feat(github-release): update release github-cli ( 2.96.0 ➔ 2.97.0 ) - #125
Conversation
![clanker-claude[bot]](https://avatars.githubusercontent.com/in/2839309?s=60&v=4){kind=small}
There was a problem hiding this comment.
github-cli: 2.96.0 → 2.97.0
Verdict: Safe to merge
This is a security-focused minor release. The release notes call out four fixed CVEs (terminal escape sequence injection in several commands, unescaped URL path components, partial token leakage in gh auth status, and regex metacharacter injection in gh attestation verify), plus new name-based field resolution for gh project and some Go/library bumps. No deprecations or breaking interface changes for the surface this repo touches.
Repo usage reviewed: home/dot_config/zsh/init.zsh.tmpl loads the gh oh-my-zsh plugin (completion/aliases only); .github/workflows/renovate-review.yaml invokes gh pr view, gh pr diff, gh pr review, gh api, gh release view, and gh release list. No scripts use gh gist, gh codespace, gh skills, gh agent-task, gh attestation verify, or gh project, so the security fixes are non-actionable here other than picking up the upgrade itself. Recommendation: merge as-is; security fixes are net-positive with no configuration change required.
New features worth adopting:
- None that warrant changes — the
gh projectname-based field improvements are not used in this repo.
Sources consulted:
- https://togithub.com/cli/cli/releases/tag/v2.97.0
- https://togithub.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46
- https://togithub.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3
- https://togithub.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm
- https://togithub.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g
1 participant
This PR contains the following updates:
2.96.0→2.97.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
cli/cli (github-cli)
v2.97.0: GitHub CLI 2.97.0Compare Source
Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version
v2.97.0as soon as possible.Several commands (including
gh gist view,gh api,gh pr diff,gh release download --output -,gh codespace logs,gh skills preview, andgh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.See GHSA-3m3g-3wcr-px46 for more information.
Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause
ghto address a different resource than intended.See GHSA-4fjg-2h4q-fwg3 for more information.
gh auth status(without--show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such asgithub_pat_*,ghs_*, andghu_*.See GHSA-cg6r-mpgc-h9mm for more information.
gh attestation verifybuilt the certificate matcher from--signer-repoand--signer-workflowwithout escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.See GHSA-mm27-mwq9-fr5g for more information.
Address project fields and items by name in
gh projectgh project item-editandgh project item-listcan now reference project fields and single-select options by name:What's Changed
✨ Features
gh project item-editby @zwick in #13807gh project item-listby @zwick in #13823gh skillagents by @tommaso-moro in #13987🐛 Fixes
📚 Docs & Chores
OWNER/REPOformat hint to thegh search --repoflag by @BagToad in #13922item-editas the first-class project flow in docs by @Solaris-star in #13927SITE_DEPLOY_PATwith the gh-cli-site-deployer App by @williammartin in #13492pkg/cmd/release/attestation/by @kobihikri in #13886ab275d0to309922bby @dependabot in #13878New Contributors
Full Changelog: cli/cli@v2.96.0...v2.97.0
Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.