This update for gh fixes the following issues:
Changes in gh:
- Update to version 2.102.0, fixing four security issues
(GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,
GHSA-wjmr-j3rp-mh2g):
* gh release/run/attestation download and repo read-file --output
could write to an unintended file through symbolic links
* gh attestation verify compared --source-ref case-insensitively
* gh attestation verify matched --signer-workflow only by prefix
* gh skill search could inject options into gh skill install
* Copy auth codes to the clipboard by default (gh config set
clipboard disabled to opt out)
* Remove the
This update for gh fixes the following issues:
Changes in gh:
Update to version 2.100.0, fixing two deadlock issues in the vendored
golang.org/x/crypto/ssh library reachable via crafted SSH channel
messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):
* Fix gh api telemetry disablement
* Bump go-gh to v2.16.0
* Expose per-host API host config
* chore: bump toolchain to go1.26.8
* chore: bump golang.org/x/crypto to 0.56.0
* Record attachment invocation telemetry
* Add webhook as an official extension
* Merge pull request #14318 from cli/issue-triage-improvements
* Refine GHES support wording
* Use version-neutral GHES su
This update for gh fixes the following issues:
Changes in gh:
- Update to version 2.98.0:
* chore: fix extra whitespace
* Default Codespaces port forwarding to loopback
* Bump gh-aw-actions to v0.87.1 and recompile workflows
* Fix issue triage action compatibility
* chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
* chore: bump go to 1.26.7 (#14205)
* chore(deps): bump the codeql-actions group across 1 directory with 3 updates
* chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1
* Revert "ci: add temporary step to verify Linux repo signing keys"
* ci: add temporary step to verify Linux repo si
This update for gh fixes the following issues:
Changes in gh:
- CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored
golang.org/x/net/idna package regardless of Go's unicode.Version (boo#1266618).
This update for gh fixes the following issues:
Changes in gh:
- Update to version 2.96.0:
* Critical security fix: patched vulnerability in gh codespace jupyter
that could allow command execution when connecting to malicious
Codespaces
* Merge commit from fork
* Fix concurrent map writes in codespace port forwarding (#13313)
* docs: fix broken install command and link/grammar errors (#13690)
* Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786)
* docs: fix duplicated word in primer README (#13677)
* fix(skills): honor --dir without agent prompt (#13766)
* Support antigravity-cli and antigravity2.