What actually happened
GitHub has confirmed that, from 2 December 2026, public repositories on GitHub.com will block pull_request_target events by default unless an applicable Actions event policy explicitly permits them. The trigger executes in the base repository's context, where secrets may be available. A workflow that checks out and executes untrusted code from a fork can turn a routine pull request into credential exposure.
Before enforcement, GitHub will run two temporary blocking windows on 9 and 16 November, both from 16:00 to 18:00 UTC. Affected workflows will fail with an annotation during those windows. Outside them, the default rule remains in evaluate mode. Private and internal repositories, and GitHub Enterprise Server, are outside this change.
GitHub also added Dependabot version updates for supported Agent Package Manager dependencies. Teams defining shared AI-agent skills, prompts and instructions in apm.yml can configure an apm ecosystem entry in .github/dependabot.yml. Dependabot opens update pull requests and regenerates apm.lock.yaml when present. This covers version updates, not vulnerability alerts.
Separately, GitHub Desktop 3.6.10 and later supports short-lived, automatically refreshing authentication tokens for eligible GitHub.com and Enterprise Cloud accounts. Rollout is gradual. An update does not migrate existing sessions: eligible users receive the new token type when they sign in.
Why a small team cares
Consider a small web development agency maintaining client stores and marketing sites. A public repository may accept outside pull requests, while the CI pipeline also holds deployment credentials. A careless pull_request_target workflow that runs contributor code could expose access beyond that repository. Even if the workflow is safe, a previously permitted trigger may fail during the November tests or after the December deadline, interrupting releases.
The agent dependency change matters for teams sharing prompts and skills across projects. Those files influence how coding assistants behave, but a Dependabot pull request is not a security guarantee. Treat an instruction update as a behavioral change that needs review. The Desktop update reduces the useful lifetime of a stolen token without adding regular manual renewal work once available.
Hype vs useful
These are not three reasons to buy another security product. The most urgent item is a specific GitHub Actions policy deadline affecting public repositories. GitHub provides evaluate-mode results in Actions Insights, so you can see potential failures before changing anything.
Do not blindly allow every blocked workflow to keep CI green. Allow only the workflows that genuinely need the event, and do not execute untrusted pull-request code with privileged tokens. Dependabot's APM support is useful only if you already manage agent dependencies through APM. Short-lived Desktop tokens are a sensible upgrade, but availability is account-dependent.
