Update styfle/cancel-workflow-action action from 0.12.1 to v0.13.0 (.github/workflows/cancel-outdated-workflow-runs.yml)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
styfle/cancel-workflow-action	action	minor	0.12.1 → 0.13.0

---

Release Notes

styfle/cancel-workflow-action (styfle/cancel-workflow-action)

v0.13.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dryrunsecurity]

This pull request leaves a workflow (.github/workflows/cancel-outdated-workflow-runs.yml) using the pull_request_target trigger that supplies the default broad GITHUB_TOKEN permissions to a third‑party action (styfle/cancel-workflow-action) instead of restricting permissions (it only needs actions: write), which increases risk if the action is compromised. Consider adding an explicit permissions block to follow least-privilege principles.

Principle of Least Privilege Violation (GITHUB_TOKEN permissions) in .github/workflows/cancel-outdated-workflow-runs.yml

Vulnerability

Principle of Least Privilege Violation (GITHUB_TOKEN permissions)

Description

The workflow .github/workflows/cancel-outdated-workflow-runs.yml uses the pull_request_target trigger and passes ${{ github.token }} to a third-party action without defining an explicit permissions block. By default, pull_request_target workflows grant the GITHUB_TOKEN broad read/write permissions to the repository (including contents: write, packages: write, etc.). However, the styfle/cancel-workflow-action only requires actions: write to perform its function. This grants excessive privileges to the third-party action, increasing the blast radius if the action were compromised or contained a vulnerability.

django-DefectDojo/.github/workflows/cancel-outdated-workflow-runs.yml

Line 19 in f7d37b4

access_token: ${{ github.token }}

---

All finding details can be found in the DryRun Security Dashboard.