SIGN IN SIGN UP
TryGhost / Ghost UNCLAIMED

Independent technology for modern publishing, memberships, subscriptions and newsletters.

0 0 121 JavaScript

Update codecov/codecov-action action to v6 (#28272)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[codecov/codecov-action](https://redirect.github.com/codecov/codecov-action)
| action | major | `v5` → `v6` |

---

### Release Notes

<details>
<summary>codecov/codecov-action (codecov/codecov-action)</summary>

###
[`v6.0.1`](https://redirect.github.com/codecov/codecov-action/releases/tag/v6.0.1)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v6...v6.0.1)

##### What's Changed

- fix: prevent template injection in run: steps (VULN-1652) by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1947](https://redirect.github.com/codecov/codecov-action/pull/1947)
- chore(release): 6.0.1 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1949](https://redirect.github.com/codecov/codecov-action/pull/1949)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1>

###
[`v6.0.0`](https://redirect.github.com/codecov/codecov-action/releases/tag/v6.0.0)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v6...v6)

##### ⚠️ This version introduces support for node24 which make cause
breaking changes for systems that do not currently support node24. ⚠️

##### What's Changed

- Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to
8.0.0"" by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1929](https://redirect.github.com/codecov/codecov-action/pull/1929)
- Th/6.0.0 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1928](https://redirect.github.com/codecov/codecov-action/pull/1928)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0>

###
[`v6`](https://redirect.github.com/codecov/codecov-action/compare/v5.5.4...v6)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.4...v6)

###
[`v5.5.4`](https://redirect.github.com/codecov/codecov-action/releases/tag/v5.5.4)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4)

This is a mirror of `v5.5.2`. `v6` will be released which requires
`node24`

##### What's Changed

- Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"
by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1926](https://redirect.github.com/codecov/codecov-action/pull/1926)
- chore(release): 5.5.4 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1927](https://redirect.github.com/codecov/codecov-action/pull/1927)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4>

###
[`v5.5.3`](https://redirect.github.com/codecov/codecov-action/releases/tag/v5.5.3)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3)

##### What's Changed

- build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;1874](https://redirect.github.com/codecov/codecov-action/pull/1874)
- chore(release): bump to 5.5.3 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1922](https://redirect.github.com/codecov/codecov-action/pull/1922)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3>

###
[`v5.5.2`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v552)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2)

##### What's Changed

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2>

###
[`v5.5.1`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v551)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.0...v5.5.1)

##### What's Changed

- fix: overwrite pr number on fork by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1871](https://redirect.github.com/codecov/codecov-action/pull/1871)
- build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1868](https://redirect.github.com/codecov/codecov-action/pull/1868)
- build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1867](https://redirect.github.com/codecov/codecov-action/pull/1867)
- fix: update to use local app/ dir by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1872](https://redirect.github.com/codecov/codecov-action/pull/1872)
- docs: fix typo in README by
[@&#8203;datalater](https://redirect.github.com/datalater) in
[#&#8203;1866](https://redirect.github.com/codecov/codecov-action/pull/1866)
- Document a `codecov-cli` version reference example by
[@&#8203;webknjaz](https://redirect.github.com/webknjaz) in
[#&#8203;1774](https://redirect.github.com/codecov/codecov-action/pull/1774)
- build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1861](https://redirect.github.com/codecov/codecov-action/pull/1861)
- build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1833](https://redirect.github.com/codecov/codecov-action/pull/1833)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1>

###
[`v5.5.0`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v550)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.4.3...v5.5.0)

