Bump the minor-npm-dependencies group with 3 updates

Bumps the minor-npm-dependencies group with 3 updates: [@vercel/ncc](https://github.com/vercel/ncc), [eslint-plugin-github](https://github.com/github/eslint-plugin-github) and [prettier](https://github.com/prettier/prettier).


Updates `@vercel/ncc` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/vercel/ncc/releases)
- [Commits](https://github.com/vercel/ncc/compare/0.44.0...0.44.1)

Updates `eslint-plugin-github` from 6.0.0 to 6.1.1
- [Release notes](https://github.com/github/eslint-plugin-github/releases)
- [Commits](https://github.com/github/eslint-plugin-github/compare/v6.0.0...v6.1.1)

Updates `prettier` from 3.8.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.4...3.9.5)

---
updated-dependencies:
- dependency-name: "@vercel/ncc"
  dependency-version: 0.44.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-npm-dependencies
- dependency-name: eslint-plugin-github
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-npm-dependencies
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

__test__/input-helper.test.ts

@@ -180,50 +180,4 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  describe('unsafe PR checkout guard', () => {
-    const forkPayload = {
-      repository: {id: 100},
-      pull_request: {
-        head: {
-          sha: '1234567890123456789012345678901234567890',
-          repo: {id: 200, full_name: 'attacker/fork'}
-        },
-        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-      }
-    }
-
-    it('allows the default self-checkout on a fork pull_request_target', async () => {
-      const originalEvent = mockGithubContext.eventName
-      const originalPayload = mockGithubContext.payload
-      try {
-        mockGithubContext.eventName = 'pull_request_target'
-        mockGithubContext.payload = forkPayload
-        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
-        // equals the PR head SHA. The default self-checkout must still succeed.
-        mockGithubContext.sha = '1234567890123456789012345678901234567890'
-        const settings: IGitSourceSettings = await inputHelper.getInputs()
-        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      } finally {
-        mockGithubContext.eventName = originalEvent
-        mockGithubContext.payload = originalPayload
-      }
-    })
-
-    it('refuses an explicit fork repository on pull_request_target', async () => {
-      const originalEvent = mockGithubContext.eventName
-      const originalPayload = mockGithubContext.payload
-      try {
-        mockGithubContext.eventName = 'pull_request_target'
-        mockGithubContext.payload = forkPayload
-        inputs.repository = 'attacker/fork'
-        await expect(inputHelper.getInputs()).rejects.toThrow(
-          /Refusing to check out fork pull request code/
-        )
-      } finally {
-        mockGithubContext.eventName = originalEvent
-        mockGithubContext.payload = originalPayload
-      }
-    })
-  })
 })

dist/index.js

@@ -42191,19 +42191,12 @@ async function getInputs() {
         (getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
             'TRUE';
     core_debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-    // The default self-checkout (this repository with no explicit ref) always
-    // resolves to the trusted ref/commit GitHub set for the triggering event, so
-    // the fork-checkout guard only needs to run when the caller customized the
-    // repository or ref.
-    const isDefaultCheckout = isWorkflowRepository && !getInput('ref');
-    if (!isDefaultCheckout) {
-        assertSafePrCheckout({
-            qualifiedRepository,
-            ref: result.ref,
-            commit: result.commit,
-            allowUnsafePrCheckout: result.allowUnsafePrCheckout
-        });
-    }
+    assertSafePrCheckout({
+        qualifiedRepository,
+        ref: result.ref,
+        commit: result.commit,
+        allowUnsafePrCheckout: result.allowUnsafePrCheckout
+    });
     return result;
 }
 

