Skip to content

Merge in changes#11

Open
dylanturn wants to merge 1040 commits into
turnbros:mainfrom
coder:main
Open

Merge in changes#11
dylanturn wants to merge 1040 commits into
turnbros:mainfrom
coder:main

Conversation

@dylanturn

Copy link
Copy Markdown
Member

Fixes #

env?: NodeJS.ProcessEnv,
): Promise<{ stdout: string; stderr: string }> {
const CODE_SERVER_COMMAND = process.env.CODE_SERVER_PATH || path.resolve("../../release-standalone/bin/code-server")
const { stdout, stderr } = await promisify(exec)(`${CODE_SERVER_COMMAND} ${argv.join(" ")}`, {

Check warning

Code scanning / CodeQL

Shell command built from environment values

This shell command depends on an uncontrolled [absolute path](1).
@github-advanced-security

Copy link
Copy Markdown

You have successfully added a new CodeQL configuration .github/workflows/security.yaml:codeql-analyze. As part of the setup process, we have scanned this repository and found 2 existing alerts. Please check the repository Security tab to see all alerts.

It seems that this causes browser to not send cookies, which can result
in a 401.

Fixes #7389.
cdrci and others added 29 commits June 15, 2026 22:28
Co-authored-by: cdrci <opensource@coder.com>
The changelog is manually curated so the prefixes are noise.
We need to properly support Windows before we can recommend any method
of installation, including npm.
- Get rid of the global isActive mock; in particular the way it shadows
  local ones seemed sketchy.
- No need for requireActual from my testing.
- Reword the comment for why we need setImmediate.
- Add the setImmediate to another test that seemed to only pass because
  of an await on the timer call which is not actually a promise but had
  the side effect of yielding.
- Always set fake/real timers in the before/after handlers and never in
  individual tests.
The -dev seems a bit weird since it is not a dev version once it is
built, and also there is a false positive advisory with the code-oss-dev
name.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.