< back to search

critical Security update for gh
openSUSE-2026-242

This update for gh fixes the following issues: - Update to version 2.96.0: * Critical security fix: patched vulnerability in gh codespace jupyter that could allow command execution when connecting to malicious Codespaces * Merge commit from fork * Fix concurrent map writes in codespace port forwarding (#13313) * docs: fix broken install command and link/grammar errors (#13690) * Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786) * docs: fix duplicated word in primer README (#13677) * fix(skills): honor --dir without agent prompt (#13766) * Support antigravity-cli and antigravity2.0 in gh skill (#13784) * chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 * docs(search): reword raw qualifier examples * chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 * docs(search): simplify raw qualifier examples * docs(search): add examples for multiple qualifiers * chore(deps): bump actions/attest from 4.1.0 to 4.1.1 * chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 * fix(cmdutil): honor DisableAuthCheck under repo-override parents * feat(release): allow download without authentication * fix(release): don't let a failed draft lookup mask a found release * Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures (#13675) * Detect additional third-party coding agents (#13722) * Add security disclosure guidance to AGENTS.md (#13720) * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 * chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 * ci: pin GitHub Actions to commit SHAs * chore(deps): bump github.com/google/go-containerregistry * Use int64 for GitHub database IDs (#13403) * docs: fix broken anchor link in release-process-deep-dive (#13688) * Cover all printSummary branches in a table test * fix(skills): install universal agent to ~/.agents/skills * fix: show checks summary when all checks were cancelled - The following bugs are no longer present in this release (may have been fixed in previous releases): boo#1234566, boo#1235345, boo#1237669, boo#1239496, boo#1241837, boo#1243930, boo#1251464, boo#1251666, boo#1253929, boo#1258617, boo#1260271, boo#1262339, boo#1262943, boo#1265405, boo#1265777, boo#1266173, boo#1266618, boo#1266975, boo#1267158, boo#1269427 - Update to version 2.95.0: * feat(skills): list available skills when install runs non-interactively (#13548) * fix(skills): stage updates in a temp dir and swap in-place (#13449) * feat: add `repo read-file` and `repo read-dir` (#13580) * Bump Go in devcontainer * Make filtering by bot authors more discoverable (#13642) * chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 * chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 * chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 * chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 * chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 * test(skill): fix test case name * test(skill): merge isolated test into table * Potential fix for pull request finding * docs(discussion): polish help docs * chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 * fix test * support custom CLAUDE_CONFIG_DIR in install - Update to version 2.94.0: * Add gh discussion and Issues 2.0 reference to the `gh` skill, plus a README note (#13631) * fix(discussion comment): fix bug in requiring body/body-file in add/edit mode * chore(discussion/client): rename client files * test(acceptance): fix discussion comment acceptance tests * fix(discussion/shared): error on out-of-range discussion number in URL * fix(discussion view): print only requested items in non-tty output * docs(discussion list): clarify answered examples refer to Q&A discussions * fix(discussion view): show comments and replies in chronological order * refactor(discussion list): simplify no-results message and use success icon helper * fix(discussion view): use color scheme method for success icon * fix(discussion view): error when --comments is used with a comment argument * test(acceptance): use positional comment argument in discussion view test * refactor(discussion/client): take host instead of repo in GetComment * refactor(discussion view): replace --replies flag with positional comment argument * chore: fix formatting * test(acceptance): cover discussion comment URLs in comment and view tests * feat(discussion): support comment URLs in --replies and comment command * test(discussion comment): add non-tty delete flag validation test case * test(acceptance): add discussion comment acceptance test * refactor(acceptance): use discussion comment command instead of raw API calls * feat(discussion): add discussion comment command * feat(discussion/client): add comment manipulation methods * chore: apply formatting * chore(discussion): remove unused HttpClient field from create and edit * fix(discussion): remove redundant error wrapping on ListCategories * test(discussion list): rename TestNewCmdList2 to TestNewCmdList * Add terminal-mockup canvas extension for marketing screenshots (#13612) * fix(discussion): add missing repo flag override * test(discussion list): consolidate tests into table-driven format * docs(acceptance): add new jq2env and jq-assert functions * test(discussion): add acceptance tests for discussion