## The problem
Issue codecov/codecov-action#1653 (closed, 32 comments): v5 upgrade gives new error 'token required because branch is protected'. PR upgrading from v4 to v5 has a token in the secrets, but with v5 it fails with the branch-protection error.
## The fix
[thomasrockhu-codecov (commenter)]: If codecov-action v5 fails on Dependabot PRs with "token required because branch is protected" even though the token is in your repo secrets, add CODECOV_TOKEN to your Dependabot secrets too (repo Settings, Secrets and variables, Dependabot). v5 reads the token differently and Dependabot PRs do not inherit regular repository secrets, so the protected-branch check fails without it.
## Notes
Thread: https://github.com/codecov/codecov-action/issues/1653. Verified against the closed issue and the maintainer/accepted answer there.