GitHub CLI: starije verzije za preuzimanje

🐛 Fixes
- Allow server to arbitrate which GitHub App installation tokens can attach files by @martinajir in #14804
- Defer --attach credential checks to the upload endpoint by @BagToad in #14805

New Contributors
- @martinajir made their first contribution in #14804

What's Changed

🐛 Fixes
- Avoid repeating the skill installation safety warning by @tommaso-moro in #14784
- feat(gh auth login): hint at --expiring when no preference is set by @babakks in #14798

📚 Docs & Chores
- Document extrepo installation on Debian by @williammartin in #14796

Dependencies
- Update github.com/digitorus/pkcs7 dependency by @bdehamer in #14791

What's Changed
- Bump go-runewidth to v0.0.30 for faster startup by @williammartin in #14577
- docs: recommend nix-shell and declarative config for Nix/NixOS by @reginaldalfret in #14592
- Clarify issue view comment output modes by @babakks with @Copilot in #14616
- Add ACCESSIBILITY.md by @BagToad in #14583
- Replace extension browse with Bubble Tea by @williammartin in #14578
- Bump shell-quote to 1.11.0 in cli-exercise skill by @williammartin in #14625
- Leave validation checks to CI in bump-go script by @williammartin in #14631
- Avoid spawning git for each extension at startup by @williammartin in #14620
- Bump Go to 1.27.2 by @github-actions[bot] in #14632
- chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #14633
- chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 by @dependabot[bot] in #14634
- Remove CLAUDE.md in favor of AGENTS.md by @jarrensj in #14474
- Fix the unclean background colors of gh-search-code by @A4-Tacks in #14648
- Clarify --repo and --owner checks for attestation bundles by @bdehamer in #14650
- Fix Go vendoring in Dependabot triage and bump gh-aw by @williammartin in #14682
- chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in #14660
- chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #14656
- chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #14655
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #14654
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 by @dependabot[bot] in #14657
- chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #14485
- chore(deps): bump github.com/cli/go-gh/v2 from 2.16.1 to 2.16.2 by @dependabot[bot] in #14696
- chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #14697
- chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @dependabot[bot] in #14707
- chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @dependabot[bot] in #14705
- chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot[bot] in #14706
- gh issue artifact stack 1/12: Resolve --attach references against the body file's directory by @BagToad in #14564
- gh issue artifact stack 2/12: Attach one set of files to several Markdown documents by @BagToad in #14565
- gh issue artifact stack 3/12: Add the command group and list by @BagToad in #14566
- gh issue artifact stack 4/12: Add view by @BagToad in #14567
- gh issue artifact stack 5/12: Add delete by @BagToad in #14568
- gh issue artifact stack 6/12: Add download by @BagToad in #14569
- gh issue artifact stack 7/12: Add create by @BagToad in #14570
- gh issue artifact stack 8/12: Add edit by @BagToad in #14571
- gh issue artifact stack 9/12: Document gh issue artifact in the gh skill by @BagToad in #14572
- gh issue artifact stack 10/12: Add edit --restore-version by @BagToad in #14580
- gh issue artifact stack 11/12: Address review feedback by @BagToad in #14640
- gh issue artifact stack 12/12: Add artifact URLs by @BagToad in #14678
- Clarify --comments behavior when piped in view commands by @arsalanyavari in #14714
- Support HTML documents in gh issue artifact by @BagToad in #14720
- Clarify release creation atomicity and immutability by @bdehamer in #14722
- Add deterministic Dependabot scheduler by @williammartin in #14750
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #14751
- Fix help text that references nonexistent flags by @BagToad in #14719
- Bump Go to 1.27.3 by @github-actions[bot] in #14767
- Merge v2.102.1 release branch into trunk by @BagToad in #14770
- chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @dependabot[bot] in #14766
- Update glamour to v2 by @heaths in #14148
- Refreshable tokens (1/7): foundation credential model, storage migration, and file 

What's Changed

Dependencies
chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible.
gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links.
See https://github.com/cli/cli/security/advisories/GHSA-39wj-f2f4-978v for more information.
gh attestation verify compared the --source-ref value case-insensitively, so an attestation built from a branch whose name differs only in case could satisfy a policy that named a different branch.
See https://github.com/cli/cli/security/advisories/GHSA-4mq3-hpgx-9cx8 for more information.
Interactive gh skill search passed repository paths from search results to gh skill install without an option separator, so a search result could inject installer options and change where skill files were written.
See https://github.com/cli/cli/security/advisories/GHSA-qcwj-mr2r-2cx7 for more information.
gh attestation verify matched the --signer-workflow value against only the start of the signing certificate's identity, so an attestation signed by a different workflow in the pinned repository could pass verification when its path began with the pinned value.
See https://github.com/cli/cli/security/advisories/GHSA-wjmr-j3rp-mh2g for more information.

What's Changed

🐛 Fixes
- Allow ghu_ tokens for supported actors to attach files by @BagToad in #14516
- Allow repo set-default --unset without an argument by @williammartin in #14540

📚 Docs & Chores
- Prioritize HackerOne for vulnerability reports by @BagToad in #14497
- Clarify reviewer-facing PR guidance by @williammartin in #14509
- Add a skill for chaptered CLI recordings by @BagToad in #14475
- Improve CLI recording rendering by @williammartin in #14507
- Mention gh CLI in the README intro by @BagToad in #14517
- Document search operator support in gh search help by @waldyrious in #14519
- Remove host versions from gh project item-list help by @BagToad in #14553

Dependencies
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14486
- chore(deps): bump nodeselector/setup-apple-codesign from 0.0.2 to 0.0.3 by @dependabot in #14487
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.9 to 2.0.10 by @dependabot in #14541
- chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1 by @dependabot in #14542
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14543

What's Changed
- docs: announce Linux PGP key rotation by @babakks in #14340
- Require verified SHAs in issue-triage permalinks by @sergiou87 in #14343
- Add clipboard preference for auth flows and default to enabled by @williammartin in #14345
- Add VHS demo skill by @williammartin in #14334
- Use API SSH URLs for repository clones by @williammartin in #14346
- docs: fix broken "GitHub language" link in primer foundations by @areesh-ali in #14363
- Fix and validate Go bump workflow by @williammartin in #14347
- chore: sign Linux repositories only with the new PGP key by @babakks in #14197
- Rewrite CLI agent guidance by @williammartin in #14388
- Prepare exit errors for Go 1.27 by @williammartin in #14397
- Reduce rate limiting and reduce time taken for acceptance tests by @williammartin in #14320
- Validate repository names during interactive creation by @sergiou87 in #14313
- Filter acceptance tests for installation token capabilities by @williammartin in #14354
- Record attachment operation counts in telemetry by @BagToad in #14360
- Finalize telemetry at invocation completion by @williammartin in #14390
- Propagate gh path to extensions by @williammartin in #14282
- Fix Go bump workflow authentication by @williammartin in #14412
- Run acceptance tests in Actions with a GitHub App token by @williammartin in #14356
- Fix acceptance script paths on Windows by @williammartin in #14414
- Wait for repository readiness before archiving by @williammartin in #14415
- chore(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 by @dependabot[bot] in #14376
- chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in #14377
- chore(deps): bump github.com/yuin/goldmark from 1.8.5 to 1.8.6 by @dependabot[bot] in #14378
- chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 by @dependabot[bot] in #14391
- chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.27 to 0.2.0 by @dependabot[bot] in #14375
- chore(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 by @dependabot[bot] in #14417
- Delete repo garden command by @williammartin in #14416
- Update Go bump validation tools by @williammartin in #14428
- Fix remote branch deletion for owner case mismatch by @williammartin in #14429
- Retire multi-account migration by @williammartin in #14430
- Recognize maintainer authorization by @williammartin in #14438
- Safely replace stale Go bump branches by @williammartin in #14441
- Bump Go to 1.27.1 by @github-actions[bot] in #14442
- Use internal Apple codesign action by @williammartin in #14437
- chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @dependabot[bot] in #14447
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #14446
- chore(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 by @dependabot[bot] in #14445
- chore(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 by @dependabot[bot] in #14444
- chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in #14443
- Test explicit default repository resolution by @williammartin in #14460
- Bump github.com/cli/go-gh/v2 to v2.16.1 by @niik in #14461
- Revert "Use internal Apple codesign action" by @williammartin in #14462

New Contributors
- @areesh-ali made their first contribution in #14363

Experimental: Route GitHub API traffic through a custom host
Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration:
# Route API traffic for github.com through a gateway
gh config set api_host gh-gateway.example.com --host github.com
# Read the configured API host
gh config get api_host --host github.com
The original host remains in use for authentication, Git remotes, and browser URLs.
Note
api_host is experimental and is not a security boundary. Requests may still reach the original host.

What's Changed

✨ Features
- Honor per-host api_host routing across GitHub API requests by @williammartin in #14104
- Expose api_host through gh config get and gh config set by @williammartin in #14332
- Add webhook as an official extension by @williammartin in #14326
- Print full command help after command misuse when gh is invoked by a coding agent by @niik in #14198

🐛 Fixes
- fix(api): disable telemetry for unauthenticated GHES requests using absolute hostnames by @williammartin in #14337

📚 Docs & Chores
- Fix discussion acceptance test flags by @williammartin in #14321
- Clarify supported GHES versions by @williammartin in #14324
- Improve automated issue triage analysis by @sergiou87 in #14318
- Record attachment counts in telemetry by @BagToad in #14327

Dependencies
- chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @babakks in #14331
- chore(deps): bump Go toolchain from 1.26.7 to 1.26.8 by @babakks in #14330
- chore(deps): bump github.com/cli/go-gh/v2 from 2.15.0 to 2.16.0 by @williammartin in #14338

Attach images and videos to issues and pull requests
The repeatable --attach flag uploads local images and videos and adds them to issue, pull request, or comment bodies. If a body already references the local path, gh replaces it with the uploaded URL; otherwise it appends the attachment:
# Attach files when creating or editing an issue
gh issue create --attach './repro.png#The error state'
gh issue edit 123 --attach ./walkthrough.mp4
# Attach files when creating or editing a pull request
gh pr create --attach ./before.png
gh pr edit 456 --attach ./after.png
# Attach files to comments
gh issue comment 123 --attach ./repro.png
gh pr comment 456 --attach ./result.mp4
Repeat the flag to attach multiple files in a single invocation. Attachments are available on GitHub.com and GitHub Enterprise Cloud.
For more information see https://gh.io/gh-attach

Worktree support extended to gh issue develop
gh issue develop can now create a linked branch and check it out in a new Git worktree, leaving your current working copy unchanged:
# Create a linked branch for an issue and check it out in a worktree
gh issue develop 123 --checkout --worktree /path/to/wt-feature

What's Changed

✨ Features
- Add token and repository metadata required for attachment uploads by @BagToad in #14177
- Add validation for attachable image and video files by @BagToad in #14178
- Rewrite local Markdown references to uploaded attachment URLs by @BagToad in #14179
- Add attachment uploads to GitHub by @BagToad in #14180
- Add repeatable --attach flag parsing and upload orchestration by @BagToad in #14181
- Add --attach to gh pr comment and gh issue comment by @BagToad in #14182
- Add --attach to gh pr create and gh pr edit by @BagToad in #14183
- Add --attach to gh issue create and gh issue edit by @BagToad in #14184
- Add worktree checkout to gh issue develop by @sergiou87 in #14136
- Use text-only spinner output when gh is invoked by a coding agent by @niik in #14191
- Honor PI_CODING_AGENT_DIR for Pi user skills by @tommaso-moro in #14260

🐛 Fixes
- fix(repo sync): explain when the target branch is checked out in another worktree by @williammartin in #14076
- fix(pr merge): safely handle --delete-branch with linked worktrees by @tidy-dev in #14007
- fix(copilot): end the declined-install warning with a newline by @BagToad in #14222
- fix(attach): clarify retry windows and attachment path resolution by @BagToad in #14262
- fix(issue develop): reject non-empty worktree targets before creating a branch by @tidy-dev in #14244
- fix(repo sync): prevent linked-worktree corruption by @sergiou87 in #14060
- fix(view): reject --comments with --json by @BagToad in #14215
- fix(attach): limit batches to 50 files by @BagToad in #14289
- fix(skills): install Codex user skills to ~/.agents/skills by @scarletkc in #14154

📚 Docs & Chores
- Address review feedback across the --attach stack by @BagToad in #14200
- Refactor commands to own attachment flag policy by @BagToad in #14255
- Document attachment support in the gh skill by @BagToad in #14261
- Document gh issue develop --checkout --worktree in the gh skill by @babakks in #14265
- Clarify pull request testing guidance by @williammartin in #14272
- Fix issue triage to apply suspected-spam labels directly by @williammartin in #14271
- Prevent Dependabot from updating agentic-workflow dependencies by @williammartin in #14274
- Modernize Go code with go fix by @BagToad in #14278

Dependencies
- chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot in #14247
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 by @dependabot in #14248
- chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot in #14250
- chore(deps): bump charm.land/bubbles/v2 from 2.1.1 to 2.2.0 by @dependabot in #14249
- chore(deps): bump agentic-workflows to 0.87.5 by @williammartin in #14273
- chore(deps): bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 by @dependabot in #14275
- chore(

What's Changed
- Slim down dependabot triage comments by @williammartin in #14019
- Require explicit PR review ownership by @williammartin in #14028
- chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by @dependabot[bot] in #14029
- Collapse spam triage into the agentic issue-triage workflow by @williammartin in #14027
- Run Dependabot triage every hour by @sergiou87 in #14030
- Fix RESTWithNext error type, repairing gh status and attestation retries by @williammartin in #13988
- Route deploy key requests through api.Client by @williammartin in #13989
- Route ssh key requests through api.Client by @williammartin in #13994
- Route gpg key requests through api.Client by @williammartin in #13997
- Add --worktree flag to gh pr checkout by @tidy-dev in #13946
- Trim spaces when parsing X-Oauth-Scopes in gh release create by @williammartin in #14065
- Route autolink requests through api.Client by @williammartin in #14013
- Route extension requests through api.Client by @williammartin in #14059
- Route release creation through api.Client by @williammartin in #14062
- Tell agents to use the PR template in AGENTS.md by @williammartin in #14074
- Set GH_EXTENSION=1 when gh invokes an extension by @williammartin in #14072
- Make Dependabot triage cheaper and more decisive by @williammartin in #14079
- chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in #14047
- chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #14049
- chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #14048
- chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #14066
- Route release deletions through api.Client by @williammartin in #14077
- Give Dependabot triage a real reachability check by @williammartin in #14087
- Restore automatic spam issue closure by @williammartin in #14088
- chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in #14050
- Add a scheduled tech debt burndown skill by @williammartin in #14095
- Use reflect.Pointer instead of deprecated reflect.Ptr by @williammartin in #14098
- Clarify what belongs in the PR template's testing section by @williammartin in #14103
- Bump golangci-lint in CI to v2.12.2 by @williammartin in #14102
- chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in #14100
- chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #14101
- chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #14091
- chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by @dependabot[bot] in #14068
- Rename cli-code-reviewer skill to code-review by @BagToad in #14116
- Fix project item-add output for non-TTY by @zwick in #14056
- Add aw-actions group to dependabot configuration by @babakks in #14123
- chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in #14124
- Isolate tests from local machine's auth and git configuration by @BagToad in #14128
- Add --search-type flag for semantic and hybrid issue search by @michaeljacholke in #14006
- Don't ask for feature detection cleanup comments when not needed by @babakks in #14139
- chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in #14140
- Upgrade gh-aw workflows to v0.85.4 by @tidy-dev in #14141
- Bump Go to 1.26.6 by @github-actions[bot] in #14143
- chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #14119
- chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in #14120
- chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in #14147
- chore: sign APT repository with both keys by @babakks in #13271
- Accept pre-release tags in deployment validation by @BagToad in #14193
- ci: add temporary step to verify Linux repo signing key

Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.
Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.
See https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46 for more information.
Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.
See https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 for more information.
gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.
See https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm for more information.
gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.
See https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project
gh project item-edit and gh project item-list can now reference project fields and single-select options by name:
# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"
# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features
- Add name-based resolution to gh project item-edit by @zwick in #13807
- Add named field columns to gh project item-list by @zwick in #13823
- Add Grok skill host support by @tommaso-moro in #13864
- Replace Windsurf with Devin in gh skill agents by @tommaso-moro in #13987

🐛 Fixes
- Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @malancas in #13624
- Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @kofuk in #13787
- Fix skill picker label wrapping by @tommaso-moro in #13967

📚 Docs & Chores
- Bump Go to 1.26.5 by @github-actions[bot] in #13817
- Add OWNER/REPO format hint to the gh search --repo flag by @BagToad in #13922
- Present by-name item-edit as the first-class project flow in docs by @Solaris-star in #13927
- Add a macOS keyring security doc by @williammartin in #13960
- Add a code review agent skill by @BagToad in #14003
- Establish a pull request template for scale by @BagToad in #14004
- Add an agentic issue-triage workflow by @lukewar in #13777
- Use the Actions token for Copilot inference in the issue-triage workflow by @tidy-dev in #13830
- Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by @alondahari in #13949
- Add a dependabot-triage agentic workflow by @williammartin in #13985
- Harden the deployment workflow by @niik in #13780
- Replace SITE_DEPLOY_PAT with the gh-cli-site-deployer App by @williammartin in #13492
- Group CodeQL Dependabot updates by @williammartin in #13943
- Remove a dead CODEOWNERS rule for the non-existent pkg/cmd/release/attestation/ by @kobihikri in #13886
- Fix typos in code and documentation by @pstoeckle in #13940
- Fix duplicated-word typos in comments by @SORBELLOSTEFANIE in #13900

Dependencies
- chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by @dependabot in #13790
- chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot in #13789
- chore(deps): bump https://github.com/klauspost/compress from 1.18.6 to 1.19.0 

Download release assets without authentication
gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:
# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features
- Allow gh release download without authentication on public repositories by @BagToad in #13723
- Detect additional third-party coding agents by @BagToad in #13722
- Support antigravity-cli and antigravity2.0 in gh skill by @BagToad in #13784

🐛 Fixes
- fix: show checks summary when all checks were cancelled by @s3onghyun in #13679
- fix(skills): install universal agent to ~/.agents/skills by @toller892 in #13681
- fix(skills): honor --dir without agent prompt by @happysnaker in #13766
- Fix concurrent map writes in codespace port forwarding by @williammartin in #13313
- Use int64 for GitHub database IDs by @williammartin in #13403

📚 Docs & Chores
- Pin reusable triage workflows to a commit SHA by @BagToad in #13705
- Add security disclosure guidance to AGENTS.md by @BagToad in #13720
- Clarify --clone boolean flag behaviour in gh repo fork help by @BagToad in #13786
- Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @pdostal in #13675
- docs(search): add examples for multiple qualifiers by @happysnaker in #13756
- docs: fix broken anchor link in release-process-deep-dive by @patrickwehbe in #13688
- docs: fix broken install command and link/grammar errors by @patrickwehbe in #13690
- docs: fix duplicated word in primer README by @s3onghyun in #13677

Dependencies
- chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @dependabot in #13708
- chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #13703
- chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot in #13702
- chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #13740
- chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot in #13754
- chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot in #13759
- chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #13779

New Contributors
- @patrickwehbe made their first contribution in #13688
- @s3onghyun made their first contribution in #13679
- @toller892 made their first contribution in #13681
- @happysnaker made their first contribution in #13756

What's Changed
- docs(discussion): polish help docs by @babakks in #13632
- Support custom CLAUDE_CONFIG_DIR in install by @tommaso-moro in #13523
- chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in #13640
- chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @dependabot[bot] in #13663
- chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in #13661
- chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #13619
- chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @dependabot[bot] in #13662
- chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #13641
- Make filtering by bot authors more discoverable by @BagToad in #13642
- Bump Go in devcontainer by @spenserblack in #13674
- feat: add repo read-file and repo read-dir by @babakks in #13580
- fix(skills): stage updates in a temp dir and swap in-place by @SamMorrowDrums in #13449
- feat(skills): list available skills when install runs non-interactively by @SamMorrowDrums in #13548

