build(deps): Bump codecov/codecov-action from 3 to 6#867
build(deps): Bump codecov/codecov-action from 3 to 6#867dependabot[bot] wants to merge 1 commit intov0.34.xfrom
Conversation
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3 to 6. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v3...v6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| cat ./*profile.out | grep -v "mode: atomic" >> coverage.txt | ||
| if: env.GIT_DIFF | ||
| - uses: codecov/codecov-action@v3 | ||
| - uses: codecov/codecov-action@v6 |
There was a problem hiding this comment.
Deprecated file parameter won't work in v6
High Severity
The codecov/codecov-action was bumped from v3 to v6, but the file input parameter was deprecated in v5 and replaced with files. The workflow still uses file: ./coverage.txt, which means the specified coverage file may be silently ignored, causing the coverage upload to either fail or upload auto-discovered files instead of the intended coverage.txt.
| cat ./*profile.out | grep -v "mode: atomic" >> coverage.txt | ||
| if: env.GIT_DIFF | ||
| - uses: codecov/codecov-action@v3 | ||
| - uses: codecov/codecov-action@v6 |
There was a problem hiding this comment.
Missing required token after bump to v6
High Severity
Bumping codecov/codecov-action from v3 to v6 introduces a breaking change: tokenless uploads were removed in v4. The workflow does not pass a token parameter, and CODECOV_TOKEN is not referenced anywhere in the repository. Without providing token: ${{ secrets.CODECOV_TOKEN }}, the coverage upload step will fail for non-fork PRs and push events to master/release/** branches.
Bumps codecov/codecov-action from 3 to 6.
Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...75cd116chore(release): 5.5.4 (#1927)87d39f4Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)1af5884chore(release): bump to 5.5.3 (#1922)c143300build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)671740achore(release): 5.5.2 (#1902)96b38e9chore:disable_searchalignment (#1881)9b6d1f8check gpg only when skip-validation = false (#1894)5a10915chore(release): 5.5.1 (#1873)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Medium Risk
Updates the Codecov upload step to a new major version, which could break CI coverage reporting if the action’s runtime/inputs have changed (notably Node 24 requirements). Impact is limited to the GitHub Actions workflow.
Overview
Updates CI coverage upload to Codecov. The
upload-coverage-reportjob in.github/workflows/coverage.ymlnow usescodecov/codecov-action@v6instead of@v3while keeping the samecoverage.txtupload configuration.Written by Cursor Bugbot for commit d2f3be9. This will update automatically on new commits. Configure here.