GitHub Actions has no built-in mechanism to lock dependency versions. Version tags like @v4 can be silently retagged to point to different code. Composite actions pull in transitive dependencies you can't see or audit.
First seen: 2025-12-20 05:23
Last seen: 2025-12-20 12:27