Bump proxy-addr to 2.0.8

Open Beginner friendly

#8,013 opened on Sep 17, 2026 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 74/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Tech stack: javascript, typescript
Domain: security

Research direction

Locate the dependency manifest and lockfile entries for proxy-addr 2.0.7, then inspect how dependencies are updated in this repository. Update the package to 2.0.8, refresh any corresponding lockfile data, and run the relevant dependency or test checks to confirm the vulnerable version is gone.

Written by the indexing model from the issue text.

Description

security

Is there an existing issue for this?

I have searched the existing issues

OS/Web Information

code-server --version: 1.137

Steps to Reproduce

Latest code server version to date ships proxy-addr version 2.0.7, which is said to be vulnerable to CVE-2026-90711.

Expected

Could proxy-addr be bumped to 2.0.8 to address this?

Actual

Logs

Screenshot/Video

No response

Does this bug reproduce in native VS Code?

No, this works as expected in native VS Code

Does this bug reproduce in VS Code web?

I did not test VS Code web

Does this bug reproduce in GitHub Codespaces?

I did not test GitHub Codespaces

Are you accessing code-server over a secure context?

I am using a secure context.

Notes