［Historical PR］ deps（actions）: bump codecov/codecov-action from 5 to 7 #144

Historical pull request 144
Original state: merged
Originally created: 2026-06-29T04:44:06Z
Restored as documentation; authors, timestamps, and native events are not replayed.

Bumps ［codecov/codecov-action］（https：//github．com/codecov/codecov-action） from 5 to 7.
＜details＞
＜summary＞Release notes＜/summary＞
＜p＞＜em＞Sourced from ＜a href="https：//github．com/codecov/codecov-action/releases"＞codecov/codecov-action's releases＜/a＞.＜/em＞＜/p＞
＜blockquote＞
＜h2＞v7.0.0＜/h2＞
＜p＞⚠️ Due to migration issues with keybase, we are unable to update our keys under the ＜code＞codecovsecurity＜/code＞ account. We have deleted the account and are using ＜code＞codecovsecops＜/code＞ with the original gpg key＜/p＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞ci: remove Enforce License Compliance workflow by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1950"＞codecov/codecov-action＃1950＜/a＞＜/li＞
＜li＞chore（release）: 7.0.0 by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1957"＞codecov/codecov-action＃1957＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v6.0.1...v7.0.0"＞https：//github．com/codecov/codecov-action/compare/v6.0.1...v7.0.0＜/a＞＜/p＞
＜h2＞v6.0.2＜/h2＞
＜p＞This is a copy of the ＜code＞v7.0.0＜/code＞ release to make updates easier＜/p＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞ci: remove Enforce License Compliance workflow by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1950"＞codecov/codecov-action＃1950＜/a＞＜/li＞
＜li＞chore（release）: 7.0.0 by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1957"＞codecov/codecov-action＃1957＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v6.0.1...v6.0.2"＞https：//github．com/codecov/codecov-action/compare/v6.0.1...v6.0.2＜/a＞＜/p＞
＜h2＞v6.0.1＜/h2＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞fix: prevent template injection in run: steps （VULN-1652） by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1947"＞codecov/codecov-action＃1947＜/a＞＜/li＞
＜li＞chore（release）: 6.0.1 by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1949"＞codecov/codecov-action＃1949＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v6.0.0...v6.0.1"＞https：//github．com/codecov/codecov-action/compare/v6.0.0...v6.0.1＜/a＞＜/p＞
＜h2＞v6.0.0＜/h2＞
＜h2＞⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️＜/h2＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞Revert "Revert "build（deps）: bump actions/github-script from 7.0.1 to 8.0.0"" by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1929"＞codecov/codecov-action＃1929＜/a＞＜/li＞
＜li＞Th/6.0.0 by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1928"＞codecov/codecov-action＃1928＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.5.4...v6.0.0"＞https：//github．com/codecov/codecov-action/compare/v5.5.4...v6.0.0＜/a＞＜/p＞
＜h2＞v5.5.5＜/h2＞
＜p＞This release only contains the keybase.io change as described ＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1956"＞here＜/a＞.＜/p＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.5.4...v5.5.5"＞https：//github．com/codecov/codecov-action/compare/v5.5.4...v5.5.5＜/a＞＜/p＞
＜h2＞v5.5.4＜/h2＞
＜p＞This is a mirror of ＜code＞v5.5.2＜/code＞. ＜code＞v6＜/code＞ will be released which requires ＜code＞node24＜/code＞＜/p＞
＜h2＞What's Changed＜/h2＞
＜ul＞
＜li＞Revert "build（deps）: bump actions/github-script from 7.0.1 to 8.0.0" by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1926"＞codecov/codecov-action＃1926＜/a＞＜/li＞
＜li＞chore（release）: 5.5.4 by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1927"＞codecov/codecov-action＃1927＜/a＞＜/li＞
＜/ul＞
＜！-- raw HTML omitted --＞
＜/blockquote＞
＜p＞... （truncated）＜/p＞
＜/details＞
＜details＞
＜summary＞Changelog＜/summary＞
＜p＞＜em＞Sourced from ＜a href="https：//github．com/codecov/codecov-action/blob/main/CHANGELOG.md"＞codecov/codecov-action's changelog＜/a＞.＜/em＞＜/p＞
＜blockquote＞
＜h2＞v5.5.2＜/h2＞
＜h3＞What's Changed＜/h3＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.5.1..v5.5.2"＞https：//github．com/codecov/codecov-action/compare/v5.5.1..v5.5.2＜/a＞＜/p＞
＜h2＞v5.5.1＜/h2＞
＜h3＞What's Changed＜/h3＞
＜ul＞
＜li＞fix: overwrite pr number on fork by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1871"＞codecov/codecov-action＃1871＜/a＞＜/li＞
＜li＞build（deps）: bump actions/checkout from 4.2.2 to 5.0.0 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1868"＞codecov/codecov-action＃1868＜/a＞＜/li＞
＜li＞build（deps）: bump github/codeql-action from 3.29.9 to 3.29.11 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1867"＞codecov/codecov-action＃1867＜/a＞＜/li＞
