jellyfin/jellyfin-vue
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-vue.git synced 2026-09-02 21:04:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

Mitigate pull_request_target privilege escalation (#2735)

Browse Source 
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
This commit is contained in:
Andrew Rabert
2026-02-20 19:10:50 -05:00
committed by Andrew Rabert
parent e9eeb9c417
commit e170b4b692
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pull_request.yml
+1 -1
View File
@@ -5,7 +5,7 @@ concurrency:
cancel-in-progress: true
on:
pull_request_target:
pull_request:
merge_group:
permissions: