.github/workflows/update.yaml

@@ -47,7 +47,7 @@ jobs:
             echo done=false >> $GITHUB_OUTPUT
           fi
 
-      - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # latest
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
         if: steps.check.outputs.done == 'false'
         with:
           packages: quilt

.node-version

@@ -1 +1 @@
-24.15.0
+22.22.1

CHANGELOG.md

@@ -22,31 +22,11 @@ Code v99.99.999
 
 ## Unreleased
 
-## [4.124.2](https://github.com/coder/code-server/releases/tag/v4.124.2) - 2026-06-16
+Code v1.123
-
-Code v1.124.2
-
-### Security
-
-- Strip code-server's session token from the cookie before proxying to a local
-  port. Previously, when you used built-in password authentication, the cookie
-  would be sent to the local proxied port, which meant if the service was
-  malicious and not already running as your code-server user it could use the
-  cookie to log into code-server and execute commands as your code-server user.
 
 ### Changed
 
-- Update to Code 1.124.2
+- Update to Code 1.123
-
-## [4.123.0](https://github.com/coder/code-server/releases/tag/v4.123.0) - 2026-06-03
-
-Code v1.123.0
-
-### Changed
-
-- Update to Code 1.123.0
-- Microsoft dropped support for armhf remotes so there will no longer be any
-  builds for armhf.
 
 ## [4.122.1](https://github.com/coder/code-server/releases/tag/v4.122.1) - 2026-06-02
 

ci/build/build-release.sh

@@ -128,9 +128,7 @@ bundle_vscode() {
 
   # Merge the package.json for the web/remote server so we can include
   # dependencies, since we want to ship this via NPM.
-  # Also override the name to prevent vulnerability scanners from
+  jq --slurp '.[0] * .[1]' \
-  # misidentifying this package as VS Code (see #7071).
-  jq --slurp '.[0] * .[1] | .name = "code-oss-dev"' \
     "$VSCODE_SRC_PATH/remote/package.json" \
     "$VSCODE_OUT_PATH/package.json" > "$VSCODE_OUT_PATH/package.json.merged"
   mv "$VSCODE_OUT_PATH/package.json.merged" "$VSCODE_OUT_PATH/package.json"

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.39.0
+version: 3.37.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.124.2
+appVersion: 4.122.1

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.124.2'
+  tag: '4.122.1'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a

docs/install.md

@@ -101,8 +101,9 @@ _exact_ same commands presented in the rest of this document.
 We recommend installing with `npm` when:
 
 1. You aren't using a machine with `amd64` or `arm64`.
-2. You're on Linux with `glibc` < v2.28 or `glibcxx` < v3.4.21.
+2. You are installing code-server on Windows.
-3. You're running Alpine Linux or are using a non-glibc libc. See
+3. You're on Linux with `glibc` < v2.28 or `glibcxx` < v3.4.21.
+4. You're running Alpine Linux or are using a non-glibc libc. See
    [#1430](https://github.com/coder/code-server/issues/1430#issuecomment-629883198)
    for more information.
 
@@ -295,7 +296,8 @@ You can install code-server using the [Helm package manager](https://coder.com/d
 ## Windows
 
 We currently [do not publish Windows
-releases](https://github.com/coder/code-server/issues/1397).
+releases](https://github.com/coder/code-server/issues/1397). We recommend
+installing code-server onto Windows with [`npm`](#npm).
 
