Bump the bundled Node.js version Pull in Node.js security fixes (Brotli decoder RCE) ahead of upstream. Drop this patch once upstream targets this version or newer. Index: code-server/lib/vscode/remote/.npmrc =================================================================== --- code-server.orig/lib/vscode/remote/.npmrc +++ code-server/lib/vscode/remote/.npmrc @@ -1,5 +1,5 @@ disturl="https://nodejs.org/dist" -target="24.21.0" +target="24.22.1" ms_build_id="474716" runtime="node" build_from_source="true" Index: code-server/lib/vscode/build/checksums/nodejs.txt =================================================================== --- code-server.orig/lib/vscode/build/checksums/nodejs.txt +++ code-server/lib/vscode/build/checksums/nodejs.txt @@ -1,6 +1,6 @@ -bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057 node-v24.21.0-darwin-arm64.tar.gz -1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097 node-v24.21.0-darwin-x64.tar.gz -724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5 node-v24.21.0-linux-arm64.tar.gz -6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff node-v24.21.0-linux-x64.tar.gz -dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7 win-arm64/node.exe -ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32 win-x64/node.exe +89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7 node-v24.22.1-darwin-arm64.tar.gz +d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035 node-v24.22.1-darwin-x64.tar.gz +33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3 node-v24.22.1-linux-arm64.tar.gz +eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c node-v24.22.1-linux-x64.tar.gz +8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00 win-arm64/node.exe +d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5 win-x64/node.exe