commands * fix(discussion list): print "answered" instead of checkmark in non-tty mode * refactor(discussion/client): precheck discussions enabled via getRepositoryMeta * refactor(discussion): add Cursor field and ExportData to DiscussionListResult * feat(extension): alias `uninstall` to `remove` * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 * chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 * chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7 * docs(discussion view): improve long help text for clarity * fix(discussion): handle partial failure on create/update label mutations * Clean up deferred issue update helper (#13584) * Auto-install official extension stubs in CI (#13581) * chore(discussion/client): fix formatting * docs(discussion/client): add godoc to exported consts * refactor(discussion list): make pager call/error consistent with view command * refactor(discussion): extract command-level consts for enums * fix(discussion): various polish and small fixes * Merge pull request #13057 from cli/kw/issues-2.0 * Bump Go to 1.26.4 * chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 * address review comments * feat(discussion edit): add discussion edit command * feat(discussion create): add discussion create command * feat(discussion view): add discussion view command * feat(discussion list): add discussion list command * feat(discussion/shared): add shared utilities for discussion commands * feat(discussion/client): add discussion client package * Use github-copilot agent ID in skill list tests and help text * Rename hosts field and helpers to agentHosts in skill list * Stat SKILL.md before reading in skill list * Sanitize terminal control characters in skill list output * chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 * chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10 * address copilot comments, clarify text * address copilot comments * handle skills in skills/ folder when running list command, by marking them as published * address bagtoad's feedback * add --all flag to install all skills in a repo * fix warning message to make it clear * skip prompting for skills without metadata when running gh skill update --all * add logic to preview too * fix discovery support in nested dirs * fix test * fix tests * fix linting * add skill list command - Update to version 2.93.0: * test(attestation): align integration tests with new external HTTP client * fix: use separate http client for non-github hosts * docs: note immutable releases starting v2.93.0 * bump golang.org/x/net * Link to Accessibility category for community discussions instead of ACR (#13481) * Allow agents as application for secrets (#13421) * SHA pin first-party GitHub Actions * chore(deps): bump github/codeql-action from 4 to 4.35.5 * Add 3 day dependabot cooldown period * chore(deps): bump github.com/google/go-containerregistry * Run govulncheck daily instead of weekly * Merge pull request #13486 from cli/tommy/update-x-crypto * Potential fix for pull request finding * Potential fix for pull request finding * Stop bumping homebrew on release * chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#13461) * Remove discussion workflow * Remove dependency on persistent token * Remove third-party license debris * chore(deps): bump github.com/theupdateframework/go-tuf/v2 * docs: drop --repo gh-cli from dnf install lines * Assert digest prefix in release verify no-attestation tests * chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 * Derive digest algorithm from ref length in release verify commands * docs: fix duplicated "of" in release-process-deep-dive * chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 * Simplify bump-go.sh toolchain logic * Remove unnecessary null checks in jq output handling * Rewrite script to use go mod edit instead of grep/sed * Address code review comments * Improve version comparison to handle both X.Y.0 and X.Y.Z formats * Update bump-go.sh to handle missing toolchain directive * Initial plan * Update CODEOWNERS for skills directory ownership * chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 * chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 * fix(copilot): update test assertion to match updated error message * fix(copilot): provide full path to copilot binary on exec error * fix(copilot): hint to run copilot directly when exec fails * fix(telemetry): use CREATE_NO_WINDOW to prevent tzutil console flash on Windows * Fix triage-pull-requests skipping PRs that open as draft * chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 * Bump Go toolchain to 1.26.3 * Fix skills acceptance tests * Add explicit build tags to platform-specific echo test files * Address review feedback on echo mode polling * Poll TTY echo mode instead of sleeping in password tests * Record accessibility state in telemetry * Bump copilot telemetry sampling to 100% * chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 * Remove numberFieldOnly API shortcut * Grammar fixes * Switch from actions/attest-build-provenance to actions/attest * Enable extended PR screening for external PRs * Fix flaky Password test by increasing echo mode setup timeout * Add missing //go:build integration tag to verify_integration_test.go * chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 * Apply patch from code review feedback. * Print `gh auth refresh` for 401 returns * Update installation commands for GitHub CLI - Update to version 2.92.0: * Bump Go to 1.26.2 * chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 * Update command.go * Add "Resource not accessible" to ProjectsV2IgnorableError * chore: fix zsh completion on debian * install_linux: correct typo in Homebrew copy * chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 * chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 * Update acceptance/testdata/workflow/run-view-log-escape-sequences.txtar * Fix log terminal injection * fix(skills): include --allow-hidden-dirs in preview hint from install * Install skills flat by Name, not namespaced InstallName * feat(skills): add --allow-hidden-dirs flag to preview command * feat(skills): support GHEC with data residency hosts * Fix SetSampleRate not updating sample_rate dimension * fix: yaml.github-actions.security.run-shell-injection.run-shell-injection security vulnerability * Enable telemetry without env var * test(telemetry): assert ANSI escape chars for color codes * fix(telemetry): lower bias in sample bucket calc * feat(skills): detect re-published skills and offer upstream install * Log when there is no telemetry * Add telemetry command * Record official extension telemetry * fix(skills): prioritize DisplayName/Name over InstallName match * fix(skills): match skills by install name in preview command * use the right json field names for skills * fix totalCount guidance * docs(skills): note --template collisions and single-string search * backtick skill filename * docs(skills): drop hand-copied naming rules from gh-skill * use hyphen instead * docs(skills): add gh and gh-skill agent skills * feat(skills): support nested skills/ directories in discovery * fix(skills): make --fix and --dry-run mutually exclusive, suppress publish prompt * fix(skills): use canonical 'gh skill' not 'gh skills' alias * fix(skills): stop publish --fix from publishing * Include CI context in telemetry * refactor: decouple hidden-dir filtering from discovery layer * Add support for installation in multiple agent hosts in `gh skills install` (#13209) * Add skills specific telemetry * chore(deps): bump github.com/google/go-containerregistry * Do not send telemetry for aliases * Apply review feedback * Disable telemetry for GHES * remove misleading text * Add sampled command telemetry * Update publish_test.go * refactor: replace real git with run.CommandStubber in publish tests * fix: apply review feedback nil HttpClient, local dedup type * Remove dispatch after install, install only * Rename official extension files and types to stubs * Replace em-dashes with regular dashes * Address PR review feedback * Add no em dash rule to AGENTS.md * Suggest and install official extensions via stub commands * Add @cli/code-reviewers to all CODEOWNERS rules * Add cli/skill-reviewers as CODEOWNERS for skills packages * style: fix gofmt alignment in publish tests * fix: update acceptance test to match current error message * fix: address post-merge review feedback for skills commands * refactor: remove redundant nil-client fallback in skills publish (#13168) * feat(skills): auto-push unpushed commits before publish * refactor: use shared discovery logic in publish command * fix(skill publish): remove misleading `validate` alias * docs(skill): improve help docs * fix skills names in examples * Disable auth check for `gh extension install` * Suggest and install official extensions for unknown commands * Update acceptance/testdata/skills/skills-search-noresults.txtar * URL-encode parentPath in skills discovery API call * Disable auth check for local-only skill flags * fix: address review feedback on namespace changes * chore: remove unused newTestGitClient function * fix: preserve namespace in skills search deduplication * fix: use target directory remotes in skills publish * fix: enforce size cap on first preview file, surface corrupted skills, fail on path traversal * fix: align relevanceScore comments with implementation and fix typo * chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 * chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 * address review comments * clean up interface and fix a few bugs * cleanup frontmatter fields * add .agents/skills as default installation path for hosts that support it: cursor, codex, gemini CLI, github copilot, antigravity. * show loading spinner during installation, even for multi-file skills * use markdown renderer in preview when previewing multi-file skills * Expand test coverage and fix invariants/bugs * add core logic and improve test coverage * improve test coverage/cleanup * register initial skills commands * add skills command scaffold * docs: fix SHA512 checksum for GPG key * chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 * chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 * chore(deps): bump github.com/sigstore/timestamp-authority/v2 * docs: add sha/md5 checksums of keyring files * chore(deps): bump github.com/google/go-containerregistry * chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 * chore: delete experimental script/debian-devel * chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 * Document dependency CVE policy in SECURITY.md * docs: add manual PGP key verification commands * chore: re-add toolchain to go1.26.2 * docs: polish wording around PGP keys * docs: include PGP key fingerprints * Fix infinite loop in 'gh release list --limit 0' * chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 * chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 * test(internal/authflow): assert user-agent header is not modified/added * replace github.com/golang/snappy with klauspost/compress/snappy * docs: require tests and linter pass before committing * fix(auth): preserve User-Agent in authflow getViewer * fix(api): propagate InvokingAgent in gh api HTTP client * chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 * chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 - Update to version 2.89.0: * Ensure huh prompter cleans up * fix(huh prompter): remove unused fields and imports * go mod tidy * feat(huh prompter): clear search input after submitting query * refactor(huh prompter): custom Field for MultiSelectWithSearch * feat(huh prompter): add placeholder to search input * fix(huh prompter): use synchronized accessors to eliminate data race * fix(accessible prompter): update test expectations for huh v2 * refactor(huh prompter): pipe-based test harness with full coverage * test(huh prompter): add table-driven tests for all prompt types * Upgrade to huh/v2 and fix selection persistence in MultiSelectWithSearch * Fix gofmt alignment for prompter-enabled fields in IOStreams * Use LayoutStack for huhPrompter MultiSelectWithSearch * Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER * Add nameWithOwner to necessary tests * fix(pr view): fetch nameWithOwner in headRepository GraphQL query * test(acceptance): remove run-download-traversal test * fix(acceptance): set git identity in testscript sandbox * internal/codespaces/portforwarder: define err in go func instead of use err defined in outer scope * chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 * Update docs/triage.md * Update docs/triage.md * Align triage.md with unified triage process * Fix typo: remove extra space in README.md link * fix(survey): use useReviewerSearch consistently in prompt path * fix(pr create): wire up @copilot assignee replacement and [bot] suffix * refactor(survey): simplify ApiActorsSupported in RepoMetadataInput * docs(featuredetection): document GHES removal criteria for ApiActorsSupported * refactor(featuredetection): rename ActorIsAssignable to ApiActorsSupported * refactor(pr shared): consolidate ActorAssignees and ActorReviewers into ApiActorsSupported * refactor(pr shared): extract SpecialAssigneeReplacer for @me and Copilot expansion * chore(deps): bump github.com/google/go-containerregistry * Record agentic invocations in User-Agent header * Address review: table tests, godocs, code style * Add AGENTS.md optimized for AI agent token efficiency * docs: simplify flag text * docs(pr edit): improve command examples with grouped sections * docs: clarify that --add-reviewer can re-request reviews * feat(pr create, issue create): search-based assignee selection in MetadataSurvey * review: address code review feedback * refactor(issue edit): wire up search-based assignee selection * refactor(pr edit): remove actor accumulation hack from assignee search * refactor(pr edit, issue edit): use login-based assignee mutation for flag flows * fix(pr create): use login-based assignee mutation on github.com * chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 * chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 * Remove auto-labels from issue templates * fix(agent-task): resolve Copilot API URL dynamically (#12956) * chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 * chore(deps): bump azure/login from 2.3.0 to 3.0.0 * fix: improve docs around IssueRepoInfo * test(issue transfer): update stub for IssueRepositoryInfo query * fix(issue transfer): use IssueRepoInfo to fetch minimal fields for issues * test(issue create): update stubs for IssueRepositoryInfo query * fix(issue create): use IssueRepoInfo to avoid requiring Contents:Read permission * test(api): add tests for GitHubRepo and IssueRepoInfo * refactor(api): add IssueRepoInfo for minimal issue repo queries - Update to version 2.88.1: * Revert "fix: clarify scope error while creating issues for projects" * Revert "refactor: deduplicate scope error handling between api/client.go and project queries" * Switch deployment signing to OIDC authentication

cloud_download Downloads

SUSE Package Hub 15.7 s390x
  • Packages
    gh
    The official CLI for GitHub
    2.96.0-bp157.2.21.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
SUSE Package Hub 15.7 ppc64le
  • Packages
    gh
    The official CLI for GitHub
    2.96.0-bp157.2.21.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
SUSE Package Hub 15.7 x86_64
  • Packages
    gh
    The official CLI for GitHub
    2.96.0-bp157.2.21.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
SUSE Package Hub 15.7 aarch64
  • Packages
    gh
    The official CLI for GitHub
    2.96.0-bp157.2.21.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.96.0-bp157.2.21.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.96.0-bp157.2.21.1 lock rpm