What's Changed
- chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #13521
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10 by @dependabot[bot] in #13520
- Improve update --all command if some skills don't have metadata by @tommaso-moro in #13469
- add --all flag to install all skills in a repo by @tommaso-moro in #13471
- fix discovery support in nested dirs by @tommaso-moro in #13459
- Bump Go to 1.26.4 by @github-actions[bot] in #13578
- Add Issues 2.0 support: issue types, sub-issues, and relationships by @BagToad in #13057
- Auto-install official extension stubs in CI by @BagToad in #13581
- Clean up deferred issue update helper by @BagToad in #13584
- New gh skill list to inventory installed agent skills by @tommaso-moro in #13418
- chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #13597
- chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot[bot] in #13596
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7 by @dependabot[bot] in #13595
- chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @dependabot[bot] in #13572
- Alias gh extension uninstall to gh extension remove by @BagToad in #13599
- Add terminal-mockup canvas extension for marketing screenshots by @BagToad in #13612
- feat(discussion): add comment command by @babakks in #13620
- feat: add discussion command set by @babakks in #13541
- Add gh discussion and Issues 2.0 reference to the gh skill, plus a README note by @BagToad in #13631

What's Changed
- chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 by @dependabot[bot] in #13297
- Add missing //go:build integration tag to verify_integration_test.go by @pdostal in #13303
- Fix flaky accessible prompter Password test timeout by @pdostal in #13304
- Enable extended PR screening for external PRs by @tidy-dev in #13312
- fix(pr): remove numberFieldOnly optimization that skips API validation by @williammartin in #13327
- Print gh auth refresh for 401 returns by @333fred in #13068
- Grammar fixes by @scop in #13326
- Bump gh copilot telemetry sampling to 100% by @williammartin in #13362
- Record accessibility feature state in telemetry by @williammartin in #13363
- chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #13328
- Poll TTY echo mode instead of sleeping in password tests by @pdostal in #13305
- Switch from actions/attest-build-provenance to actions/attest by @scop in #13325
- Fix skills acceptance tests by @williammartin in #13365
- Bump Go toolchain to 1.26.3 by @Copilot in #13367
- Trigger triage check-requirements on ready_for_review by @BagToad in #13383
- fix(copilot): hint to run copilot directly when exec fails by @babakks in #13393
- Update installation commands for GitHub CLI by @sassdawe in #13126
- chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in #13381
- chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in #13396
- chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #13346
- chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in #13397
- Update CODEOWNERS for skills directory ownership by @williammartin in #13416
- fix(telemetry): prevent tzutil console flash on Windows by @adehad in #13353
- Fix bump-go.sh to tolerate missing toolchain directive by @Copilot in #12581
- chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #13420
- chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #13436
- Derive digest algorithm from ref length in release verify commands by @bdehamer in #13430
- docs: drop --repo gh-cli from dnf install lines by @c-tonneslan in #13444
- Remove third-party license debris by @williammartin in #13470
- Remove dependency on persistent token by @williammartin in #13474
- Remove discussion workflow by @williammartin in #13476
- chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #13461
- Stop bumping homebrew on release by @williammartin in #13479
- build: update golang.org/x/crypto by @tommaso-moro in #13486
- Add 3 day dependabot cooldown period by @williammartin in #13488
- Run govulncheck daily instead of weekly by @williammartin in #13487
- chore(deps): bump github/codeql-action from 4 to 4.35.5 by @dependabot[bot] in #13489
- SHA pin first-party GitHub Actions by @williammartin in #13491
- Allow agents as application for secrets by @tenjaa in #13421
- Link to Accessibility category for community discussions instead of ACR by @mxie in #13481
- docs: fix duplicated "of" in release-process-deep-dive by @vip892766gma in #13425
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.4.1 to 2.4.2 by @dependabot[bot] in #13462
- chore(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #13457
- chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @BagToad in #13510
- docs: note immutable releases starting v2.93.0 by @BagToad in #13518
- fix CI attestation integration tests after rename by @BagToad in #13536

New Contributors
- @pdostal made their first contribution in #13303
- @333fred made their first contribution in #13068
- @scop made their first contribution in #13326
- @sassdawe made their first contribution in #13126
- @adehad made their first contribution in #13353
- @c-tonneslan made their first contribution in #13444
- @tenjaa made thei

What's Changed
- fix: using variable interpolation `${{ in deployment.yml... by @orbisai0security in #13258
- Fix SetSampleRate not updating sample_rate dimension by @williammartin in #13259
- Fix log terminal injection by @williammartin in #13272
- chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by @dependabot[bot] in #13161
- chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in #13162
- chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 by @dependabot[bot] in #13163
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 by @dependabot[bot] in #13206
- docs: correct typo in Linux Homebrew copy by @cassidyjames in #13273
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 by @dependabot[bot] in #13241
- feat(skills): add --allow-hidden-dirs flag to preview command by @SamMorrowDrums in #13265
- Install skills flat by Name, not namespaced InstallName by @SamMorrowDrums in #13266
- feat(skills): support GHEC with data residency hosts by @SamMorrowDrums in #13264
- chore: fix zsh completion on debian by @babakks in #13274
- Add trust disclaimer to extension help text by @travellertales in #13296
- chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in #13298
- Bump Go to 1.26.2 by @github-actions[bot] in #13301
- Add "Resource not accessible" to ProjectsV2IgnorableError by @maxbeizer in #13281

New Contributors
- @orbisai0security made their first contribution in #13258
- @cassidyjames made their first contribution in #13273
- @travellertales made their first contribution in #13296

