As cited
Copy frozen at (site build).
cloud saas
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub will enforce a default block on pull_request_target workflows in public repositories starting December 2, 2026, with two test windows on November 9 and 16 to preview impact. The trigger, introduced to automate pull request tasks, has become an attack vector for credential theft and supply chain compromise when workflows check out untrusted code or pass attacker-controlled data to shell commands. Maintainers can explicitly allow pull_request_target via Actions event policies, though configuration tools vary by pricing tier and smaller organizations face additional operational burden to assess and migrate affected workflows.
Why it matters: Open source maintainers and platform administrators must audit their pull_request_target workflows before December 2 or face workflow failures; the brownout windows on November 9 and 16 provide opportunity to identify affected automation and configure exceptions if the trigger remains necessary for their CI/CD tasks.
- Source published
- First seen by Cybersecurity Tracker