GitHub: GitHub CLI 2.97.0

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features

• Add name-based resolution to gh project item-edit by @zwick in #13807
• Add named field columns to gh project item-list by @zwick in #13823
• Add Grok skill host support by @tommaso-moro in #13864
• Replace Windsurf with Devin in gh skill agents by @tommaso-moro in #13987

🐛 Fixes

• Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @malancas in #13624
• Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @kofuk in #13787
• Fix skill picker label wrapping by @tommaso-moro in #13967

📚 Docs & Chores

• Bump Go to 1.26.5 by @github-actions[bot] in #13817
• Add OWNER/REPO format hint to the gh search --repo flag by @BagToad in #13922
• Present by-name item-edit as the first-class project flow in docs by @Solaris-star in #13927
• Add a macOS keyring security doc by @williammartin in #13960
• Add a code review agent skill by @BagToad in #14003
• Establish a pull request template for scale by @BagToad in #14004
• Add an agentic issue-triage workflow by @lukewar in #13777
• Use the Actions token for Copilot inference in the issue-triage workflow by @tidy-dev in #13830
• Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by @alondahari in #13949
• Add a dependabot-triage agentic workflow by @williammartin in #13985
• Harden the deployment workflow by @niik in #13780
• Replace SITE_DEPLOY_PAT with the gh-cli-site-deployer App by @williammartin in #13492
• Group CodeQL Dependabot updates by @williammartin in #13943
• Remove a dead CODEOWNERS rule for the non-existent pkg/cmd/release/attestation/ by @kobihikri in #13886
• Fix typos in code and documentation by @pstoeckle in #13940
• Fix duplicated-word typos in comments by @SORBELLOSTEFANIE in #13900

Dependencies

• chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by @dependabot in #13790
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot in #13789
• chore(deps): bump https://github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot in #13791
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by @dependabot in #13800
• chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by @dependabot in #13812
• chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot in #13821
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot in #13801
• chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by @dependabot in #13832
• chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by @dependabot in #13813
• chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot in #13822
• chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by @dependabot in #13843
• chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by @dependabot in #13841
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot in #13867
• chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by @dependabot in #13869
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot in #13868
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by @dependabot in #13870
• chore(deps): bump https://github.com/yuin/goldmark from 1.8.2 to 1.8.4 by @dependabot in #13888
• chore(deps): bump https://github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 by @dependabot in #13842
• chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by @dependabot in #13877
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot in #13933
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot in #13934
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot in #13936
• chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by @dependabot in #13935
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.22 to 0.0.23 by @dependabot in #13937
• chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by @dependabot in #13938
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #13941
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot in #13942
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 by @dependabot in #13944
• chore(deps): bump nodeselector/setup-apple-codesign from ab275d0 to 309922b by @dependabot in #13878
• chore(deps): bump https://github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot in #13950
• chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by @dependabot in #13951
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13965
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.23 to 0.0.24 by @dependabot in #13977
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13978
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.14 to 1.4.15 by @dependabot in #13976
• chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by @dependabot in #13979
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by @dependabot in #13980
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot in #13981
• chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by @dependabot in #13995
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by @dependabot in #13996
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by @dependabot in #14018

New Contributors

• @lukewar made their first contribution in #13777
• @niik made their first contribution in #13780
• @kofuk made their first contribution in #13787
• @zwick made their first contribution in #13807
• @kobihikri made their first contribution in #13886
• @pstoeckle made their first contribution in #13940
• @Solaris-star made their first contribution in #13927
• @SORBELLOSTEFANIE made their first contribution in #13900
• @alondahari made their first contribution in #13949

Full Changelog: v2.96.0...v2.97.0