chore(deps-dev): [security] bump codecov from 3.7.0 to 3.7.1

[dependabot-preview]

Bumps codecov from 3.7.0 to 3.7.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Command injection in codecov (npm package)

Impact

The upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

A similar CVE was issued: CVE-2020-7597, but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer.

We have written a CodeQL query, which automatically detects this vulnerability. You can see the results of the query on the codecov-node project here.

Patches

3.7.1

Workarounds

None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.

References

• CVE-2020-7597

For more information

Affected versions: < 3.7.1

Commits

• 29dd5b6 3.7.1
• c0711c6 Switch from execSync to execFileSync (#180)
• 5f6cc62 Bump lodash from 4.17.15 to 4.17.19 (#183)
• 0c4d7f3 Merge pull request #182 from codecov/update-readme-badges
• cc5e121 Update depstat image and urls
• b44b44e Update readme with 400 error info (#181)
• bb79335 V3.7.0 (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[codecov-commenter]

Codecov Report

Merging #1392 into master will increase coverage by 0.34%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1392      +/-   ##
==========================================
+ Coverage   79.08%   79.42%   +0.34%     
==========================================
  Files         287      294       +7     
  Lines       11155    11356     +201     
  Branches     2360     2423      +63     
==========================================
+ Hits         8822     9020     +198     
- Misses       2333     2336       +3     

Impacted Files	Coverage Δ
...al-provider-imds/src/remoteProvider/httpRequest.ts
...dential-provider-imds/src/fromContainerMetadata.ts
...ider-imds/src/remoteProvider/RemoteProviderInit.ts
...edential-provider-imds/src/remoteProvider/retry.ts
...edential-provider-imds/src/fromInstanceMetadata.ts
...rovider-imds/src/remoteProvider/ImdsCredentials.ts
...provider-imds/dist/cjs/src/fromInstanceMetadata.ts	100.00% <0.00%> (ø)
...ages/credential-provider-env/dist/cjs/src/index.ts	100.00% <0.00%> (ø)
packages/util-buffer-from/dist/cjs/src/index.ts	100.00% <0.00%> (ø)
...ages/credential-provider-ini/dist/cjs/src/index.ts	100.00% <0.00%> (ø)
... and 9 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bcb5503...46f1134. Read the comment docs.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.