##### What's Changed

- feat: upgrade wrapper to 0.2.4 by
[@&#8203;jviall](https://redirect.github.com/jviall) in
[#&#8203;1864](https://redirect.github.com/codecov/codecov-action/pull/1864)
- Pin actions/github-script by Git SHA by
[@&#8203;martincostello](https://redirect.github.com/martincostello) in
[#&#8203;1859](https://redirect.github.com/codecov/codecov-action/pull/1859)
- fix: check reqs exist by
[@&#8203;joseph-sentry](https://redirect.github.com/joseph-sentry) in
[#&#8203;1835](https://redirect.github.com/codecov/codecov-action/pull/1835)
- fix: Typo in README by
[@&#8203;spalmurray](https://redirect.github.com/spalmurray) in
[#&#8203;1838](https://redirect.github.com/codecov/codecov-action/pull/1838)
- docs: Refine OIDC docs by
[@&#8203;spalmurray](https://redirect.github.com/spalmurray) in
[#&#8203;1837](https://redirect.github.com/codecov/codecov-action/pull/1837)
- build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1829](https://redirect.github.com/codecov/codecov-action/pull/1829)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0>

###
[`v5.4.3`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v543)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.4.2...v5.4.3)

##### What's Changed

- build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1822](https://redirect.github.com/codecov/codecov-action/pull/1822)
- fix: OIDC on forks by
[@&#8203;joseph-sentry](https://redirect.github.com/joseph-sentry) in
[#&#8203;1823](https://redirect.github.com/codecov/codecov-action/pull/1823)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3>

###
[`v5.4.2`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v542)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.4.1...v5.4.2)

##### What's Changed

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2>

###
[`v5.4.1`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v541)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.4.0...v5.4.1)

##### What's Changed

- fix: use the github core methods by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1807](https://redirect.github.com/codecov/codecov-action/pull/1807)
- build(deps): bump github/codeql-action from 3.28.12 to 3.28.13 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1803](https://redirect.github.com/codecov/codecov-action/pull/1803)
- build(deps): bump github/codeql-action from 3.28.11 to 3.28.12 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1797](https://redirect.github.com/codecov/codecov-action/pull/1797)
- build(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1798](https://redirect.github.com/codecov/codecov-action/pull/1798)
- chore(release): wrapper -0.2.1 by
[@&#8203;app/codecov-releaser-app](https://redirect.github.com/app/codecov-releaser-app)
in
[#&#8203;1788](https://redirect.github.com/codecov/codecov-action/pull/1788)
- build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1786](https://redirect.github.com/codecov/codecov-action/pull/1786)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1>

###
[`v5.4.0`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v540)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.3.1...v5.4.0)

##### What's Changed

- update wrapper submodule to 0.2.0, add recurse\_submodules arg by
[@&#8203;matt-codecov](https://redirect.github.com/matt-codecov) in
[#&#8203;1780](https://redirect.github.com/codecov/codecov-action/pull/1780)
- build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1775](https://redirect.github.com/codecov/codecov-action/pull/1775)
- build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1776](https://redirect.github.com/codecov/codecov-action/pull/1776)
- build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1777](https://redirect.github.com/codecov/codecov-action/pull/1777)
- Clarify in README that `use_pypi` bypasses integrity checks too by
[@&#8203;webknjaz](https://redirect.github.com/webknjaz) in
[#&#8203;1773](https://redirect.github.com/codecov/codecov-action/pull/1773)
- Fix use of safe.directory inside containers by
[@&#8203;Flamefire](https://redirect.github.com/Flamefire) in
[#&#8203;1768](https://redirect.github.com/codecov/codecov-action/pull/1768)
- Fix description for report\_type input by
[@&#8203;craigscott-crascit](https://redirect.github.com/craigscott-crascit)
in
[#&#8203;1770](https://redirect.github.com/codecov/codecov-action/pull/1770)
- build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1765](https://redirect.github.com/codecov/codecov-action/pull/1765)
- Fix a typo in the example by
[@&#8203;miranska](https://redirect.github.com/miranska) in
[#&#8203;1758](https://redirect.github.com/codecov/codecov-action/pull/1758)
- build(deps): bump github/codeql-action from 3.28.5 to 3.28.8 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1757](https://redirect.github.com/codecov/codecov-action/pull/1757)
- build(deps): bump github/codeql-action from 3.28.1 to 3.28.5 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1753](https://redirect.github.com/codecov/codecov-action/pull/1753)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0>

