Avatar for the codecov user
codecov
umbrella
BlogDocsChangelog

Performance History

Latest Results

add version 26.4.1 migration
release/26.4.1
16 hours ago
fix: move upload finisher retries to 5
th/retries-to-5
12 days ago
feat(bitbucket): Migrate to OAuth 2.0 (#772) * feat(bitbucket): Migrate to OAuth 2.0 * fix(bitbucket): add OAuth 2.0 state param to prevent CSRF/account takeover Generate a cryptographically random state on redirect, store it in a signed httponly cookie, and validate it matches before exchanging the authorization code. Also updates tests for the OAuth 2.0 flow. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(bitbucket): update VCR cassettes for OAuth 2.0 Bearer token auth Remove OAuth 1.0 query params (oauth_consumer_key, oauth_token, oauth_version) from cassette URIs to match the new Bearer token request format. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(bitbucket): add missing VCR cassette for test_list_repos_generator Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(bitbucket): add OAuth 2.0 token refresh on 401 Access tokens expire in ~2h; refresh using stored refresh_token. Removes the no-op early returns in the token refresh callbacks for both API and worker that were left over from OAuth 1.0. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(bitbucket): restore BITBUCKET_SERVER refresh guard; handle refresh errors - Bitbucket Server still uses OAuth 1.0 so restore the return None guard that was incorrectly removed alongside the BITBUCKET guard - Catch TorngitClientGeneralError/5xx from refresh_token() in api() so an expired/revoked refresh token raises the original 401 instead of a confusing refresh error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(bitbucket): update tests for enabled token refresh callback Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(bitbucket): add secure flag to state cookie; remove unused param - Set secure=settings.SESSION_COOKIE_SECURE on _bb_oauth_state cookie so it isn't transmitted over plain HTTP - Remove unused original_url param from refresh_token() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(bitbucket): add samesite and max_age to state cookie Prevents state cookie from being sent on cross-site requests when SameSite=None is configured (e.g. staging). Also caps cookie lifetime at 300s to limit the window for state reuse. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(bitbucket): replace while loop with explicit two-attempt retry Extract HTTP call into _send_request() helper and make the 401 token refresh retry explicit instead of using while/continue. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: sentry[bot] <39604003+sentry[bot]@users.noreply.github.com> Co-authored-by: Joe Becher <joe.becher@sentry.io> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
main
16 days ago

Latest Branches

CodSpeed Performance Gauge
0%
Release 26.4.1#790
16 hours ago
19c181b
release/26.4.1
CodSpeed Performance Gauge
0%
fix: move upload finisher retries to 5#778
12 days ago
ace1554
th/retries-to-5
CodSpeed Performance Gauge
0%
feat(api): expose upload state_id/state_name in v2 commit uploads#776
15 days ago
bd2b171
feat/v2-commit-uploads-state-id-name
© 2026 CodSpeed Technology
Home Terms Privacy Docs