What's Changed
- Remove misleading text by @tommaso-moro in #13203
- Add sampled command telemetry by @williammartin in #13191
- Do not send telemetry for aliases by @williammartin in #13192
- Add skills specific telemetry by @williammartin in #13204
- Add support for installation in multiple agent hosts in gh skills install by @tommaso-moro in #13209
- Add --allow-hidden-dirs flag to gh skill install by @SamMorrowDrums in #13213
- Record CI context in telemetry by @williammartin in #13210
- Fix skills publish --fix to not publish by @SamMorrowDrums in #13237
- Make skill discovery less strict: support nested skills/ directories by @SamMorrowDrums in #13235
- fix(skills): match skills by install name in preview command by @SamMorrowDrums in #13249
- Record official extension telemetry by @williammartin in #13205
- Add telemetry command by @williammartin in #13253
- feat(skills): detect re-published skills and offer upstream install by @SamMorrowDrums in #13236
- Log when there is no telemetry by @williammartin in #13255
- docs(skills): add gh and gh-skill agent skills by @BagToad in #13244
- Enable telemetry without env var by @williammartin in #13254

New Contributors
- @tommaso-moro made their first contribution in #13203

What's Changed
- Ensure api and auth commands record agentic invocations by @williammartin in #13046
- replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in #13048
- chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in #13071
- Fix infinite loop in gh release list --limit 0 by @Bahtya in #13097
- docs: include PGP key fingerprints by @babakks in #13112
- chore: bump to go1.26.2 by @babakks in #13116
- chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in #13045
- Document dependency CVE policy in SECURITY.md by @BagToad in #13119
- chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in #13051
- chore: delete experimental script/debian-devel by @babakks in #13127
- docs: add sha/md5 checksums of keyring files by @babakks in #13150
- chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in #13152
- chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in #13129
- chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in #13128
- chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in #13044
- chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in #12918
- chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #13076
- chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in #13065
- docs: fix SHA512 checksum for GPG key by @timsu92 in #13157
- Disable auth check for local-only skill flags by @SamMorrowDrums in #13173
- URL-encode parentPath in skills discovery API call by @SamMorrowDrums in #13172
- fix: use target directory remotes in skills publish by @SamMorrowDrums in #13169
- Disable auth check for gh extension install by @BagToad in #13176
- docs(skill): polish skill commadset docs by @babakks in #13183
- feat(skills): auto-push unpushed commits before publish by @SamMorrowDrums in #13171
- Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in #13167
- Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in #13168
- fix: preserve namespace in skills search deduplication by @SamMorrowDrums in #13170
- Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in #13187
- Add agent skills command by @SamMorrowDrums in #13165
- Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in #13189
- Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in #13190
- Suggest first party extensions by @williammartin in #13182
- Suggest and install official extensions for unknown commands by @BagToad in #13175
- Address post-merge review feedback for skills commands by @SamMorrowDrums in #13185
- Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in #13188

New Contributors
- @thaJeztah made their first contribution in #13048
- @Bahtya made their first contribution in #13097
- @timsu92 made their first contribution in #13157
- @SamMorrowDrums made their first contribution in #13173

What's Changed
- fix(agent-task): resolve Copilot API URL dynamically by @BagToad in #12956
- Remove auto-labels from issue templates by @tidy-dev in #12972
- docs: clarify that gh pr edit --add-reviewer can re-request reviews by @joshjohanning in #13021
- Record agentic invocations in User-Agent header by @williammartin in #13023
- Add AGENTS.md by @williammartin in #13024
- chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #12963
- Use login-based assignee mutation on github.com by @BagToad in #13009
- Fix typo: remove extra space in README.md link by @realMelTuc in #12725
- chore(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.3 by @dependabot[bot] in #12962
- fix(issue): avoid fetching unnecessary fields for discovery by @babakks in #12884
- chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 by @dependabot[bot] in #13031
- define err in go func instead of use err defined in outer scope by @Lslightly in #13033
- Consolidate actor-mode signals into ApiActorsSupported by @BagToad in #13025
- Align triage.md with current triage process by @tidy-dev in #13030
- Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by @BagToad in #13037
- chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 by @dependabot[bot] in #13005
- chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by @dependabot[bot] in #13004
- chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #12951
- Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER by @BagToad in #12859

New Contributors
- @joshjohanning made their first contribution in #13021
- @realMelTuc made their first contribution in #12725
- @Lslightly made their first contribution in #13033

What's Changed
- Migrate Windows code signing from client secret to OIDC by @BagToad in #12911
- Revert "refactor: deduplicate scope error handling between api/client.go and project queries" by @williammartin in #12914
- Revert "fix: clarify scope error while creating issues for projects" by @williammartin in #12915