###
[`v5.3.1`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v531)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.3.0...v5.3.1)

##### What's Changed

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.3.0..v5.3.1>

###
[`v5.3.0`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v530)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.2.0...v5.3.0)

##### What's Changed

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.2.0..v5.3.0>

###
[`v5.2.0`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v520)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.1.2...v5.2.0)

##### What's Changed

- Fix typo in README by
[@&#8203;tserg](https://redirect.github.com/tserg) in
[#&#8203;1747](https://redirect.github.com/codecov/codecov-action/pull/1747)
- Th/add commands by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1745](https://redirect.github.com/codecov/codecov-action/pull/1745)
- use correct audience when requesting oidc token by
[@&#8203;juho9000](https://redirect.github.com/juho9000) in
[#&#8203;1744](https://redirect.github.com/codecov/codecov-action/pull/1744)
- build(deps): bump github/codeql-action from 3.27.9 to 3.28.1 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1742](https://redirect.github.com/codecov/codecov-action/pull/1742)
- build(deps): bump actions/upload-artifact from 4.4.3 to 4.6.0 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1743](https://redirect.github.com/codecov/codecov-action/pull/1743)
- chore(deps): bump wrapper to 0.0.32 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1740](https://redirect.github.com/codecov/codecov-action/pull/1740)
- feat: add disable-telem feature by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1739](https://redirect.github.com/codecov/codecov-action/pull/1739)
- fix: remove erroneous linebreak in readme by
[@&#8203;Vampire](https://redirect.github.com/Vampire) in
[#&#8203;1734](https://redirect.github.com/codecov/codecov-action/pull/1734)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.1.2..v5.2.0>

###
[`v5.1.2`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v512)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.1.1...v5.1.2)

##### What's Changed

- fix: update statment by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1726](https://redirect.github.com/codecov/codecov-action/pull/1726)
- fix: update action script by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1725](https://redirect.github.com/codecov/codecov-action/pull/1725)
- fix: prevent oidc on tokenless due to permissioning by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1724](https://redirect.github.com/codecov/codecov-action/pull/1724)
- chore(release): wrapper-0.0.31 by
[@&#8203;app/codecov-releaser-app](https://redirect.github.com/app/codecov-releaser-app)
in
[#&#8203;1723](https://redirect.github.com/codecov/codecov-action/pull/1723)
- Put quotes around `${{ inputs.token }}` in `action.yml` by
[@&#8203;jwodder](https://redirect.github.com/jwodder) in
[#&#8203;1721](https://redirect.github.com/codecov/codecov-action/pull/1721)
- build(deps): bump github/codeql-action from 3.27.6 to 3.27.9 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1722](https://redirect.github.com/codecov/codecov-action/pull/1722)
- Remove mistake from options table by
[@&#8203;Acconut](https://redirect.github.com/Acconut) in
[#&#8203;1718](https://redirect.github.com/codecov/codecov-action/pull/1718)
- build(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1717](https://redirect.github.com/codecov/codecov-action/pull/1717)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.1.1..v5.1.2>

###
[`v5.1.1`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v511)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.1.0...v5.1.1)

##### What's Changed

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.1.0..v5.1.1>

###
[`v5.1.0`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v510)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.7...v5.1.0)

##### What's Changed

- fix: hide unnecessary error on shasum by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1692](https://redirect.github.com/codecov/codecov-action/pull/1692)
- build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1701](https://redirect.github.com/codecov/codecov-action/pull/1701)
- chore(release): wrapper-0.0.29 by
[@&#8203;app/codecov-releaser-app](https://redirect.github.com/app/codecov-releaser-app)
in
[#&#8203;1713](https://redirect.github.com/codecov/codecov-action/pull/1713)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.7..v5.1.0>

