chore(deps): update prototools toolchain (#521)

renovate[bot] · web-flow · commit 062e527a154c · 2026-07-25T22:14:12.000Z
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [gh](https://redirect.github.com/cli/cli) | minor | `2.95.0` → `2.96.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | | [npm](https://docs.npmjs.com/) ([source](https://redirect.github.com/npm/cli)) | minor | `11.17.0` → `11.18.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/npm/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/npm/cli) | --- ### Release Notes <details> <summary>cli/cli (gh)</summary> ### [`v2.96.0`](https://redirect.github.com/cli/cli/releases/tag/v2.96.0): GitHub CLI 2.96.0 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.95.0...v2.96.0) #### Security A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via `gh codespace jupyter`. Users of `gh codespace jupyter` are advised to update gh to version v2.96.0 as soon as possible. For more information see: <GHSA-8cg3-r6g9-fpg2> #### Download release assets without authentication `gh release download` now works against public repositories without authentication, matching `gh extension install`. A token is still used when one is present: ```shell # Download assets from a public repository, no login required gh release download v2.96.0 --repo cli/cli ``` #### What's Changed ##### ✨ Features - Allow `gh release download` without authentication on public repositories by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13723](https://redirect.github.com/cli/cli/pull/13723) - Detect additional third-party coding agents by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13722](https://redirect.github.com/cli/cli/pull/13722) - Support `antigravity-cli` and `antigravity2.0` in `gh skill` by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13784](https://redirect.github.com/cli/cli/pull/13784) ##### 🐛 Fixes - fix: show checks summary when all checks were cancelled by [@&#8203;s3onghyun](https://redirect.github.com/s3onghyun) in [#&#8203;13679](https://redirect.github.com/cli/cli/pull/13679) - fix(skills): install universal agent to `~/.agents/skills` by [@&#8203;toller892](https://redirect.github.com/toller892) in [#&#8203;13681](https://redirect.github.com/cli/cli/pull/13681) - fix(skills): honor `--dir` without agent prompt by [@&#8203;happysnaker](https://redirect.github.com/happysnaker) in [#&#8203;13766](https://redirect.github.com/cli/cli/pull/13766) - Fix concurrent map writes in codespace port forwarding by [@&#8203;williammartin](https://redirect.github.com/williammartin) in [#&#8203;13313](https://redirect.github.com/cli/cli/pull/13313) - Use `int64` for GitHub database IDs by [@&#8203;williammartin](https://redirect.github.com/williammartin) in [#&#8203;13403](https://redirect.github.com/cli/cli/pull/13403) ##### 📚 Docs & Chores - Pin reusable triage workflows to a commit SHA by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13705](https://redirect.github.com/cli/cli/pull/13705) - Add security disclosure guidance to `AGENTS.md` by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13720](https://redirect.github.com/cli/cli/pull/13720) - Clarify `--clone` boolean flag behaviour in `gh repo fork` help by [@&#8203;BagToad](https://redirect.github.com/BagToad) in [#&#8203;13786](https://redirect.github.com/cli/cli/pull/13786) - Fix flaky `TestHuhPrompterMultiSelectWithSearchPersistence` on slow architectures by [@&#8203;pdostal](https://redirect.github.com/pdostal) in [#&#8203;13675](https://redirect.github.com/cli/cli/pull/13675) - docs(search): add examples for multiple qualifiers by [@&#8203;happysnaker](https://redirect.github.com/happysnaker) in [#&#8203;13756](https://redirect.github.com/cli/cli/pull/13756) - docs: fix broken anchor link in release-process-deep-dive by [@&#8203;patrickwehbe](https://redirect.github.com/patrickwehbe) in [#&#8203;13688](https://redirect.github.com/cli/cli/pull/13688) - docs: fix broken install command and link/grammar errors by [@&#8203;patrickwehbe](https://redirect.github.com/patrickwehbe) in [#&#8203;13690](https://redirect.github.com/cli/cli/pull/13690) - docs: fix duplicated word in primer README by [@&#8203;s3onghyun](https://redirect.github.com/s3onghyun) in [#&#8203;13677](https://redirect.github.com/cli/cli/pull/13677) ##### Dependencies - chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13708](https://redirect.github.com/cli/cli/pull/13708) - chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13703](https://redirect.github.com/cli/cli/pull/13703) - chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13702](https://redirect.github.com/cli/cli/pull/13702) - chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13740](https://redirect.github.com/cli/cli/pull/13740) - chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13754](https://redirect.github.com/cli/cli/pull/13754) - chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13759](https://redirect.github.com/cli/cli/pull/13759) - chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;13779](https://redirect.github.com/cli/cli/pull/13779) #### New Contributors - [@&#8203;patrickwehbe](https://redirect.github.com/patrickwehbe) made their first contribution in [#&#8203;13688](https://redirect.github.com/cli/cli/pull/13688) - [@&#8203;s3onghyun](https://redirect.github.com/s3onghyun) made their first contribution in [#&#8203;13679](https://redirect.github.com/cli/cli/pull/13679) - [@&#8203;toller892](https://redirect.github.com/toller892) made their first contribution in [#&#8203;13681](https://redirect.github.com/cli/cli/pull/13681) - [@&#8203;happysnaker](https://redirect.github.com/happysnaker) made their first contribution in [#&#8203;13756](https://redirect.github.com/cli/cli/pull/13756) **Full Changelog**: <cli/cli@v2.95.0...v2.96.0> </details> <details> <summary>npm/cli (npm)</summary> ### [`v11.18.0`](https://redirect.github.com/npm/cli/compare/v11.17.0...fef2b1324991a098c64132b77339ba9989b5e3bf) [Compare Source](https://redirect.github.com/npm/cli/compare/v11.17.0...v11.18.0) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Oslo) - Branch creation - Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (`* 0-5 25-31 * 0`) - Automerge - Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (`* 0-5 25-31 * 0`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/archgate/cli).  Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.prototools b/.prototools
@@ -1,7 +1,7 @@
 bun = "1.3.14"
 node = "24"
-npm = "11.17.0"
-gh = "2.95.0"
+npm = "11.18.0"
+gh = "2.96.0"
 
 [settings]
 auto-install = true
