The moving v1 tag always points at the latest 1.x. Reference yk-lab/setup-task@v1 to keep receiving fixes.

Please do not open a public issue for security vulnerabilities.

Report them privately via GitHub's Private Vulnerability Reporting (the repository's Security → Report a vulnerability). We aim to acknowledge reports within a few days and will coordinate a fix and a published advisory before any public disclosure.

Helpful details to include:

• affected version(s) of the action,
• runner OS / architecture,
• a description and, if possible, a minimal reproduction.