What's Changed
- Add databaseId to assignees GraphQL fragment by @srt32 in #12783
- Set COPILOT_GH env var when launching Copilot CLI by @devm33 in #12821
- chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #12797
- chore(deps): bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #12796
- chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #12795
- chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in #12760
- chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 by @dependabot[bot] in #12759
- chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.11 to 1.4.13 by @dependabot[bot] in #12615
- Use pre-compiled regexp for matching Content-Type by @itchyny in #12781
- fix: error when --remote flag used with repo argument by @majiayu000 in #12375
- Fix redundant API call in gh issue view --comments (#12606) by @VishnuVV27 in #12652
- fix: clarify scope error while creating issues for projects by @elijahthis in #12596
- fix: gh project item-edit error when editing Draft Issue with only one (title/body) flag by @ManManavadaria in #12787
- Add --json support to gh agent-task list by @maxbeizer in #12806
- Add --json support to gh agent-task view by @maxbeizer in #12807
- Fix invalid ANSI SGR escape code in JSON and diff colorization by @BagToad in #12720
- fix(licenses): isolate generated licenses per platform (os/arch) by @babakks in #12774
- fix(issue list): reject pull request-only search qualifiers by @LouisLau-art in #12623
- Add --no-upstream flag to repo clone by @4RH1T3CT0R7 in #12686
- feat(pr): add changeType field to files JSON output by @yuvrajangadsingh in #12657
- issue develop: prevent .git/config corruption on repeated --name invocation by @gunadhya in #12651
- feat(browse): add blame flag by @masonmcelvain in #11486
- build: customizable install prefix by @scarf005 in #11714
- Add --duplicate-of flag and duplicate reason to issue close by @tksohishi in #12811
- Fix incorrect integer conversion from int to uint16 in port forwarder by @BagToad in #12831
- docs: add examples to gh issue close help text by @BagToad in #12830
- Fix extension install error message showing raw struct instead of owner/repo by @Copilot in #12836
- Remove unnecessary StateReason and StateReasonDuplicate feature detection by @BagToad in #12838
- chore(deps): bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible by @dependabot[bot] in #12842
- refactor: deduplicate scope error handling between api/client.go and project queries by @yuvrajangadsingh in #12845
- gh pr create: login-based reviewer requests and search-based interactive selection by @BagToad in #12627
- gh pr view and gh issue view: show friendly display names for all actors by @BagToad in #12854
- Bump Go from 1.25.7 to 1.26.1 by @BagToad in #12860
- Update Go version requirement to 1.26+ by @BagToad in #12864
- chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.2 by @dependabot[bot] in #12851
- feat(pr diff): add --exclude flag to filter files from diff output by @yuvrajangadsingh in #12655
- chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 by @dependabot[bot] in #12886
- feat(repo): add --squash-merge-commit-message flag to gh repo edit by @yuvrajangadsingh in #12846
- Add monthly pitch surfacing workflow by @tidy-dev in #12894
New Contributors
- @srt32 made their first contribution in #12783
- @itchyny made their first contribution in #12781
- @VishnuVV27 made their first contribution in #12652
- @elijahthis made their first contribution in #12596
- @ManManavadaria made their first contribution in #12787
- @maxbeizer made their first contribution in #12806
- @LouisLau-art made their first contribution in #12623
- @4RH1T3CT0R7 made their first contribution in #12686
- @yuvrajangadsingh made their first contribution in #12657
- @masonmcelvain made their first contribution in #11486
- @scarf005 made their first c

What's Changed
- Fix project mutation query variable usage by @williammartin in #12757

ℹ️ Note
This release was cut primarily to resolve a publishing issue. We recommend reviewing the v2.87.1 release notes for the complete set of latest features and fixes.
What's Changed
- chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #12659
Full Changelog: v2.87.1...v2.87.2

What's Changed
- Remove license bundling debris by @williammartin in #12716
- fix(agent-task/capi): use a fixed CAPI API version by @babakks in #12731
Full Changelog: v2.87.0...v2.87.1

What's Changed
- Fix fmt.Errorf format argument in ParseFullReference by @mikelolasagasti in #12516
- Lint source.md by @Sethispr in #12521
- chore(deps): bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 by @dependabot[bot] in #12525
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by @dependabot[bot] in #12515
- chore(deps): bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #12314
- chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #12315
- chore(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.4.0 by @dependabot[bot] in #12354
- typo: dont to don't by @cuiweixie in #12554
- gh pr edit: new interactive prompt for assignee selection, performance and accessibility improvements by @BagToad in #12526
- chore: bump cli/oauth to v1.2.2 by @babakks in #12573
- update Go to 1.25.6 by @BagToad in #12580
- chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in #12558
- chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in #12524
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by @dependabot[bot] in #12555
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.4 to 2.13.7 by @dependabot[bot] in #12469
- gh pr edit: Add support for Copilot as reviewer with search capability, performance and accessibility improvements by @BagToad in #12567
- chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 by @dependabot[bot] in #12468
- chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 by @dependabot[bot] in #12616
- Bump go to 1.25.7 by @BagToad in #12630
- chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @dependabot[bot] in #12629
- Add manual dispatch to bump-go workflow by @BagToad in #12631
- Fork with default branch only during pr create by @williammartin in #12673
- Respect --exit-status with --log and --log-failed in run view by @williammartin in #12679
- Pin REST API version to 2022-11-28 by @williammartin in #12680
- Add missing TODO comments for featuredetection if-statements by @BagToad in #12701
- Add missing environment and label check to triage workflow by @Copilot in #12706
- Migrate issue triage workflows to shared workflows by @BagToad in #12677
- Migrate PR triage workflows to shared workflows by @BagToad in #12707
- Remove feedback issue template by @BagToad in #12708
- Add usage examples to gh gist edit command by @BagToad in #12710
- feat(workflow run): retrieve workflow dispatch run details by @babakks in #12695
- gh release upload: Clarify --clobber flag deletes assets before re-uploading by @BagToad in #12711
- Add --query flag to project item-list by @williammartin in #12696
- Clean up project item-list query addition changes by @williammartin in #12714
- Bundle licenses at release time by @williammartin in #12625
New Contributors
- @Sethispr made their first contribution in #12521
- @cuiweixie made their first contribution in #12554
Full Changelog: v2.86.0...v2.87.0

