Repository navigation
Pin GitHub Actions to full-length commit SHAs - #3472
Merged
Jiuqing Song (JiuqingSong) merged 1 commit intoOct 7, 2026
Merged
Jiuqing Song (JiuqingSong) merged 1 commit into
Jiuqing Song (JiuqingSong) merged 1 commit into
Conversation
Jiuqing Song (JiuqingSong)
approved these changes
Oct 7, 2026
Julia Roldi (juliaroldi)
added a commit
that referenced
this pull request
Oct 16, 2026
* Bump fast-uri from 3.1.6 to 3.1.8 (#3467) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.6 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.6...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jiuqing Song <jisong@microsoft.com> * Fix Word Desktop nested list spacing (#3469) * Fix Word Desktop nested list spacing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 * Fix Word list margin shorthand parsing Parse margin shorthand by top-level whitespace so CSS function values such as calc() and var() are preserved when removing horizontal Word list margins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 --------- Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 * Fix borders being incorrectly applied when pasting tables from Word Desktop (#3470) * Handle Word table no-border paste Add a Word Desktop border parser that reads the original style attribute and preserves explicit border:none declarations by clearing the corresponding table border formats. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 * Use 'none' instead of empty string for no-border values in Word table paste Fix unit tests for addParser call counts after adding wordBorderParser Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fc13a30a-b68a-4db8-a3eb-c057f2195fe4 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 Copilot-Session: fc13a30a-b68a-4db8-a3eb-c057f2195fe4 * Fix list bullet font size using stale font from previous element (#3471) Root cause: When pasting a Word list item with no Word fake-bullet markup (i.e. no mso-list:Ignore span), processAsListItem created the list item's format holder (used to render the bullet/number) from context.segmentFormat *before* parsing the current list item element's own font family/size into it. This meant the first list item's bullet font came from whatever was left over from the previously processed element, instead of the list item's own style. Fix: Parse the list item element's own segment format into context.segmentFormat before creating the list item, so the format holder always reflects the current list item's own resolved font. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fc13a30a-b68a-4db8-a3eb-c057f2195fe4 * Pin GitHub Actions to full-length commit SHAs (#3472) * Fix unsafe URL handling and HTML sanitization (#3475) Add a shared isUnsafeUrl helper and use it in link insertion, link format parsing/application, HTML sanitization, and paste link parsing to reject script protocols obfuscated with browser-ignored characters while preserving safe URLs containing similar text. Handle SVG anchor URLs during paste, remove xmp from allowed tags to avoid unsafe raw-text serialization, and restrict sanitizer map lookups to own properties so inherited object members cannot break HTML conversion. Add regression tests for URL normalization and HTML sanitization. * Version bump to main 9.61.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434dcda2-329b-46d3-9de3-48554356e678 * Return false for Shift+Tab outdent when only when segment before marker are spaces. (#3474) * Return false for Shift+Tab outdent when only entities precede the marker handleTabOnParagraph previously fell through without returning false when the segment immediately before the collapsed selection marker was not a Text segment (e.g. an Entity), causing preventDefault() to be called without actually outdenting. Now it checks whether all segments before the marker are entities and returns false so the browser's default Shift+Tab behavior runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a6a96dae-ddfc-4128-974c-c3d69eba91d2 * Simplify entity-before-marker check to generic non-Text fallback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a6a96dae-ddfc-4128-974c-c3d69eba91d2 * Fix test type error: provide valid ContentModelEntity shape in handleTabOnParagraphTest Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a6a96dae-ddfc-4128-974c-c3d69eba91d2 * Fix browser-dependent font expectation in PowerPoint paste test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2253ec0d-4994-4f43-b8f7-bead705407aa --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a6a96dae-ddfc-4128-974c-c3d69eba91d2 Copilot-Session: 2253ec0d-4994-4f43-b8f7-bead705407aa --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jiuqing Song <jisong@microsoft.com> Co-authored-by: Bryan Valverde U <bvalverde@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Dan Fiedler <151573964+danfiedler-msft@users.noreply.github.com> Copilot-Session: 12a1ef28-2e75-4648-a2a2-c149b4436919 Copilot-Session: fc13a30a-b68a-4db8-a3eb-c057f2195fe4 Copilot-Session: 434dcda2-329b-46d3-9de3-48554356e678 Copilot-Session: a6a96dae-ddfc-4128-974c-c3d69eba91d2 Copilot-Session: 2253ec0d-4994-4f43-b8f7-bead705407aa
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions. This work is described in more detail at https://aka.ms/action-pinning.
Why?
Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.
This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.
What changed?
Action pinning: Third-party action references in
.github/workflows/that used mutable tag-based references (e.g.,actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g.,actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.Dependabot configuration:
.github/dependabot.ymlhas been updated to ensure agithub-actionspackage-ecosystem section is present with acooldownconfiguration (default-days: 7). If the file did not exist, it was created. If agithub-actionssection already existed, only thecooldownblock was added or itsdefault-daysvalue was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.Is this safe to merge?
Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes in action execution are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for
actions/checkout@v7can be found in theshaproperty in the JSON response forGET https://api.github.com/repos/actions/checkout/commits/v7).Additional Information
For more information, please see https://aka.ms/action-pinning