package-lock.json

@@ -20,13 +20,13 @@
         "@types/node": "^24.1.0",
         "@typescript-eslint/eslint-plugin": "^8.54.0",
         "@typescript-eslint/parser": "^8.54.0",
-        "@vercel/ncc": "^0.44.0",
+        "@vercel/ncc": "^0.44.1",
         "eslint": "^9.39.2",
-        "eslint-plugin-github": "^6.0.0",
+        "eslint-plugin-github": "^6.1.1",
         "eslint-plugin-jest": "^29.12.1",
         "jest": "^29.7.0",
         "js-yaml": "^4.2.0",
-        "prettier": "^3.8.4",
+        "prettier": "^3.9.5",
         "ts-jest": "^29.4.11",
         "ts-node": "^10.9.2",
         "typescript": "^5.5.4"
@@ -680,19 +680,19 @@
       }
     },
     "node_modules/@eslint/compat": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.1.tgz",
-      "integrity": "sha512-cfO82V9zxxGBxcQDr1lfaYB7wykTa0b00mGa36FrJl7iTFd0Z2cHfEYuxcBRP/iNijCsWsEkA+jzT8hGYmv33w==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.0.tgz",
+      "integrity": "sha512-LgaSCymEpw7tF53xvDw9SNsraPb1IBHxpdABIOM0hW8UAlP8znrjYtuxfR58FSJ3L9BhwD+FaPRFQpZq84Nh6g==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^0.17.0"
+        "@eslint/core": "^1.2.1"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "peerDependencies": {
-        "eslint": "^8.40 || 9"
+        "eslint": "^8.40 || 9 || 10"
       },
       "peerDependenciesMeta": {
         "eslint": {
@@ -700,6 +700,19 @@
         }
       }
     },
+    "node_modules/@eslint/compat/node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@eslint/config-array": {
       "version": "0.21.2",
       "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
@@ -1986,9 +1999,9 @@
       }
     },
     "node_modules/@vercel/ncc": {
-      "version": "0.44.0",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.44.0.tgz",
-      "integrity": "sha512-pHyI+bZokSgIscTKFSmpNk5vZzmOrb9RW0Vu4SRyqUvkJ0kgg3PzaZLLDVTFXhbUiCqg0/Eu8L4fKtgViA92kg==",
+      "version": "0.44.1",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.44.1.tgz",
+      "integrity": "sha512-cUjIE5P2YY1n+Kt9rFIazMMpGoPn1Fic04rOmTkElMkiDP5oszGfERMpo2shVkFKDL7rVppdM2pqJKC59shQWQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -3410,13 +3423,13 @@
       }
     },
     "node_modules/eslint-plugin-github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.0.0.tgz",
-      "integrity": "sha512-J8MvUoiR/TU/Y9NnEmg1AnbvMUj9R6IO260z47zymMLLvso7B4c80IKjd8diqmqtSmeXXlbIus4i0SvK84flag==",
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz",
+      "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint/compat": "^1.2.3",
+        "@eslint/compat": "^2.0.0",
         "@eslint/eslintrc": "^3.1.0",
         "@eslint/js": "^9.14.0",
         "@github/browserslist-config": "^1.0.0",
@@ -3433,24 +3446,24 @@
         "eslint-plugin-no-only-tests": "^3.0.0",
         "eslint-plugin-prettier": "^5.2.1",
         "eslint-rule-documentation": ">=1.0.0",
-        "globals": "^16.0.0",
+        "globals": "^17.7.0",
         "jsx-ast-utils": "^3.3.2",
         "prettier": "^3.0.0",
         "svg-element-attributes": "^1.3.1",
-        "typescript": "^5.7.3",
+        "typescript": "^6.0.3",
         "typescript-eslint": "^8.14.0"
       },
       "bin": {
         "eslint-ignore-errors": "bin/eslint-ignore-errors.js"
       },
       "peerDependencies": {
-        "eslint": "^8 || ^9"
+        "eslint": "^8 || ^9 || ^10"
       }
     },
     "node_modules/eslint-plugin-github/node_modules/globals": {
-      "version": "16.5.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
-      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
+      "version": "17.7.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz",
+      "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3460,6 +3473,20 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/eslint-plugin-github/node_modules/typescript": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
     "node_modules/eslint-plugin-i18n-text": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/eslint-plugin-i18n-text/-/eslint-plugin-i18n-text-1.0.1.tgz",
@@ -6443,9 +6470,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.8.4",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
-      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
+      "version": "3.9.5",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.5.tgz",
+      "integrity": "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==",
       "dev": true,
       "license": "MIT",
       "bin": {

package.json

@@ -43,13 +43,13 @@
     "@types/node": "^24.1.0",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
     "@typescript-eslint/parser": "^8.54.0",
-    "@vercel/ncc": "^0.44.0",
+    "@vercel/ncc": "^0.44.1",
     "eslint": "^9.39.2",
-    "eslint-plugin-github": "^6.0.0",
+    "eslint-plugin-github": "^6.1.1",
     "eslint-plugin-jest": "^29.12.1",
     "jest": "^29.7.0",
     "js-yaml": "^4.2.0",
-    "prettier": "^3.8.4",
+    "prettier": "^3.9.5",
     "ts-jest": "^29.4.11",
     "ts-node": "^10.9.2",
     "typescript": "^5.5.4"

src/input-helper.ts

@@ -168,19 +168,12 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     'TRUE'
   core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
 
-  // The default self-checkout (this repository with no explicit ref) always
-  // resolves to the trusted ref/commit GitHub set for the triggering event, so
-  // the fork-checkout guard only needs to run when the caller customized the
-  // repository or ref.
-  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
-  if (!isDefaultCheckout) {
-    unsafePrCheckoutHelper.assertSafePrCheckout({
-      qualifiedRepository,
-      ref: result.ref,
-      commit: result.commit,
-      allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    })
-  }
+  unsafePrCheckoutHelper.assertSafePrCheckout({
+    qualifiedRepository,
+    ref: result.ref,
+    commit: result.commit,
+    allowUnsafePrCheckout: result.allowUnsafePrCheckout
+  })
 
   return result
 }