GitHub Actions to block pull_request_target events by default in public repositories from December 2
Announced November 2, 2026
Verified (fact)
GitHub announced that starting December 2, 2026, the pull_request_target event in GitHub Actions will be blocked by default in all public repositories. It will run only when explicitly allowed through the relevant Actions event policy. The change was originally scheduled for a different date and has been rescheduled.
Why it matters (interpretation)
Paths that let external PRs run workflows with elevated permissions have often been used in supply chain attacks, and stronger defaults matter more as AI agents generate PRs in bulk. Repositories using this trigger should review their policies before the deadline.
Sources
- Official pull_request_target blocked by default December 2 GitHub
More about GitHub
-
GitHub: Korea gained over 1 million developers in a year, topping 3.5 million (interview)
At GitHub Universe 2026, Tala Karadsheh, GitHub's senior director of business insights, told ZDNet Korea that the number of GitHub...
-
At GitHub Universe panel, OpenAI, Anthropic, and Google say access control and execution tracking are key challenges as agents spread (report)
According to Electronic Times (etnews), at a GitHub Universe 2026 panel discussion in San Francisco on the 29th (local time),...
-
Former GitHub CEO's Entire plans to open-source Git storage system, pushing back on GitHub COO's 'no need for a new GitHub' remark (report)
According to ZDNet Korea, Entire CEO Thomas Dohmke said developers should be able to choose their code hosting platform. He was...
-
More from GitHub Universe: Copilot Projects runs and assigns agents toward a goal, and GitHub intelligence brings in team context
At GitHub Universe 2026, GitHub unveiled Copilot Projects, which launches sub-agents and divides up work based on a development goal. A...
-
GitHub makes 'Copilot Fusion,' which automatically picks and combines models per task, generally available; local model routing in experimental preview
GitHub made 'Copilot Fusion' generally available at its annual event, GitHub Universe 2026. Instead of users choosing a model for each...