Post
Socket
socket.dev
did:plc:n6f3j47vjucu5ijwdmow7n2w
GitHub has delayed its default block on `pull_request_target` workflows until Dec. 2.
The change tightens security but could disrupt legitimate OSS automation.
Here's what maintainers need to know:
https://socket.dev/blog/github-to-block-pull-request-target
2026-11-05T20:33:47.086Z