Skip to content

Release history

checkout releases

Action for checking out a repo

Back to tool Latest release

All releases

15 shown

v2.8.0 Breaking risk
⚠ Upgrade required
  • If you depend on the previous default allowing unsafe PR target workflows, add `allow-unsafe-pr-checkout: true` in your checkout action configuration after upgrading to v2.8.0.
Breaking changes
  • Removed implicit unsafe behavior for `pull_request_target` in GitHub Actions; `allow-unsafe-pr-checkout` flag must be explicitly enabled to restore previous functionality.
Full changelog

What's Changed

  • [BREAKING] backport allow-unsafe-pr-checkout to v2 by @aiqiaoy in https://github.com/actions/checkout/pull/2504
  • backport fixes to releases-v2 by @aiqiaoy in https://github.com/actions/checkout/pull/2526

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v2.7.0...v2.8.0

View release on GitHub
v3.7.0 Breaking risk
Breaking changes
  • Backported `allow-unsafe-pr-checkout` flag to v3 (BREAKING change)
Full changelog

What's Changed

  • [BREAKING] backport allow-unsafe-pr-checkout to v3 by @aiqiaoy in https://github.com/actions/checkout/pull/2503
  • backport fixes to releases-v3 by @aiqiaoy in https://github.com/actions/checkout/pull/2525

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v3.6.0...v3.7.0

View release on GitHub
v4.4.0 Breaking risk
Breaking changes
  • Backported `allow-unsafe-pr-checkout` flag to version 4, altering runtime behavior.
Full changelog

What's Changed

  • [BREAKING] backport allow-unsafe-pr-checkout to v4 by @aiqiaoy in https://github.com/actions/checkout/pull/2502
  • backport fixes to releases-v4 by @aiqiaoy in https://github.com/actions/checkout/pull/2524

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v4.3.1...v4.4.0

View release on GitHub
v5.1.0 Breaking risk
Breaking changes
  • Backported `allow-unsafe-pr-checkout` flag to version 5 (removes prior unsafe default behavior)
Full changelog

What's Changed

  • [BREAKING] backport allow-unsafe-pr-checkout to v5 by @aiqiaoy in https://github.com/actions/checkout/pull/2501
  • backport fixes to releases-v5 by @aiqiaoy in https://github.com/actions/checkout/pull/2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v5.0.1...v5.1.0

View release on GitHub
v6.1.0 Breaking risk
Breaking changes
  • Backported the `allow-unsafe-pr-checkout` flag to version 6, altering default behavior.
Full changelog

What's Changed

  • [BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in https://github.com/actions/checkout/pull/2500
  • backport fixes to releases-v6 by @aiqiaoy in https://github.com/actions/checkout/pull/2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0

View release on GitHub
No immediate action
v7.0.1 Maintenance

Routine maintenance and dependency updates.

Open
No immediate action
v7.0.0 Bug fix

Error wording update

Open
No immediate action
v6.0.3 Maintenance

Routine maintenance and dependency updates.

Open
v6.0.1 New feature

Adds worktree support for persist-credentials includeIf configuration.

View release on GitHub
v5.0.0 Breaking risk

Requires GitHub Actions runner v2.327.1 minimum; now uses Node 24.

View release on GitHub

Beta — feedback welcome: [email protected]