Reference edition : 2026-11-02. Retrospective written and published on 2026-11-08.

Default blocking for public repositories is announced for December 2.

Reference points to check

Source publication : 2026-11-02.

  • pull_request_target
  • 2026-11-09 16:00–18:00 UTC
  • 2026-11-16 16:00–18:00 UTC
  • 2026-12-02

Prepare a useful check

Inventory pull_request_target workflows and permissions. Prepare for the test windows and have each exception approved for a precise scope.

For a Web team, turn this signal into a bounded task: affected site, priority, test and result to share. A news mention does not replace checking the page.

Keep the reference, its date and the relevant passage. Then identify the service, version and responsible person in your own environment.

Try the change on a copy or a limited scope. Compare expected behaviour with the observed result and retain evidence of the check.

This editorial reading proposes a checking method. A supplier announcement confirms neither account enablement nor the outcome on your installation.

Primary source : GitHub Changelog.