- GitHub Dependabot
GitHub Dependabot alerts (December 2026): What Startups Need to Know
Our recommendation: Keep alerts enabled for inactive repositories you still depend on, and review GitHub's policy exceptions before 8 December 2026.
- GitHub Actions
GitHub blocks pull_request_target by default on 2 December: keep it, switch, or remove
Remove pull_request_target where the workflow only tests or builds, split it into pull_request plus a separate privileged job where it must comment or deploy, and keep it behind an explicit policy only as a documented last resort.