jellyfin/jellyfin-web
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-web.git synced 2026-09-03 03:50:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Mitigate pull_request_target privilege escalation

Browse Source 
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
This commit is contained in:
Andrew Rabert
2026-02-20 19:10:53 -05:00
parent 6f24a18c31
commit b0c3c33e6e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pull_request.yml
+1 -1
View File
@@ -5,7 +5,7 @@ concurrency:
cancel-in-progress: true
on:
pull_request_target:
pull_request:
branches:
- master
- release*