＜li＞fix: update to use local app/ dir by ＜a href="https：//github．com/thomasrockhu-codecov"＞＜code＞＠thomasrockhu-codecov＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1872"＞codecov/codecov-action＃1872＜/a＞＜/li＞
＜li＞docs: fix typo in README by ＜a href="https：//github．com/datalater"＞＜code＞＠datalater＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1866"＞codecov/codecov-action＃1866＜/a＞＜/li＞
＜li＞Document a ＜code＞codecov-cli＜/code＞ version reference example by ＜a href="https：//github．com/webknjaz"＞＜code＞＠webknjaz＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1774"＞codecov/codecov-action＃1774＜/a＞＜/li＞
＜li＞build（deps）: bump github/codeql-action from 3.28.18 to 3.29.9 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1861"＞codecov/codecov-action＃1861＜/a＞＜/li＞
＜li＞build（deps）: bump ossf/scorecard-action from 2.4.1 to 2.4.2 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1833"＞codecov/codecov-action＃1833＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.5.0..v5.5.1"＞https：//github．com/codecov/codecov-action/compare/v5.5.0..v5.5.1＜/a＞＜/p＞
＜h2＞v5.5.0＜/h2＞
＜h3＞What's Changed＜/h3＞
＜ul＞
＜li＞feat: upgrade wrapper to 0.2.4 by ＜a href="https：//github．com/jviall"＞＜code＞＠jviall＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1864"＞codecov/codecov-action＃1864＜/a＞＜/li＞
＜li＞Pin actions/github-script by Git SHA by ＜a href="https：//github．com/martincostello"＞＜code＞＠martincostello＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1859"＞codecov/codecov-action＃1859＜/a＞＜/li＞
＜li＞fix: check reqs exist by ＜a href="https：//github．com/joseph-sentry"＞＜code＞＠joseph-sentry＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1835"＞codecov/codecov-action＃1835＜/a＞＜/li＞
＜li＞fix: Typo in README by ＜a href="https：//github．com/spalmurray"＞＜code＞＠spalmurray＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1838"＞codecov/codecov-action＃1838＜/a＞＜/li＞
＜li＞docs: Refine OIDC docs by ＜a href="https：//github．com/spalmurray"＞＜code＞＠spalmurray＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1837"＞codecov/codecov-action＃1837＜/a＞＜/li＞
＜li＞build（deps）: bump github/codeql-action from 3.28.17 to 3.28.18 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1829"＞codecov/codecov-action＃1829＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.4.3..v5.5.0"＞https：//github．com/codecov/codecov-action/compare/v5.4.3..v5.5.0＜/a＞＜/p＞
＜h2＞v5.4.3＜/h2＞
＜h3＞What's Changed＜/h3＞
＜ul＞
＜li＞build（deps）: bump github/codeql-action from 3.28.13 to 3.28.17 by ＜code＞＠app/dependabot＜/code＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1822"＞codecov/codecov-action＃1822＜/a＞＜/li＞
＜li＞fix: OIDC on forks by ＜a href="https：//github．com/joseph-sentry"＞＜code＞＠joseph-sentry＜/code＞＜/a＞ in ＜a href="https：//redirect．github．com/codecov/codecov-action/pull/1823"＞codecov/codecov-action＃1823＜/a＞＜/li＞
＜/ul＞
＜p＞＜strong＞Full Changelog＜/strong＞: ＜a href="https：//github．com/codecov/codecov-action/compare/v5.4.2..v5.4.3"＞https：//github．com/codecov/codecov-action/compare/v5.4.2..v5.4.3＜/a＞＜/p＞
＜h2＞v5.4.2＜/h2＞
＜！-- raw HTML omitted --＞
＜/blockquote＞
＜p＞... （truncated）＜/p＞
＜/details＞
＜details＞
＜summary＞Commits＜/summary＞
＜ul＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/ｆｂ８ｂ３５８２ｃ８ｅ４ｄｅｆ４９６９ｃ９７ｃａａ２ｆ１９７２０ｃｂ３３ａ７２ｆ"＞＜code＞ｆｂ８ｂ３５８＜/code＞＜/a＞ chore（release）: 7.0.0 （＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1957"＞＃1957＜/a＞）＜/li＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/ｃａ０ａ９２８ａ４ｃｂ３９１１０１１ｅ８６８１２８ａ５ｃｄ９０４３７ｃ１２ｄｂ１"＞＜code＞ｃａ０ａ９２８＜/code＞＜/a＞ ci: remove Enforce License Compliance workflow （＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1950"＞＃1950＜/a＞）＜/li＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/ｅ７９ａ６９６２ｅ０ｄ４ｃ０ｃ１７ｂ２２９０９０２１４９３５ｄ２ｅ３３ｆ８３５４"＞＜code＞ｅ７９ａ６９６＜/code＞＜/a＞ chore（release）: 6.0.1 （＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1949"＞＃1949＜/a＞）＜/li＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/５１ｅ６４２２９ａｃ３３１ａｃｂ０ｄ７ｆ７ｂ１７ｃ６７４２３９９５ｆ９９１ｃ７９"＞＜code＞５１ｅ６４２２＜/code＞＜/a＞ fix: prevent template injection in run: steps （VULN-1652） （＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1947"＞＃1947＜/a＞）＜/li＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/５７ｅ３ａ１３６ｂ７７９ｂ５７０ｆｆｃｄｂｆ８０ｂ３ｂｄｃ９０ｅ７ｆａｂ３ｄｅ２"＞＜code＞５７ｅ３ａ１３＜/code＞＜/a＞ Th/6.0.0 （＜a href="https：//redirect．github．com/codecov/codecov-action/issues/1928"＞＃1928＜/a＞）＜/li＞
＜li＞＜a href="https：//github．com/codecov/codecov-action/commit/ｆ６７ｄ３３ｄｄａ８ａ４２ｂ５１ｃ４２ａ８３１８ａ１ｆ６６４６８１１９ｅ８９８ｂ"＞＜code＞ｆ６７ｄ３３ｄ＜/code＞＜/a＞ Revert "Revert "build（deps）: bump actions/github-script from 7.0.1 to 8.0.0""...＜/li＞
＜li＞See full diff in ＜a href="https：//github．com/codecov/codecov-action/compare/v5...v7"＞compare view＜/a＞＜/li＞
＜/ul＞
＜/details＞
＜br /＞

