Skip to content

build(deps): bump codecov/codecov-action from 4 to 6#2113

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/codecov/codecov-action-6
Open

build(deps): bump codecov/codecov-action from 4 to 6#2113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/codecov/codecov-action-6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 7, 2026

Bumps codecov/codecov-action from 4 to 6.

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

What's Changed

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

v5.5.2

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.5.1...v5.5.2

v5.5.1

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 7, 2026
@dependabot dependabot Bot requested a review from ryanmaclean as a code owner May 7, 2026 01:44
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label May 7, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

PR Analysis 📊

Changed Files Summary:

  • JavaScript/TypeScript files: 0
  • Test files: 0
  • Documentation files: 0
  • Configuration files: 1

CI Status: Running automated checks...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

Quick Checks Results

Check Status
ESLint
TypeScript

✅ All quick checks passed!

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

Build Status ✅ Build successful

✅ Build completed successfully!

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

Dependency Audit Results

# npm audit report

aws-sdk  >=2.0.1
JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 - https://github.com/advisories/GHSA-j965-2qgj-vjmq
fix available via `npm audit fix --force`
Will install aws-sdk@1.18.0, which is a breaking change
node_modules/aws-sdk

basic-ftp  <=5.3.0
Severity: high
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering - https://github.com/advisories/GHSA-rpmf-866q-6p89
fix available via `npm audit fix`
node_modules/basic-ftp

hono  <=4.12.15
Severity: moderate
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests - https://github.com/advisories/GHSA-9vqf-7f2p-gf9v
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection - https://github.com/advisories/GHSA-69xw-7hcm-h432
fix available via `npm audit fix`
node_modules/hono

ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/ip-address
  express-rate-limit  8.0.1 - 8.5.0
  Depends on vulnerable versions of ip-address
  node_modules/express-rate-limit

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix --force`
Will install next@9.3.3, which is a breaking change
node_modules/next/node_modules/postcss
  next  9.3.4-canary.0 - 16.3.0-canary.5
  Depends on vulnerable versions of postcss
  node_modules/next

7 vulnerabilities (1 low, 5 moderate, 1 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

Test Results ✅ Passed

Test Suites: 67 failed, 5 skipped, 480 passed, 547 of 552 total
Tests: 359 failed, 104 skipped, 30 todo, 10623 passed, 11116 total

✅ All tests passed! Ready for review.

View test output

Check the Actions tab for detailed test output.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

PR Status Summary

Check Status
Quick Checks ✅ Passed
Tests ✅ Passed
Build ✅ Passed

All checks passed! This PR is ready to merge. 🎉

@dependabot dependabot Bot force-pushed the dependabot/github_actions/codecov/codecov-action-6 branch from 4798bd7 to 915833b Compare May 8, 2026 15:50
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

Build Status ✅ Build successful

✅ Build completed successfully!

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

Quick Checks Results

Check Status
ESLint
TypeScript

✅ All quick checks passed!

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

PR Analysis 📊

Changed Files Summary:

  • JavaScript/TypeScript files: 0
  • Test files: 0
  • Documentation files: 0
  • Configuration files: 1

CI Status: Running automated checks...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

Dependency Audit Results

# npm audit report

aws-sdk  >=2.0.1
JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 - https://github.com/advisories/GHSA-j965-2qgj-vjmq
fix available via `npm audit fix --force`
Will install aws-sdk@1.18.0, which is a breaking change
node_modules/aws-sdk

basic-ftp  <=5.3.0
Severity: high
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering - https://github.com/advisories/GHSA-rpmf-866q-6p89
fix available via `npm audit fix`
node_modules/basic-ftp

hono  <=4.12.15
Severity: moderate
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests - https://github.com/advisories/GHSA-9vqf-7f2p-gf9v
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection - https://github.com/advisories/GHSA-69xw-7hcm-h432
fix available via `npm audit fix`
node_modules/hono

ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/ip-address
  express-rate-limit  8.0.1 - 8.5.0
  Depends on vulnerable versions of ip-address
  node_modules/express-rate-limit

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix --force`
Will install next@9.3.3, which is a breaking change
node_modules/next/node_modules/postcss
  next  9.3.4-canary.0 - 16.3.0-canary.5
  Depends on vulnerable versions of postcss
  node_modules/next

7 vulnerabilities (1 low, 5 moderate, 1 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

Test Results ✅ Passed

Test Suites: 78 failed, 5 skipped, 468 passed, 546 of 551 total
Tests: 556 failed, 104 skipped, 42 todo, 10478 passed, 11180 total

✅ All tests passed! Ready for review.