 ## Raspberry Pi
 

package-lock.json

@@ -13,13 +13,12 @@
         "@coder/logger": "^3.0.1",
         "argon2": "^0.44.0",
         "compression": "^1.7.4",
-        "cookie": "^1.1.1",
         "cookie-parser": "^1.4.6",
         "env-paths": "^2.2.1",
         "express": "^5.0.1",
         "http-proxy": "^1.18.1",
         "httpolyglot": "^0.1.2",
-        "i18next": "^26.3.1",
+        "i18next": "^25.8.3",
         "js-yaml": "^4.1.0",
         "limiter": "^2.1.0",
         "pem": "^1.14.8",
@@ -58,7 +57,7 @@
         "eslint-import-resolver-typescript": "^4.4.4",
         "eslint-plugin-import": "^2.28.1",
         "eslint-plugin-prettier": "^5.0.0",
-        "globals": "^17.6.0",
+        "globals": "^16.1.0",
         "prettier": "3.8.3",
         "prettier-plugin-sh": "^0.18.0",
         "ts-node": "^10.9.1",
@@ -69,6 +68,15 @@
         "node": "22"
       }
     },
+    "node_modules/@babel/runtime": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
+      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
     "node_modules/@coder/logger": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/@coder/logger/-/logger-3.0.1.tgz",
@@ -960,9 +968,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.6",
+      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1928,16 +1936,12 @@
       }
     },
     "node_modules/cookie": {
-      "version": "1.1.1",
+      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.6"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie-parser": {
@@ -1953,15 +1957,6 @@
         "node": ">= 0.8.0"
       }
     },
-    "node_modules/cookie-parser/node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -2958,15 +2953,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/express/node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/express/node_modules/cookie-signature": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
@@ -3324,9 +3310,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.6.0",
+      "version": "16.5.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
-      "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==",
+      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3546,26 +3532,29 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.3.1",
+      "version": "25.8.13",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.8.13.tgz",
-      "integrity": "sha512-txQqd5EULsqEh9OJqRH15aCaOuy/nLJyhw5EHCSKLKJE1aBbb3Zve2+uQIxgWhPm1QqUQoWyQBm2kfmmIrzkcQ==",
+      "integrity": "sha512-E0vzjBY1yM+nsFrtgkjLhST2NBkirkvOVoQa0MSldhsuZ3jUge7ZNpuwG0Cfc74zwo5ZwRzg3uOgT+McBn32iA==",
       "funding": [
         {
           "type": "individual",
-          "url": "https://www.locize.com/i18next"
+          "url": "https://locize.com"
+        },
+        {
+          "type": "individual",
+          "url": "https://locize.com/i18next.html"
         },
         {
           "type": "individual",
           "url": "https://www.i18next.com/how-to/faq#i18next-is-awesome.-how-can-i-support-the-project"
-        },
-        {
-          "type": "individual",
-          "url": "https://www.locize.com"
         }
       ],
       "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.28.4"
+      },
       "peerDependencies": {
-        "typescript": "^5 || ^6"
+        "typescript": "^5"
       },
       "peerDependenciesMeta": {
         "typescript": {
@@ -4141,19 +4130,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
+      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -6634,9 +6613,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.0",
+      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package.json

@@ -59,7 +59,7 @@
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.28.1",
     "eslint-plugin-prettier": "^5.0.0",
-    "globals": "^17.6.0",
+    "globals": "^16.1.0",
     "prettier": "3.8.3",
     "prettier-plugin-sh": "^0.18.0",
     "ts-node": "^10.9.1",
@@ -70,13 +70,12 @@
     "@coder/logger": "^3.0.1",
     "argon2": "^0.44.0",
     "compression": "^1.7.4",
-    "cookie": "^1.1.1",
     "cookie-parser": "^1.4.6",
     "env-paths": "^2.2.1",
     "express": "^5.0.1",
     "http-proxy": "^1.18.1",
     "httpolyglot": "^0.1.2",
-    "i18next": "^26.3.1",
+    "i18next": "^25.8.3",
     "js-yaml": "^4.1.0",
     "limiter": "^2.1.0",
     "pem": "^1.14.8",

patches/disable-builtin-ext-update.diff

@@ -7,7 +7,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -345,6 +345,10 @@ export class Extension implements IExten
+@@ -344,6 +344,10 @@ export class Extension implements IExten
  			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
  				return false;
  			}

patches/webview.diff

@@ -70,8 +70,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-nXjtuhBilO++r8hfxl5VjEScSmdm07wDAk6jw228DgM=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-q+WTr+fBXpLLE3++yWNaxT6BTWQtsKscoeIlynBRk4E=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-m1DlJtsIJd46QuWYNcsaYIG1xI+9FyjKQu+cfp+zq5Q=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"

src/node/i18n/index.ts

@@ -54,6 +54,7 @@ init({
   lowerCaseLng: true,
   debug: process.env.NODE_ENV === "development",
   resources: defaultResources,
+  showSupportNotice: false,
 })
 
 export default i18next

src/node/proxy.ts

@@ -1,7 +1,5 @@
-import * as cookie from "cookie"
-import type { Request } from "express"
 import proxyServer from "http-proxy"
-import { getCookieSessionName, HttpCode } from "../common/http"
+import { HttpCode } from "../common/http"
 
 export const proxy = proxyServer.createProxyServer({})
 
