GitHub will block pull_request_target in public repos from December 2

GitHub Actions will block pull_request_target events by default in public repositories starting December 2, 2026, unless an Actions event policy explicitly allows them. Two-hour brownouts on November 9 and November 16 give maintainers a rehearsal first.