View test output

Check the Actions tab for detailed test output.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

PR Status Summary

Check Status
Quick Checks ✅ Passed
Tests ✅ Passed
Build ✅ Passed

All checks passed! This PR is ready to merge. 🎉

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/codecov/codecov-action-6 branch from 915833b to c3896af Compare May 29, 2026 01:21
@github-actions
Copy link
Copy Markdown
Contributor

PR Analysis 📊

Changed Files Summary:

  • JavaScript/TypeScript files: 0
  • Test files: 0
  • Documentation files: 0
  • Configuration files: 1

CI Status: Running automated checks...

@github-actions
Copy link
Copy Markdown
Contributor

Quick Checks Results

Check Status
ESLint
TypeScript

✅ All quick checks passed!

@github-actions
Copy link
Copy Markdown
Contributor

Build Status ✅ Build successful

✅ Build completed successfully!

@github-actions
Copy link
Copy Markdown
Contributor

Test Results ✅ Passed

Test Suites: 69 failed, 5 skipped, 435 passed, 504 of 509 total
Tests: 529 failed, 104 skipped, 21 todo, 10342 passed, 10996 total

✅ All tests passed! Ready for review.

View test output

Check the Actions tab for detailed test output.

@github-actions
Copy link
Copy Markdown
Contributor

PR Status Summary

Check Status
Quick Checks ✅ Passed
Tests ✅ Passed
Build ✅ Passed

All checks passed! This PR is ready to merge. 🎉

@github-actions
Copy link
Copy Markdown
Contributor

Dependency Audit Results

# npm audit report

@babel/plugin-transform-modules-systemjs  7.12.0 - 7.29.0
Severity: high
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - https://github.com/advisories/GHSA-fv7c-fp4j-7gwp
fix available via `npm audit fix`
node_modules/@babel/plugin-transform-modules-systemjs

@opentelemetry/auto-instrumentations-node  <=0.74.0
Severity: high
Depends on vulnerable versions of @opentelemetry/sdk-node
Prometheus exporter process crash via malformed HTTP request - https://github.com/advisories/GHSA-q7rr-3cgh-j5r3
fix available via `npm audit fix --force`
Will install @opentelemetry/auto-instrumentations-node@0.76.0, which is a breaking change
node_modules/@opentelemetry/auto-instrumentations-node

@opentelemetry/exporter-prometheus  <0.217.0
Severity: high
Prometheus exporter process crash via malformed HTTP request - https://github.com/advisories/GHSA-q7rr-3cgh-j5r3
fix available via `npm audit fix --force`
Will install @opentelemetry/exporter-prometheus@0.218.0, which is a breaking change
node_modules/@opentelemetry/exporter-prometheus
node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/exporter-prometheus
  @opentelemetry/sdk-node  <=0.216.0
  Depends on vulnerable versions of @opentelemetry/exporter-prometheus
  node_modules/@opentelemetry/sdk-node


@protobufjs/utf8  <=1.1.0
Severity: moderate
protobufjs has overlong UTF-8 decoding - https://github.com/advisories/GHSA-q6x5-8v7m-xcrf
fix available via `npm audit fix`
node_modules/@protobufjs/utf8

aws-sdk  >=2.0.1
JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 - https://github.com/advisories/GHSA-j965-2qgj-vjmq
fix available via `npm audit fix --force`
Will install aws-sdk@1.18.0, which is a breaking change
node_modules/aws-sdk

basic-ftp  <=5.3.0
Severity: high
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering - https://github.com/advisories/GHSA-rpmf-866q-6p89
fix available via `npm audit fix`
node_modules/basic-ftp

brace-expansion  5.0.2 - 5.0.5
Severity: moderate
brace-expansion: Large numeric range defeats documented `max` DoS protection - https://github.com/advisories/GHSA-jxxr-4gwj-5jf2
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion

fast-uri  <=3.1.1
Severity: high
fast-uri vulnerable to path traversal via percent-encoded dot segments - https://github.com/advisories/GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to host confusion via percent-encoded authority delimiters - https://github.com/advisories/GHSA-v39h-62p7-jpjc
fix available via `npm audit fix`
node_modules/fast-uri

fast-xml-builder  <=1.1.6
Severity: high
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes - https://github.com/advisories/GHSA-5wm8-gmm8-39j9
fast-xml-builder Comment Value regex can be bypassed - https://github.com/advisories/GHSA-45c6-75p6-83cc
fix available via `npm audit fix`
node_modules/fast-xml-builder

ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/ip-address
  express-rate-limit  8.0.1 - 8.5.0
  Depends on vulnerable versions of ip-address
  node_modules/express-rate-limit

langsmith  <0.6.0
Severity: high
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning - https://github.com/advisories/GHSA-3644-q5cj-c5c7
fix available via `npm audit fix`
node_modules/langsmith

next  9.3.4-canary.0 - 16.3.0-canary.5
Severity: high
Next.js Vulnerable to Denial of Service with Server Components - https://github.com/advisories/GHSA-8h8q-6873-q5fj
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up - https://github.com/advisories/GHSA-26hh-7cqf-hhc6
Next.js's Middleware / Proxy redirects can be cache-poisoned - https://github.com/advisories/GHSA-3g8h-86w9-wvmq
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces - https://github.com/advisories/GHSA-ffhc-5mcf-pf4q
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting - https://github.com/advisories/GHSA-vfv6-92ff-j949
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input - https://github.com/advisories/GHSA-gx5p-jg67-6x7h
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components - https://github.com/advisories/GHSA-mg66-mrh9-m8jx
Next.js has a Denial of Service in the Image Optimization API - https://github.com/advisories/GHSA-h64f-5h5j-jqjh
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades - https://github.com/advisories/GHSA-c4j6-fc7j-m34r
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection - https://github.com/advisories/GHSA-492v-c6pp-mqqv
Next.js vulnerable to cache poisoning in React Server Component responses - https://github.com/advisories/GHSA-wfc6-r584-vfw7
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - https://github.com/advisories/GHSA-267c-6grr-h53f
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n - https://github.com/advisories/GHSA-36qx-fr4f-26g5
Depends on vulnerable versions of postcss
fix available via `npm audit fix --force`
Will install next@16.2.6, which is outside the stated dependency range
node_modules/next

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix --force`
Will install next@16.2.6, which is outside the stated dependency range
node_modules/next/node_modules/postcss

protobufjs  <=7.5.7 || 8.0.0 - 8.1.6-experimental
Severity: high
protobuf.js: Code injection through bytes field defaults in generated toObject code - https://github.com/advisories/GHSA-66ff-xgx4-vchm
protobuf.js: Code injection through bytes field defaults in generated toObject code - https://github.com/advisories/GHSA-66ff-xgx4-vchm
protobuf.js: Denial of service from crafted field names in generated code - https://github.com/advisories/GHSA-2pr8-phx7-x9h3
protobuf.js: Denial of service from crafted field names in generated code - https://github.com/advisories/GHSA-2pr8-phx7-x9h3
protobuf.js: Prototype injection in generated message constructors - https://github.com/advisories/GHSA-fx83-v9x8-x52w
protobuf.js: Prototype injection in generated message constructors - https://github.com/advisories/GHSA-fx83-v9x8-x52w
protobuf.js: Code generation gadget after prototype pollution - https://github.com/advisories/GHSA-75px-5xx7-5xc7
protobuf.js: Code generation gadget after prototype pollution - https://github.com/advisories/GHSA-75px-5xx7-5xc7
protobuf.js: Process-wide denial of service through unsafe option paths - https://github.com/advisories/GHSA-jvwf-75h9-cwgg
protobuf.js: Process-wide denial of service through unsafe option paths - https://github.com/advisories/GHSA-jvwf-75h9-cwgg
protobuf.js: Denial of service through unbounded protobuf recursion - https://github.com/advisories/GHSA-685m-2w69-288q
protobuf.js: Denial of service through unbounded protobuf recursion - https://github.com/advisories/GHSA-685m-2w69-288q
protobufjs has overlong UTF-8 decoding - https://github.com/advisories/GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding - https://github.com/advisories/GHSA-q6x5-8v7m-xcrf
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - https://github.com/advisories/GHSA-jggg-4jg4-v7c6
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - https://github.com/advisories/GHSA-jggg-4jg4-v7c6
fix available via `npm audit fix`
node_modules/@opentelemetry/otlp-transformer/node_modules/protobufjs
node_modules/protobufjs

qs  6.11.1 - 6.15.1
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
fix available via `npm audit fix`
node_modules/qs

tmp  <0.2.6
Severity: high
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape - https://github.com/advisories/GHSA-ph9p-34f9-6g65
fix available via `npm audit fix`
node_modules/tmp

ws  8.0.0 - 8.20.0
Severity: moderate
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
fix available via `npm audit fix --force`
Will install ws@8.21.0, which is outside the stated dependency range
node_modules/engine.io-client/node_modules/ws
node_modules/engine.io/node_modules/ws
node_modules/socket.io-adapter/node_modules/ws
node_modules/ws
  engine.io  0.7.8 - 0.7.9 || 6.0.0 - 6.6.7
  Depends on vulnerable versions of ws
  node_modules/engine.io
  engine.io-client  0.7.0 || 0.7.8 - 0.7.9 || 6.0.0 - 6.6.4
  Depends on vulnerable versions of ws
  node_modules/engine.io-client
  socket.io-adapter  2.5.2 - 2.5.6
  Depends on vulnerable versions of ws
  node_modules/socket.io-adapter

22 vulnerabilities (1 low, 10 moderate, 11 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants