close
Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: codecov/codecov-action
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v5
Choose a base ref
...
head repository: codecov/codecov-action
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v6
Choose a head ref
  • 4 commits
  • 4 files changed
  • 2 contributors

Commits on Mar 26, 2026

  1. Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to… 

    … 8.0.0"" (#1929)

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" …"

This reverts commit 87d39f4.
    @thomasrockhu-codecov
    thomasrockhu-codecov authored Mar 26, 2026
    Configuration menu
    Copy the full SHA
    f67d33d View commit details
    Browse the repository at this point in the history

  2. Th/6.0.0 (#1928) 

    * chore(release): 5.5.4

* chore(release): 6.0.0

* fix: small fixes

---------

Co-authored-by: Tom Hu <tomhu1096@gmail.com>
    @thomasrockhu-codecov @thomasrockhu
    thomasrockhu-codecov and thomasrockhu authored Mar 26, 2026
    Configuration menu
    Copy the full SHA
    57e3a13 View commit details
    Browse the repository at this point in the history

Commits on May 13, 2026

  1. fix: prevent template injection in run: steps (VULN-1652) (#1947) 

    Replace direct ${{ inputs.skip_validation }}, ${{ inputs.use_oidc }},
${{ inputs.token }}, and ${{ env.CODECOV_TOKEN }} interpolation inside
run: shell scripts with env-var indirection. GitHub Actions resolves
template expressions before the shell sees the script, so any consumer
workflow that passes user-controlled data into these inputs could
achieve arbitrary command execution on the runner. Moving the values
into env: entries and referencing them as $INPUT_* shell variables
ensures the shell always treats them as data, not code.
    @thomasrockhu-codecov
    thomasrockhu-codecov authored May 13, 2026
    Configuration menu
    Copy the full SHA
    51e6422 View commit details
    Browse the repository at this point in the history

Commits on May 18, 2026

  1. chore(release): 6.0.1 (#1949)

    @thomasrockhu-codecov
    thomasrockhu-codecov authored May 18, 2026
    Configuration menu
    Copy the full SHA
    e79a696 View commit details
    Browse the repository at this point in the history
Loading