［！［Dependabot compatibility score］（https：//dependabot-badges.githubapp.com/badges/compatibility＿score?dependency-name=codecov/codecov-action&package-manager=github＿actions&previous-version=5&new-version=7）］（https：//docs．github．com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates＃about-compatibility-scores）

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ｀＠dependabot rebase｀.

［//］: ＃ （dependabot-automerge-start）
［//］: ＃ （dependabot-automerge-end）

＜details＞
＜summary＞Dependabot commands and options＜/summary＞
＜br /＞

You can trigger Dependabot actions by commenting on this PR:

• ｀＠dependabot rebase｀ will rebase this PR
• ｀＠dependabot recreate｀ will recreate this PR, overwriting any edits that have been made to it
• ｀＠dependabot show ＜dependency name＞ ignore conditions｀ will show all of the ignore conditions of the specified dependency
• ｀＠dependabot ignore this major version｀ will close this PR and stop Dependabot creating any more for this major version （unless you reopen the PR or upgrade to it yourself）
• ｀＠dependabot ignore this minor version｀ will close this PR and stop Dependabot creating any more for this minor version （unless you reopen the PR or upgrade to it yourself）
• ｀＠dependabot ignore this dependency｀ will close this PR and stop Dependabot creating any more for this dependency （unless you reopen the PR or upgrade to it yourself）

＜/details＞