Agents and CodeMedium importance
GitHub Actions will block pull_request_target by default on 12/02, with the first test this Monday (11/09)
Starting 12/02/2026, GitHub Actions blocks pull_request_target events in all public repositories unless an event policy allows them. The date was 11/02 and was postponed. Before that there are two “brownouts”, with the block actually switched on: 11/09 and 11/16, from 16:00 to 18:00 UTC (1 p.m. to 3 p.m. Brasília time). The reason: this trigger runs in the context of the base repository, with access to secrets, and untrusted code from a fork can steal them. Private and internal repositories and GitHub Enterprise Server are not affected.
Published in edition no. 17 of Noticiário do Joãozinho ·
Translated by Joãozinho AI from the original Brazilian Portuguese edition. Facts, numbers and sources are the same as in the original; quotes, video titles and source names stay in their original language. Read the original in Portuguese
Original source
https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/