v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @aiqiaoy in #2518
• trim only ascii whitespace for branch by @aiqiaoy in #2521
• escape values passed to --unset by @aiqiaoy in #2530
• Various dependency updates

Full Changelog: v7...v7.0.1

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in #2500
• backport fixes to releases-v6 by @aiqiaoy in #2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: v6.0.3...v6.1.0

v5.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v5 by @aiqiaoy in #2501
• backport fixes to releases-v5 by @aiqiaoy in #2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: v5.0.1...v5.1.0

v4.4.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v4 by @aiqiaoy in #2502
• backport fixes to releases-v4 by @aiqiaoy in #2524

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: v4.3.1...v4.4.0

v3.7.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v3 by @aiqiaoy in #2503
• backport fixes to releases-v3 by @aiqiaoy in #2525

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: v3.6.0...v3.7.0

v2.8.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v2 by @aiqiaoy in #2504
• backport fixes to releases-v2 by @aiqiaoy in #2526

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: v2.7.0...v2.8.0

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in #2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
• Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
• Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
• upgrade module to esm and update dependencies by @aiqiaoy in #2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462
• getting ready for checkout v7 release by @aiqiaoy in #2464
• update error wording by @aiqiaoy in #2467

New Contributors

• @aiqiaoy made their first contribution in #2454

Full Changelog: v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @ericsciple in #2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414
• Fix checkout init for SHA-256 repositories by @yaananth in #2439
• Update changelog for v6.0.3 by @yaananth in #2446

New Contributors

• @yaananth made their first contribution in #2414

Full Changelog: v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in #2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

Full Changelog: v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @ericsciple in #2314
• Add worktree support for persist-credentials includeIf by @ericsciple in #2327
• Clarify v6 README by @ericsciple in #2328

Full Changelog: v6...v6.0.1