Bump proxy-addr to 2.0.8

[alexander-str]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• code-server --version: 1.137

Steps to Reproduce

Latest code server version to date ships proxy-addr version 2.0.7, which is said to be vulnerable to CVE-2026-90711.

Expected

Could proxy-addr be bumped to 2.0.8 to address this?

Actual

Logs

Screenshot/Video

No response

Does this bug reproduce in native VS Code?

No, this works as expected in native VS Code

Does this bug reproduce in VS Code web?

I did not test VS Code web

Does this bug reproduce in GitHub Codespaces?

I did not test GitHub Codespaces

Are you accessing code-server over a secure context?

• I am using a secure context.

Notes

No response

[linear-code]

CODE-70

[alexander-str]

@code-asher Would you have any idea on when this could be fixed?

[code-asher]

Should get picked up automatically by Dependabot once the dependency cooldown hits, I believe (7 days).

[alexander-str]

Thanks!