chore(deps): update Codespaces dependencies

[github-actions]

deps(codespaces): bump devcontainer dependencies

[.devcontainer/devcontainer.json] Bump GitHub CLI version

1 file(s) updated with "${1}2.90.0${3}": * .devcontainer/devcontainer.json

v2.90.0

## Manage agent skills with `gh skill` (Public Preview)

[Agent skills](https://agentskills.io) are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new `gh skill` command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

```
# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run
```

Skills are automatically installed to the correct directory for your agent host. `gh skill` supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with `--agent` and `--scope` flags.

`gh skill publish` validates skills against the [Agent Skills specification](https://agentskills.io/specification) and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the [GitHub Blog](https://github.blog/changelog/2026-04-16-manage-agent-skills-with-github-cli/).

`gh skill` is launching in public preview and is subject to change without notice.

## Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. `gh stack`), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for [github/gh-aw](https://github.com/github/gh-aw) and [github/gh-stack](https://github.com/github/gh-stack).

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the `gh extension install` command to run.

## `gh extension install` no longer requires authentication

`gh extension install` previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

## What's Changed

### ✨ Features

* Add `gh skill` command group: install, preview, search, update, publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13165
* Suggest and install official extensions for unknown commands by @BagToad in https://github.com/cli/cli/pull/13175
* `gh skill publish`: auto-push unpushed commits before publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13171
* Disable auth check for `gh extension install` by @BagToad in https://github.com/cli/cli/pull/13176

### 🐛 Fixes

* Fix infinite loop in `gh release list --limit 0` by @Bahtya in https://github.com/cli/cli/pull/13097
* Ensure `api` and `auth` commands record agentic invocations by @williammartin in https://github.com/cli/cli/pull/13046
* Disable auth check for local-only skill flags by @SamMorrowDrums in https://github.com/cli/cli/pull/13173
* URL-encode parentPath in skills discovery API call by @SamMorrowDrums in https://github.com/cli/cli/pull/13172
* Fix: use target directory remotes in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13169
* Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in https://github.com/cli/cli/pull/13170

### 📚 Docs & Chores

* docs: include PGP key fingerprints by @babakks in https://github.com/cli/cli/pull/13112
* docs: add sha/md5 checksums of keyring files by @babakks in https://github.com/cli/cli/pull/13150
* docs: fix SHA512 checksum for GPG key by @timsu92 in https://github.com/cli/cli/pull/13157
* docs(skill): polish skill commandset docs by @babakks in https://github.com/cli/cli/pull/13183
* Document dependency CVE policy in SECURITY.md by @BagToad in https://github.com/cli/cli/pull/13119
* Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in https://github.com/cli/cli/pull/13048
* chore: bump to go1.26.2 by @babakks in https://github.com/cli/cli/pull/13116
* chore: delete experimental script/debian-devel by @babakks in https://github.com/cli/cli/pull/13127
* Suggest first party extensions by @williammartin in https://github.com/cli/cli/pull/13182
* Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in https://github.com/cli/cli/pull/13189
* Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in https://github.com/cli/cli/pull/13190
* Address post-merge review feedback for skills commands by @SamMorrowDrums in https://github.com/cli/cli/pull/13185
* Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in https://github.com/cli/cli/pull/13187
* Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in https://github.com/cli/cli/pull/13188
* Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13168
* Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in https://github.com/cli/cli/pull/13167

### :dependabot: Dependencies

* chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13071
* chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13045
* chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13051
* chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13152
* chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13129
* chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13128
* chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13044
* chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12918
* chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13076
* chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13065

## New Contributors
* @thaJeztah made their first contribution in https://github.com/cli/cli/pull/13048
* @Bahtya made their first contribution in https://github.com/cli/cli/pull/13097
* @timsu92 made their first contribution in https://github.com/cli/cli/pull/13157
* @SamMorrowDrums made their first contribution in https://github.com/cli/cli/pull/13173

**Full Changelog**: https://github.com/cli/cli/compare/v2.89.0...v2.90.0

[.devcontainer/setup.sh] Bump yq version

1 file(s) updated with "${1}4.53.2${3}": * .devcontainer/setup.sh

v4.53.2

- Releases and tags now signed and immutable!
- Add system(command; args) operator (disabled by default) (#2640)
- TOML encoder: prefer readable table sections over inline tables (#2649)
- Fix TOML encoder to quote keys containing special characters (#2648)
- Add string slicing support (#2639)
- Fix findInArray misuse on MappingNodes in equality and contains (#2645) Thanks @jandubois!
- Fix panic on negative slice indices that underflow after adjustment (#2646) Thanks @jandubois!
- Fix stack overflow from circular alias in traverse (#2647) Thanks @jandubois!
- Fix panic and OOM in repeatString for large repeat counts (#2644) Thanks @jandubois!
- Bumped dependencies

GitHub Action workflow link

---

Created automatically by Updatecli Options: Most of Updatecli configuration is done via its manifest(s). If you close this pull request, Updatecli will automatically reopen it, the next time it runs. If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made. Feel free to report any issues at github.com/updatecli/updatecli. If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!