Several catalog entries carry dated GitHub platform notes (e.g. actions/checkout refusing fork head/merge checkouts under pull_request_target, shipped in v7 and backported on a specific date; npm v12 install-script defaults; read-only Actions cache tokens). These were accurate at authoring time, but as adoption completes and the ecosystem moves to the newer defaults, the notes read as increasingly historical and can mislead a reader into thinking a mitigation is still pending when it is now the default.
Ask: decide a maintenance cadence (or an automated freshness check) for the dated platform notes, and a convention for retiring a note once its change is universally the default rather than a live residual.
Found during the ci-secure launch-readiness review (panel P2).
Activity
0No activity yet.