[faust-renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/coder/code-server	minor	4.141.1 → 4.143.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[faust-renovate]

konflate · #1768 — feat(container): update image ghcr.io/coder/code-server (4.141.1 ➔ 4.143.1)

Tip

Routine: only container-image and chart-version changes; 2 resources across 2 apps

image	from	to	upstream
ghcr.io/coder/code-server	4.141.1@sha256:bfe06d…	4.143.1@sha256:377b66…	✅

_{konflate 0.6.6 · rendered fc70478}

[faust-review]

Confidence Score: 5/5

[Low risk] The minor update affects a single application sidecar rather than a shared or central dependency, with potential disruption limited to that workload and reversible by restoring the prior image.

Approved

Summary

Bumps the code-server sidecar image for plexanilistsync to 4.143.1

The only rendered effect is the codeserver sidecar container in the plexanilistsync Deployment switching to the new image reference, which will roll the pod when Flux applies it; the app container, resources, securityContext, persistence and route are untouched. Upstream coder/code-server has no v4.142.x or v4.143.0 tags, so the changelog between the two pinned versions is the single v4.143.1 entry, "Update to Code 1.143.1", with no removals, renames or changed defaults. None of the flags the HelmRelease passes (--auth none, --bind-addr 0.0.0.0:12321, --disable-telemetry, --disable-update-check) appear in those notes. After merging, expect the plexanilistsync pod to restart once and the anilist-sync route to keep serving on 12321, with the codeserver container reporting version 4.143.1/Code 1.143.1. The CVE-2026-111497 Brotli fix and the compressed-body rejection were already in the 4.141.1 image this replaces, so nothing new lands on the security side here. Note the sidecar still runs with --auth none and binds 0.0.0.0:12321, which is unchanged by this PR and relies on the envoy-internal gateway for access control; it is worth a look outside this bump if that route's policy is not already restrictive. No release notes or upstream behaviour question was left open. Automerge is disabled by the repo's Renovate config, so this waits for a manual merge, as the description states.

Review context · 5 sources · 4/7 commands

• Sources:
  • https://redirect.github.com/coder/code-server/releases
  • https://redirect.github.com/coder/code-server/releases/tag/v4.143.1
  • https://redirect.github.com/coder/code-server/releases/tag/v4.141.1
  • https://raw.githubusercontent.com/coder/code-server/v4.143.1/CHANGELOG.md
  • https://redirect.github.com/coder/code-server/tags
• Commands run: curl gh konflate rg

_{Reviews (1) · Last reviewed commit: "feat(container): update image ghcr.io/co..." · self-qwen3.8-flash-next/low}

[faust-review]

kritika: confidence 5/5 with low risk at fc70478.