pull_request_target blocked by default December 2 - GitHub Changelog

Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories unless explicitly allowed by an event policy. Private and internal repositories are unaffected. GitHub will temporarily enforce this rule during two scheduled brownouts on November 9 and November 16, 2026, to help users identify and update affected workflows before permanent enforcement begins. Open article →