code-server 4.145.2-1
seededverified· maintained by coadler· MIT
VS Code in the browser
shelly install aur code-server --aur-url https://atoll.seafoam-labs.org
This can be permanently set in the shelly
config.json file.
git clone https://atoll.seafoam-labs.org/packages/code-server.git
Served Git SHAs are synthesized by Atoll when it commits stored revisions - they do not match
upstream AUR.
/v1/packages/code-server/versions SHAs are authoritative.
Metadata
Relations
Depends
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 2b9b1bea83aehead | verified | 2026-11-07 01:37 | 2 |
| 42fef73d30c0 | verified | 2026-11-05 16:11 | 2 |
| f8a95de21154 | verified | 2026-11-05 16:11 | 2 |
| f556a21b4224 | verified | 2026-11-05 16:10 | 2 |
| a41fcb41949e | verified | 2026-11-05 16:10 | 2 |
| 8f8803e823b7 | verified | 2026-11-05 16:03 | 2 |
Head findings
medium
privilege-escalation
in
update.shPrivilege escalation tool 'sudo' is invoked inside a packaged helper script - helper scripts only run when the user invokes them voluntarily, typically with the privileges they already hold.
sudo pacman -S pacman-contrib --noconfirm
medium
command-substitution
in
update.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
CODE_SERVER_CURRENT_VERSION=$(grep "pkgver=" PKGBUILD | cut -d "=" -f2-)
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.