Repository navigation
chore(deps): bump hono from 4.13.13 to 4.13.16 #5559
Triggered via pull request
November 13, 2026 15:06
dependabot[bot]
dependabot[bot]
opened
#3647
Status
Success
Total duration
1m 50s
Artifacts
–
deep-review.yml
on: pull_request_target
deep-review
1m 46s
Annotations
4 warnings and 1 notice
|
Workflow execution policy warning (evaluate mode):
.github/workflows/deep-review.yml#L1
On December 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
|
|
deep-review
15 Bash rule(s) in claude_args are not on the deny list and stay allowed. Check that they cannot run code from the pull request.
|
|
deep-review
The author of pull request #3647 is not confirmed to have write access, so commands that run code from the checkout are denied. Set restrict_untrusted_prs to "false" to turn this off.
|
|
deep-review
⚠️ SECURITY WARNING: Bypassing write permission check for dependabot[bot] due to allowed_non_write_users='*'. This should only be used for workflows with very limited permissions.
|
|
deep-review
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
|