@@ -20,19 +18,6 @@ proxy.on("error", (error, _, res) => {
   }
 })
 
-// Strip the code-server cookie if it exists to avoid transmitting the cookie
-// to potentially malicious local ports.
-proxy.on("proxyReq", (preq, req) => {
-  const cookieSessionName = getCookieSessionName((req as Request).args["cookie-suffix"])
-  preq.setHeader(
-    "Cookie",
-    cookie.stringifyCookie({
-      ...(req as Request).cookies,
-      [cookieSessionName]: undefined,
-    }),
-  )
-})
-
 // Intercept the response to rewrite absolute redirects against the base path.
 // Is disabled when the request has no base path which means /absproxy is in use.
 proxy.on("proxyRes", (res, req) => {

test/e2e/codeServer.test.ts

@@ -32,7 +32,7 @@ describe("code-server", ["--disable-workspace-trust"], {}, () => {
 
   test("should show the Integrated Terminal", async ({ codeServerPage }) => {
     await codeServerPage.focusTerminal()
-    await expect(codeServerPage.page.locator("#terminal")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("#terminal")).toBe(true)
   })
 
   test("should open a file", async ({ codeServerPage }) => {

test/e2e/downloads.test.ts

@@ -18,7 +18,7 @@ describe("Downloads (enabled)", ["--disable-workspace-trust"], {}, async () => {
     // Action
     await codeServerPage.openContextMenu("text=unique-file.txt")
 
-    await expect(codeServerPage.page.locator("text=Download...")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Download...")).toBe(true)
   })
 
   test("should see the 'Show Local' button on Save As", async ({ codeServerPage }) => {
@@ -37,7 +37,7 @@ describe("Downloads (enabled)", ["--disable-workspace-trust"], {}, async () => {
     await codeServerPage.page.keyboard.type("Making some edits.")
     await codeServerPage.navigateMenus(["File", "Save As..."])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(true)
   })
 
   test("should see the 'Show Local' button on Save File", async ({ codeServerPage }) => {
@@ -46,14 +46,14 @@ describe("Downloads (enabled)", ["--disable-workspace-trust"], {}, async () => {
     await codeServerPage.waitForTab("Untitled-1")
     await codeServerPage.navigateMenus(["File", "Save"])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(true)
   })
 
   test("should see the 'Show Local' button on Save Workspace As", async ({ codeServerPage }) => {
     // Action
     await codeServerPage.navigateMenus(["File", "Save Workspace As..."])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(true)
   })
 })
 
@@ -72,7 +72,7 @@ describe("Downloads (disabled)", ["--disable-workspace-trust", "--disable-file-d
     // Action
     await codeServerPage.openContextMenu("text=unique-file.txt")
 
-    await expect(codeServerPage.page.locator("text=Download...")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Download...")).toBe(false)
   })
 
   test("should not see the 'Show Local' button on Save as", async ({ codeServerPage }) => {
@@ -87,7 +87,7 @@ describe("Downloads (disabled)", ["--disable-workspace-trust", "--disable-file-d
     await codeServerPage.openFile(fileName)
     await codeServerPage.page.click(".tab")
     await codeServerPage.navigateMenus(["File", "Save As..."])
-    await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(false)
   })
 
   test("should not see the 'Show Local' button on Save File", async ({ codeServerPage }) => {
@@ -96,13 +96,13 @@ describe("Downloads (disabled)", ["--disable-workspace-trust", "--disable-file-d
     await codeServerPage.waitForTab("Untitled-1")
     await codeServerPage.navigateMenus(["File", "Save"])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(false)
   })
 
   test("should not see the 'Show Local' button on Save Workspace As", async ({ codeServerPage }) => {
     // Action
     await codeServerPage.navigateMenus(["File", "Save Workspace As..."])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(false)
   })
 })

