mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-13 13:48:26 +00:00
Thibaud-Vdb
237ab7fa68
request-review.yml still referenced tj-actions/changed-files@v41, the action and version range hit by the March 2025 supply chain compromise (GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at code that dumped the runner's memory, including the job's GITHUB_TOKEN, into the public build logs. Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed again; the two other call sites already on v46 get the same pin in the next commit. The action's file-matching API is unchanged between v41 and v46 for the patterns used here.