Skip to content

Update tool gh (2.96.0 ➔ 2.97.0) - #2286

Merged
mav-bot[bot] merged 1 commit into
mainfrom
renovate/gh-2.x
Jul 31, 2026
Merged

Update tool gh (2.96.0 ➔ 2.97.0)#2286
mav-bot[bot] merged 1 commit into
mainfrom
renovate/gh-2.x

Conversation

@mav-bot

@mav-bot mav-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
gh tools minor 2.96.0 → 2.97.0

Release Notes

cli/cli (gh)

v2.97.0: GitHub CLI 2.97.0

Compare Source

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@&#8203;me" --field "Status" --field "Priority"

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.96.0...v2.97.0

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@mav-bot
mav-bot Bot requested a review from maverickd650 as a code owner July 31, 2026 03:01
@mav-bot

mav-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

konflate — summary

Note

✅ No rendered changes.

konflate · rendered 6eacc41 · advisory, not a gate

@mav-bot
mav-bot Bot merged commit 0da3df0 into main Jul 31, 2026
7 checks passed
@mav-bot
mav-bot Bot deleted the renovate/gh-2.x branch July 31, 2026 03:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maverickd650 maverickd650 Awaiting requested review from maverickd650 maverickd650 is a code owner

Assignees

No one assigned

Labels

area/mise automerge renovate/github-release type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants