From 3029519052b906e4733e95037d635a51dffb4871 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 16 Oct 2026 12:31:05 -0700
Subject: [PATCH] build(deps): update checkout action to v7.0.1

---
 .github/workflows/ci.yml | 2 +-
 CHANGELOG.md             | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a6abf6..83859db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: node --test --test-concurrency=2 tests/*.test.mjs
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6912ae..da42750 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Update CI checkout to v7.0.1 for dependency security fixes and safer fork handling.
+
 - Ignore maintainer opt-in reminders in the comment prefilter so quoted commands do not queue another dispatch. Thanks @SebTardif (#4).
 - Keep comment commands dispatching when the optional target acknowledgement token cannot be minted. Thanks @SebTardif (#5).