###
[`v5.0.7`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v507)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.6...v5.0.7)

##### What's Changed

- fix: use HEAD\_REPO by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1690](https://redirect.github.com/codecov/codecov-action/pull/1690)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.6..v5.0.7>

###
[`v5.0.6`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v506)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.5...v5.0.6)

##### What's Changed

- fix: update CODECOV\_TOKEN and fix tokenless by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1688](https://redirect.github.com/codecov/codecov-action/pull/1688)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.5..v5.0.6>

###
[`v5.0.5`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v505)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.4...v5.0.5)

##### What's Changed

- chore(release): wrapper-0.0.27 by
[@&#8203;app/codecov-releaser-app](https://redirect.github.com/app/codecov-releaser-app)
in
[#&#8203;1685](https://redirect.github.com/codecov/codecov-action/pull/1685)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.4..v5.0.5>

###
[`v5.0.4`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v504)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.3...v5.0.4)

##### What's Changed

- chore(deps): bump wrapper to 0.0.26 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1681](https://redirect.github.com/codecov/codecov-action/pull/1681)
- fix: strip out a trailing /n from input tokens by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1679](https://redirect.github.com/codecov/codecov-action/pull/1679)
- fix: add action version by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1678](https://redirect.github.com/codecov/codecov-action/pull/1678)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.3..v5.0.4>

###
[`v5.0.3`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v503)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.2...v5.0.3)

##### What's Changed

- fix: update OIDC audience by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1675](https://redirect.github.com/codecov/codecov-action/pull/1675)
- fix: use double-quotes for OIDC by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1669](https://redirect.github.com/codecov/codecov-action/pull/1669)
- fix: prevent always setting tokenless to be true by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1673](https://redirect.github.com/codecov/codecov-action/pull/1673)
- fix: update CHANGELOG and automate by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1674](https://redirect.github.com/codecov/codecov-action/pull/1674)
- fix: bump to v5 and update README by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1655](https://redirect.github.com/codecov/codecov-action/pull/1655)
- build(deps): bump github/codeql-action from 3.27.0 to 3.27.4 by
[@&#8203;app/dependabot](https://redirect.github.com/app/dependabot) in
[#&#8203;1665](https://redirect.github.com/codecov/codecov-action/pull/1665)
- fix: typo in `inputs.disable_safe_directory` by
[@&#8203;mkroening](https://redirect.github.com/mkroening) in
[#&#8203;1666](https://redirect.github.com/codecov/codecov-action/pull/1666)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.2..v5.0.3>

###
[`v5.0.2`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v502)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5.0.1...v5.0.2)

##### What's Changed

- fix: override commit and pr values for PR cases by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1657](https://redirect.github.com/codecov/codecov-action/pull/1657)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.1...v5.0.2>

###
[`v5.0.1`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v501)

[Compare
Source](https://redirect.github.com/codecov/codecov-action/compare/v5...v5.0.1)

##### What's Changed

- fix: use marketplace v5 badge by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1646](https://redirect.github.com/codecov/codecov-action/pull/1646)
- fix: update tokenless branch logic by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1650](https://redirect.github.com/codecov/codecov-action/pull/1650)
- chore(release): 5.0.1 by
[@&#8203;thomasrockhu-codecov](https://redirect.github.com/thomasrockhu-codecov)
in
[#&#8203;1656](https://redirect.github.com/codecov/codecov-action/pull/1656)

**Full Changelog**:
<https://github.com/codecov/codecov-action/compare/v5.0.0...v5.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
- Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`)
- Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * *
1-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
- Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`)
- Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * *
1-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjIwNS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: tryghost-renovate[bot] <269725441+tryghost-renovate[bot]@users.noreply.github.com>
T
tryghost-renovate[bot] committed
93e6058426f0e848a6037a63e232a6b20889ec52
Parent: a384ef4
Committed by GitHub <noreply@github.com> on 5/31/2026, 11:37:48 PM