Repository navigation
chore(deps): bump go.opentelemetry.io/otel/trace from 1.41.0 to 1.47.0 in /packages/otel-collector #5624
Triggered via pull request
November 14, 2026 01:56
dependabot[bot]
dependabot[bot]
opened
#3666
Status
Success
Total duration
4m 20s
Artifacts
–
deep-review.yml
on: pull_request_target
deep-review
4m 16s
Annotations
4 warnings and 1 notice
|
Workflow execution policy warning (evaluate mode):
.github/workflows/deep-review.yml#L1
On December 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
|
|
deep-review
15 Bash rule(s) in claude_args are not on the deny list and stay allowed. Check that they cannot run code from the pull request.
|
|
deep-review
The author of pull request #3666 is not confirmed to have write access, so commands that run code from the checkout are denied. Set restrict_untrusted_prs to "false" to turn this off.
|
|
deep-review
⚠️ SECURITY WARNING: Bypassing write permission check for dependabot[bot] due to allowed_non_write_users='*'. This should only be used for workflows with very limited permissions.
|
|
deep-review
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
|