< back to search

gpp_maybe Security update for gh
openSUSE-2026-309

This update for gh fixes the following issues: - Update to version 2.98.0: * chore: fix extra whitespace * Default Codespaces port forwarding to loopback * Bump gh-aw-actions to v0.87.1 and recompile workflows * Fix issue triage action compatibility * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 * chore: bump go to 1.26.7 (#14205) * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 * Revert "ci: add temporary step to verify Linux repo signing keys" * ci: add temporary step to verify Linux repo signing keys * Accept pre-release tags in deployment validation (#14193) * chore: sign APT repositories with both keys * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 * chore(deps): bump the aw-actions group with 2 updates * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 * Bump Go to 1.26.6 * Upgrade gh-aw workflows to v0.85.4 * chore(deps): bump github.com/google/go-containerregistry * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 * Address review: drop cleanup markers, document search-type in skill * Reconcile feature detection cleanup comment rules in AGENTS.md * Update AGENTS.md with cleanup comment guidance * Address review feedback * Add --search-type flag for semantic and hybrid issue search * Rename config mock constructors to match repo convention * Document when to use the config mock or the isolated config * Accept config content in NewIsolatedTestConfig * Clear auth environment variables in isolated test config * Isolate git config in tests that shell out to git * Rename config stub file to test.go * chore(deps): bump the aw-actions group with 2 updates * Add aw-actions group to dependabot configuration * Rename cli-code-reviewer skill to code-review (#14116) * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 * Reduce item-add test diff * Isolate item-add test mocks * Test item-add output through command path * Run lint workflow when the lint workflow changes * Bump golangci-lint in CI to v2.12.2 * Clarify PR testing section expectations * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * chore(deps): bump azure/login from 3.0.0 to 3.0.1 * chore(deps): bump actions/attest from 4.2.1 to 4.2.2 * Use reflect.Pointer instead of deprecated reflect.Ptr * Add a scheduled tech debt burndown skill (#14095) * Restore automatic spam issue closure (#14088) * Give Dependabot triage a real reachability check (#14087) * Route release deletions through api.Client (#14077) * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 * chore(deps): bump github.com/google/go-containerregistry * Grant the gate the scopes its CI read needs * Keep pre-flight dedup out of the integrity proxy * Key direct/indirect off the // indirect comment * Gate triager confidence on required evidence * Gate Dependabot triage on deterministic pre-flight check * Set GH_EXTENSION=1 when gh invokes an extension * Tell agents to use the PR template in AGENTS.md * Merge pull request #14062 from cli/williammartin-wp-08-release-create * Route extension requests through api.Client (#14059) * Route autolink requests through api.Client (#14013) * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * fix(release create): trim spaces when parsing X-Oauth-Scopes * Match worktree rev-parse stub against absolute path on Windows * fix(pr/checkout): pass -- before worktree path so dash paths work * docs(pr/checkout): add worktree usage example to help text * docs(skills): mention pr checkout worktree support * chore(pr checkout): polish worktree related tests * Route gpg key requests through api.Client (#13997) * Use generated key in ssh-key acceptance test * Route ssh key requests through api.Client * Fix item-add output for non-TTY * test(pr/checkout): add acceptance tests for worktree checkout * chore(deps): bump actions/attest from 4.2.0 to 4.2.1 * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 * Generate unique acceptance SSH keys * Route deploy key requests through api.Client * Collapse spam triage into the agentic issue-triage workflow (#14027) * Run Dependabot triage hourly * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 * Require explicit PR review ownership (#14028) * Slim down dependabot triage comments (#14019) * Wrap RESTWithNext errors as api.HTTPError * Bail out early on unusable --worktree paths * Clarify current-worktree rejection message * Return ok bool from revParseFacts to satisfy nilerr * Drop docs on self-explanatory worktree helpers * Trim redundant comments and clarify worktree field names * Resolve worktree target once instead of re-querying git * Fix worktree toplevel stub to match Windows absolute paths * Detect worktrees via git rev-parse and reject the current worktree * Address review: restore TODO, flatten detachCmds, guard worktree symlink * Cover detach-reuse, worktree fetch dir, and symlink path resolution * Harden worktree submodule prefixing and cover cmd.Dir stripping * Create branch when reusing a worktree with a new --branch name * Extract authenticatedCommand helper to dedupe -C handling * Preserve no-force safety when reusing a worktree for fork PRs * Simplify submodule worktree prefix to inline conditional * Run submodule commands inside the worktree for pr checkout * tidying.. * Refine PR checkout worktree flag help * Add --worktree flag to gh pr checkout - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266618). - Update to version 2.97.0, fixing four security issues (CVE-2026-64654, CVE-2026-64653, CVE-2026-64652, CVE-2026-64655): * CVE-2026-64654: terminal escape sequence injection in gist view, api, pr diff, release download --output -, codespace logs, skills preview and agent-task view/create * CVE-2026-64653: unescaped variable path components in request URLs could redirect gh to a different resource than intended * CVE-2026-64652: gh auth status could print part of the auth token in plaintext for token types with an underscore after the prefix * CVE-2026-64655: gh attestation verify built its --signer-repo/ --signer-workflow matcher without escaping regex metacharacters, allowing a lookalike signer to pass verification * Add named field columns to gh project item-list and item-edit

cloud_download Downloads

SUSE Package Hub 15.7 x86_64
  • Packages
    gh
    The official CLI for GitHub
    2.98.0-bp157.2.29.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
SUSE Package Hub 15.7 s390x
  • Packages
    gh
    The official CLI for GitHub
    2.98.0-bp157.2.29.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
SUSE Package Hub 15.7 ppc64le
  • Packages
    gh
    The official CLI for GitHub
    2.98.0-bp157.2.27.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
SUSE Package Hub 15.7 aarch64
  • Packages
    gh
    The official CLI for GitHub
    2.98.0-bp157.2.27.1 lock rpm
    gh-bash-completion
    Bash Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-fish-completion
    Fish completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm
    gh-zsh-completion
    ZSH Completion for gh
    2.98.0-bp157.2.29.1 lock rpm
    2.98.0-bp157.2.27.1 lock rpm