test/e2e/extensions.test.ts

@@ -13,7 +13,7 @@ function runTestExtensionTests() {
 
     // Remove end slash in address.
     const normalizedAddress = address.replace(/\/+$/, "")
-    await expect(codeServerPage.page.getByText(`Info: proxyUri: ${normalizedAddress}/proxy/{{port}}/`)).toBeVisible()
+    await codeServerPage.page.getByText(`Info: proxyUri: ${normalizedAddress}/proxy/{{port}}/`)
   })
 }
 

test/e2e/github.test.ts

@@ -12,7 +12,7 @@ if (process.env.GITHUB_TOKEN) {
       await codeServerPage.page.click("text=Allow")
       // It should ask to select an account, one of which will be the one we
       // pre-injected.
-      await expect(codeServerPage.page.locator("text=Select an account")).not.toBeVisible()
+      expect(await codeServerPage.page.isVisible("text=Select an account")).toBe(false)
     })
   })
 
@@ -26,7 +26,7 @@ if (process.env.GITHUB_TOKEN) {
       await codeServerPage.page.click("text=Allow")
       // Since there is no account it will ask directly for the token (because
       // we are on localhost; otherwise it would initiate the oauth flow).
-      await expect(codeServerPage.page.locator("text=GitHub Personal Access Token")).not.toBeVisible()
+      expect(await codeServerPage.page.isVisible("text=GitHub Personal Access Token")).toBe(false)
     })
   })
 } else {

test/e2e/login.test.ts

@@ -24,8 +24,8 @@ describe("login", ["--disable-workspace-trust", "--auth", "password"], {}, () =>
     // Skip entering password
     // Click the submit button and login
     await codeServerPage.page.click(".submit")
-    // The required input blocks empty submits, so the server-side error can't render.
+    await codeServerPage.page.waitForLoadState("networkidle")
-    await expect(codeServerPage.page.locator("input.password:invalid")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Missing password"))
   })
 
   test("should see an error message for incorrect password", async ({ codeServerPage }) => {
@@ -34,29 +34,28 @@ describe("login", ["--disable-workspace-trust", "--auth", "password"], {}, () =>
     // Click the submit button and login
     await codeServerPage.page.click(".submit")
     await codeServerPage.page.waitForLoadState("networkidle")
-    await expect(codeServerPage.page.locator("text=Incorrect password")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Incorrect password"))
   })
 
   test("should hit the rate limiter for too many unsuccessful logins", async ({ codeServerPage }) => {
-    test.slow()
+    // Type in password
+    await codeServerPage.page.fill(".password", "password123")
     // Click the submit button and login
     // The current RateLimiter allows 2 logins per minute plus
     // 12 logins per hour for a total of 14
     // See: src/node/routes/login.ts
     for (let i = 1; i <= 14; i++) {
-      await codeServerPage.page.fill(".password", "password123")
       await codeServerPage.page.click(".submit")
       await codeServerPage.page.waitForLoadState("networkidle")
       // We double-check that the correct error message shows
       // which should be for incorrect password
-      await expect(codeServerPage.page.locator("text=Incorrect password")).toBeVisible()
+      expect(await codeServerPage.page.isVisible("text=Incorrect password"))
     }
 
     // The 15th should fail for a different reason:
     // login rate
-    await codeServerPage.page.fill(".password", "password123")
     await codeServerPage.page.click(".submit")
     await codeServerPage.page.waitForLoadState("networkidle")
-    await expect(codeServerPage.page.locator("text=Login rate limited!")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Login rate limited!"))
   })
 })

test/e2e/uploads.test.ts

@@ -18,14 +18,14 @@ describe("Uploads (enabled)", ["--disable-workspace-trust"], {}, () => {
     // Action
     await codeServerPage.openContextMenu('span:has-text("test-directory")')
 
-    await expect(codeServerPage.page.locator("text=Upload...")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Upload...")).toBe(true)
   })
 
   test("should see the 'Show Local' button on Open File", async ({ codeServerPage }) => {
     // Action
     await codeServerPage.navigateMenus(["File", "Open File..."])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(true)
   })
 })
 
