nextjs @vercel.com, @react.dev at night, @testing-library.com core | testing + a11y first | he/himhttps://bsky.app/profile/sebbie.devhttps://bsky.app/profile/sebbie.dev/post/3mv4bosl2hc2oAlmost as many contributors as 19.0.0. Lots of bug fixes from the community in there! [contains quote post or other embedded content]09 Sep 2026 19:32 +0000at://did:plc:5nhpcpbpk7lfwc6jsjd4pdpc/app.bsky.feed.post/3mv4bosl2hc2ohttps://bsky.app/profile/sebbie.dev/post/3mlnx33kol222I personally would recommend reviewing actions/checkout with a custom ref input instead. actions/checkout is the way to escape trust boundaries. In pull_request_target events that's fork -> upstream. But in workflow_dispatch events actions/checkout allows running in protected GH environments. [contains quote post or other embedded content]12 May 2026 13:58 +0000at://did:plc:5nhpcpbpk7lfwc6jsjd4pdpc/app.bsky.feed.post/3mlnx33kol222