Skip to content

Upgrading codecov 2 to 3

Breaking2.3.1 → 3.8.3Breaking1Security4New3Changed39Fixed14

Full comparisonBack to codecov
Fetching 23 releases from GitHub…14 / 23
BreakingUpgrade verdict

1 breaking change and 4 security fixes.

In plain terms
  • Remove the X-Amz-Acl: public-read header.
  • Move to execFileSync and security fixes.
  • Command injection in codecov (npm package)
  • codecov NPM module allows remote attackers to execute arbitrary commands
Must act Top 4 of 5 that need code or config changes

Node.js requirement changed in 3.0.4: >=0.12 → >=4.0.

Adds ignore-walk 3.0.4, js-yaml 3.14.1, teeny-request 7.1.1.

Drops request.

Installs 27 packages in all (was 68).

What you must change

Breaking1
Remove the X-Amz-Acl: public-read header.
3.7.0CHANGELOG.mdOriginalView source
Security4
Move to execFileSync and security fixes.
3.7.1CHANGELOG.mdOriginalView source
Command injection in codecov (npm package)
Moderate · CVSS 9.3
3.7.1GitHub AdvisoryOriginalView source
codecov NPM module allows remote attackers to execute arbitrary commands
High · CVSS 8.8
3.6.5GitHub AdvisoryOriginalView source
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov
High · CVSS 8.8
3.6.2GitHub AdvisoryOriginalView source