pytorch_geometric is using a compromised tj-actions/changed-files GitHub action

[eslerm]

pytorch_geometric uses a compromised version of tj-actions/changed-files. The compromised action appears to leak secrets the runner has in memory.

The action is included in:

• https://github.com/pyg-team/pytorch_geometric/blob/d2bb939a1bfba3b7a6f7d7b102a2771471657319/.github/workflows/documentation.yml

Output of an affected runs:

• https://github.com/pyg-team/pytorch_geometric/actions/runs/13864242315/job/38799668099#step:3:63

Please review.

Learn about the compromise on StepSecurity of Semgrep.

[xnuohz]

will be fixed in #10097. does it meet your requirement?

[akihironitta]

If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

GHSA-mw4p-6x4p-x5m5