@@ -44,13 +44,13 @@ describe("Uploads (disabled)", ["--disable-workspace-trust", "--disable-file-upl
     // Action
     await codeServerPage.openContextMenu('span:has-text("test-directory")')
 
-    await expect(codeServerPage.page.locator("text=Upload...")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Upload...")).toBe(false)
   })
 
   test("should not see the 'Show Local' button on Open File", async ({ codeServerPage }) => {
     // Action
     await codeServerPage.navigateMenus(["File", "Open File..."])
     await codeServerPage.page.waitForSelector(".quick-input-widget")
-    await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
+    expect(await codeServerPage.page.isVisible("text=Show Local")).toBe(false)
   })
 })

test/package-lock.json

@@ -2336,17 +2336,17 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.6",
+      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.4",
+        "hasown": "^2.0.2",
-        "mime-types": "^2.1.35"
+        "mime-types": "^2.1.12"
       },
       "engines": {
         "node": ">= 6"
@@ -2561,9 +2561,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.4",
+      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3602,16 +3602,16 @@
       }
     },
     "node_modules/jsdom/node_modules/form-data": {
-      "version": "3.0.5",
+      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.5.tgz",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.4.tgz",
-      "integrity": "sha512-j23EibVLnp4zNXGW7LjryXYa2X6U/M96yoOX+ybZxwkYajdxRNEqYY3zhh7y0i6kfISKS2jr+EJq1YTUDEv5+w==",
+      "integrity": "sha512-f0cRzm6dkyVYV3nPoooP8XlccPQukegwhAnpoLcXy+X+A8KfpGOoXwDr9FLZd3wzgLaBGQBE3lY93Zm/i1JvIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.4",
+        "hasown": "^2.0.2",
         "mime-types": "^2.1.35"
       },
       "engines": {

test/unit/node/heart.test.ts

@@ -115,9 +115,6 @@ describe("heartbeatTimer", () => {
     const heart = new Heart(`${testDir}/shutdown.txt`, mockIsActive)
     await heart.beat()
     jest.advanceTimersByTime(60 * 1000)
-    // Yield a real macrotask so the callback's rejection handler can run first
-    // (fake timers stub the global setImmediate).
-    await new Promise((resolve) => jest.requireActual("timers").setImmediate(resolve))
 
     expect(mockIsActive).toHaveBeenCalled()
     expect(logger.warn).toHaveBeenCalledWith(errorMsg)
@@ -150,7 +147,7 @@ describe("stateChange", () => {
 
     expect(mockOnChange.mock.calls[0][0]).toBe("alive")
   })
-  it("should change to expired when not active", async () => {
+  it.only("should change to expired when not active", async () => {
     jest.useFakeTimers()
     heart = new Heart(`${testDir}/shutdown.txt`, () => new Promise((resolve) => resolve(false)))
     const mockOnChange = jest.fn()

test/unit/node/proxy.test.ts

@@ -1,12 +1,15 @@
 import * as express from "express"
+import * as http from "http"
+import nodeFetch from "node-fetch"
 import { HttpCode } from "../../../src/common/http"
+import { proxy } from "../../../src/node/proxy"
 import { wss, Router as WsRouter } from "../../../src/node/wsRouter"
-import { mockLogger } from "../../utils/helpers"
+import { getAvailablePort, mockLogger } from "../../utils/helpers"
 import * as httpserver from "../../utils/httpserver"
 import * as integration from "../../utils/integration"
 
 describe("proxy", () => {
-  const proxyTarget = new httpserver.HttpServer()
+  const nhooyrDevServer = new httpserver.HttpServer()
   const wsApp = express.default()
   const wsRouter = WsRouter()
   let codeServer: httpserver.HttpServer | undefined
@@ -16,22 +19,21 @@ describe("proxy", () => {
 
   beforeAll(async () => {
     wsApp.use("/", wsRouter.router)
-    await proxyTarget.listen((req, res) => {
+    await nhooyrDevServer.listen((req, res) => {
       e(req, res)
     })
-    proxyTarget.listenUpgrade(wsApp)
+    nhooyrDevServer.listenUpgrade(wsApp)
-    proxyPath = `/proxy/${proxyTarget.port()}/wsup`
+    proxyPath = `/proxy/${nhooyrDevServer.port()}/wsup`
     absProxyPath = proxyPath.replace("/proxy/", "/absproxy/")
   })
 
