From 8ec970b104ffe1f0f89a46c4d61bb5152a8483c6 Mon Sep 17 00:00:00 2001 From: Jack Green Date: Mon, 31 Aug 2026 19:12:17 +0100 Subject: [PATCH] Update `securely-using-pull_request_target` to remove `actions/checkout` version restriction _Originally_ the change applied to `actions/checkout` `v7` only, but it's [since been backported to older versions](https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/) without the docs being updated. --- .../reference/security/securely-using-pull_request_target.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/actions/reference/security/securely-using-pull_request_target.md b/content/actions/reference/security/securely-using-pull_request_target.md index 960426b4c02c..1d03625565e1 100644 --- a/content/actions/reference/security/securely-using-pull_request_target.md +++ b/content/actions/reference/security/securely-using-pull_request_target.md @@ -11,7 +11,7 @@ category: - Secure your workflows --- -This guide helps you assess whether your workflow should use the `pull_request_target` event and understand the security risks involved. It also explains the protection {% data variables.product.github %} applies to [`actions/checkout`](https://github.com/actions/checkout) v7 and later to reduce these risks by default, and when to opt out of that protection if necessary. +This guide helps you assess whether your workflow should use the `pull_request_target` event and understand the security risks involved. It also explains the protection {% data variables.product.github %} applies to [`actions/checkout`](https://github.com/actions/checkout) to reduce these risks by default, and when to opt out of that protection if necessary. Read [`pull_request_target`](/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target) before you check out pull request code from one of these workflows, or before you set the `allow-unsafe-pr-checkout` input on `actions/checkout`.