From d982c4d6cc99a668fdc87a9726ed28edaaa14317 Mon Sep 17 00:00:00 2001
From: Kyle McDonald <kyle@knock.app>
Date: Wed, 11 Mar 2026 10:18:12 -0500
Subject: [PATCH] fix: dependabot automatic changeset security warnings

---
 .github/workflows/dependabot-changeset.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-changeset.yml b/.github/workflows/dependabot-changeset.yml
index 16e43c737..181f6a1c5 100644
--- a/.github/workflows/dependabot-changeset.yml
+++ b/.github/workflows/dependabot-changeset.yml
@@ -1,7 +1,7 @@
 name: Dependabot Changeset
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
   workflow_dispatch:
     inputs:
@@ -10,6 +10,10 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   changeset:
     name: Add changeset for dependency update