   afterAll(async () => {
-    await proxyTarget.dispose()
+    await nhooyrDevServer.dispose()
   })
 
   beforeEach(() => {
     e = express.default()
     mockLogger()
-    delete process.env.PASSWORD
   })
 
   afterEach(async () => {
@@ -281,42 +283,65 @@ describe("proxy", () => {
     const resp = await codeServer.fetch(proxyPath, { method: "OPTIONS" })
     expect(resp.status).toBe(200)
   })
-
-  it("should return a 500 when no target is running ", async () => {
-    const target = new httpserver.HttpServer()
-    await target.listen(() => {})
-    const port = target.port()
-    target.dispose()
-    codeServer = await integration.setup(["--auth=none"], "")
-    const resp = await codeServer.fetch(`/proxy/${port}/wsup`)
-    expect(resp.status).toBe(HttpCode.ServerError)
-    expect(resp.statusText).toBe("Internal Server Error")
 })
 
-  it("should strip token cookie", async () => {
+// NOTE@jsjoeio
-    const token = "my-super-secure-token"
+// Both this test suite and the one above it are very similar
-    process.env.HASHED_PASSWORD = token
+// The main difference is this one uses http and node-fetch
-    codeServer = await integration.setup(["--auth=password"])
+// and specifically tests the proxy in isolation vs. using
+// the httpserver abstraction we've built.
+//
+// Leaving this as a separate test suite for now because
+// we may consider refactoring the httpserver abstraction
+// in the future.
+//
+// If you're writing a test specifically for code in
+// src/node/proxy.ts, you should probably add it to
+// this test suite.
+describe("proxy (standalone)", () => {
+  let URL = ""
+  let PROXY_URL = ""
+  let testServer: http.Server
+  let proxyTarget: http.Server
 
-    // Set up a listener that just prints the cookies it got.
+  beforeEach(async () => {
-    e.get("/wsup/cookies", (req, res) => {
+    const PORT = await getAvailablePort()
-      res.writeHead(HttpCode.Ok, { "Content-Type": "text/plain" })
+    const PROXY_PORT = await getAvailablePort()
-      res.end(req.headers.cookie)
+    URL = `http://localhost:${PORT}`
+    PROXY_URL = `http://localhost:${PROXY_PORT}`
+    // Define server and a proxy server
+    testServer = http.createServer((req, res) => {
+      proxy.web(req, res, {
+        target: PROXY_URL,
+      })
     })
 
-    // Send the token along with other cookies which should be preserved.
+    proxyTarget = http.createServer((req, res) => {
-    // Encode one to make sure they are being re-encoded properly.
+      res.writeHead(200, { "Content-Type": "text/plain" })
-    const value = "hello=there"
+      res.end()
-    const encodedValue = encodeURIComponent(value)
-    const resp = await codeServer.fetch(proxyPath + "/cookies", {
-      headers: {
-        cookie: `cookie1=${encodedValue}; code-server-session=${token}; cookie2=hello;`,
-      },
     })
 
-    // The proxied listener should not have printed the code-server token.
+    // Start both servers
+    proxyTarget.listen(PROXY_PORT)
+    testServer.listen(PORT)
+  })
+
+  afterEach(async () => {
+    testServer.close()
+    proxyTarget.close()
+  })
+
+  it("should return a 500 when proxy target errors ", async () => {
+    // Close the proxy target so that proxy errors
+    proxyTarget.close()
+    const errorResp = await nodeFetch(`${URL}/error`)
+    expect(errorResp.status).toBe(HttpCode.ServerError)
+    expect(errorResp.statusText).toBe("Internal Server Error")
+  })
+
+  it("should proxy correctly", async () => {
+    const resp = await nodeFetch(`${URL}/route`)
     expect(resp.status).toBe(200)
-    const text = await resp.text()
+    expect(resp.statusText).toBe("OK")
-    expect(text).toBe(`cookie1=${encodedValue}; cookie2=hello`)
   })
 })