GitHub Actions Is Changing pull_request_target — Check Your Workflows Before December 2

Sanem KOCA — Sun, 08 Nov 2026 20:43:06 +0000

Developer roundup · November 1–8, 2026

A contributor opens a pull request from a fork. Your workflow checks out their code and runs a test script. If that workflow uses pull_request_target, the script can run with access to the base repository’s secrets. That’s the risk behind a GitHub Actions default that changes on December 2. GitHub’s announcement

Check your GitHub Actions workflows

Start by searching the workflow files in your local checkout.

git grep -n pull_request_target -- .github/workflows/

If you find a match, check whether the workflow runs code from the fork and look at Insights to see what GitHub’s evaluation mode would block. Starting December 2, GitHub will block the event by default in public repositories unless an applicable Actions event policy explicitly allows it. GitHub also scheduled temporary enforcement windows for November 9 and 16, from 16:00 to 18:00 UTC. Schedule and preparation steps

Four GitHub repos for everyday developer work

When you need to…	What to look at
Commit a bug fix without including the unfinished refactor in the same file	Viff is a desktop Git client with side-by-side diffs, line-by-line staging, and merge conflict resolution. Repository
Let an agent call a few Laravel endpoints	laravel-mcp-bridge exposes selected routes through MCP and applies your app’s existing authorization rules. Repository
Show a teammate how your services fit together	stack-diagram turns a plain-text architecture description into an HTML or PNG diagram. Repository
Give a coding agent a project environment with its own toolchain	devvm puts the agent’s workspace and the project dependencies in a separate virtual machine on macOS or Linux. Repository

Two Claude Code skills for different kinds of review

Cloudflare Security Audit runs a multi-stage security review of code and APIs. The Skill Leaderboard’s November 8 snapshot showed about 10.5K GitHub stars gained in seven days. Repository · Leaderboard

unslop reviews an existing web interface for overused design patterns and helps revise them. Upstar ranked it first in its monthly Claude Code roundup on November 7, with about 11K stars gained over the period it tracked. Repository · Upstar ranking

Four more updates from the week

PHP 8.6 RC5 is out. PHP 8.6.0 is scheduled for November 19. If you maintain a Laravel app, try installing your Composer dependencies and running your test suite against RC5 in a test environment. PHP announcement · Release schedule
Google open-sourced XLA Serving Engine. It lets you export a model developed in Python and serve it in a C++ runtime. Google Open Source Blog
Firefox 160 Beta adds custom HTTP headers to WebTransport. If your code calls exportKeyingMaterial(), check the signature. context is now required, and outputLength specifies how many bytes to derive. MDN release notes
OpenAI plans to acquire Pierre. Codex already uses Pierre’s Trees and Diffs libraries, which will stay open source. If the deal closes, OpenAI plans to bring Code Storage features to Codex. OpenAI announcement

If you maintain a public repo, what does CI need to do on fork PRs that your current pull_request workflow can’t handle? I’d like to hear which cases still depend on pull_request_target.

AI assisted with adapting and editing this roundup for DEV.

DEV Community: Sanem KOCA

GitHub Actions Is Changing pull_request_target — Check Your Workflows Before December 2

Check your GitHub Actions workflows

Four GitHub repos for everyday developer work

Two Claude Code skills for different kinds of review

Four more updates from the week