What's Changed
✨ Features
- Add gh browse --actions flag by @rneatherway in #12091
- feat: allow git remote names in gh repo set-default by @majiayu000 in #12377
🐛 Fixes
- Fix Debian CLI package link in installation guide by @andyfeller in #12291
- fix: prevent panic when processing null project items by @chrishenzie in #12324
📚 Docs & Chores
- chore: upgrade to cli/oauth@v1.2.1 by @babakks in #12337
- ci: upgrade to GoReleaser v2 by @babakks in #12318
- CI: Update Azure Code Signing client to 1.0.95 by @BagToad in #12424
- CI: Update Azure Code Signing endpoint URL by @BagToad in #12425
- ci: tag per build job by @babakks in #12428
- CI: Add shell specification for temporary tag creation on Windows by @BagToad in #12429
- Bump sigstore-go to v1.1.4 by @williammartin in #12289
- Update actions/checkout to v6 in extension workflow templates by @fchimpan in #12393
- ci: enable noop linters by @babakks in #12440
:dependabot: Dependencies
- chore(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 by @dependabot[bot] in #12274
- chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 by @dependabot[bot] in #12281
- chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 by @dependabot[bot] in #12282
- chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by @dependabot[bot] in #12255
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.1 to 2.13.2 by @dependabot[bot] in #12262
- chore(deps): bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 by @dependabot[bot] in #12252
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.2 to 2.13.4 by @dependabot[bot] in #12302
- chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @dependabot[bot] in #12300
- chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in #12339
- chore(deps): bump github.com/yuin/goldmark from 1.7.13 to 1.7.16 by @dependabot[bot] in #12452
New Contributors
- @chrishenzie made their first contribution in #12324
- @fchimpan made their first contribution in #12393
- @majiayu000 made their first contribution in #12377
Full Changelog: v2.83.2...v2.85.0

What's Changed
🐛 Fixes
- Isolate user-provided search query from contextual qualifiers by @babakks in #12170
📚 Docs & Chores
- Refactor cfg out of CAPI Client by @williammartin in #12148
- Remove extra flag default from help usage by @andyfeller in #12154
- Add PGP key rotation PoC by @babakks in #12176
- Add Debian/Ubuntu to unofficial packages by @andyfeller in #12191
- Error if go-licenses is not on the PATH by @williammartin in #12238
- refactor: drop multierror in favor of std by @ferhatelmas in #12234
:dependabot: Dependencies
- chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #12165
- chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #12178
- chore(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 by @dependabot[bot] in #12037
- chore(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by @dependabot[bot] in #12189
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.2.0 to 2.3.0 by @dependabot[bot] in #12100
- chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.10 to 1.4.11 by @dependabot[bot] in #12051
- chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.76.0 by @dependabot[bot] in #11972
- chore(deps): bump github.com/charmbracelet/huh from 0.7.0 to 0.8.0 by @dependabot[bot] in #11971
- Bump Go to 1.25.4 by @github-actions[bot] in #12104
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.9.0 to 2.13.1 by @dependabot[bot] in #12246
- chore(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 by @dependabot[bot] in #12247
- chore(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7 by @dependabot[bot] in #12245
- Bump Go to 1.25.5 by @github-actions[bot] in #12250
- Bump dev-tunnels SDK 0.1.13 to 0.1.19 by @sam-byng in #12285
New Contributors
- @ferhatelmas made their first contribution in #12234
- @sam-byng made their first contribution in #12285
Full Changelog: v2.83.1...v2.83.2

What's Changed
🐛 Fixes
- gh pr edit: Ensure empty arrays for reviewers in PR API calls by @BagToad in #12122
📚 Docs & Chores
- Integrate license checks back into lint workflow by @BagToad in #12112
- Update third-party licenses and dependencies by @BagToad in #12123
:dependabot: Dependencies
- chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by @dependabot[bot] in #12134
Full Changelog: v2.83.0...v2.83.1

What's Changed
✨ Features
- Add isImmutable to release list JSON output by @babakks in #12064
- gh agent-task create: support --custom-agent/-a flag by @BagToad in #12068
- 💡 (gh repo delete) Add warning when --yes is ignored without a repository, Closes: #12033 by @Shion1305 in #12039
- feat: implement gh pr revert by @lucasmelin in #8826
🐛 Fixes
- fix(gist): add support for editing & viewing large files by @luxass in #11761
- Fix gh attestation verify to work when Public Good Instance of Sigstore is unavailable by @Copilot in #11989
📚 Docs & Chores
- chore: add basic linters by @babakks in #12084
- CI: Update lint govulncheck to use source mode by @BagToad in #12089
- chore: add workflow_dispatch to govulncheck triggers by @babakks in #12085
- Exclude third-party from Golangci-lint formatting paths by @babakks in #12058
- Apply go fix to remove deprecated // +build tags by @babakks in #12056
- Bump Golangci-lint to v2.6.0 by @babakks in #12049
- Mention pr checks in run list docs by @babakks in #12050
- Fix typo in comment for gh issue develop branch checkout command by @jonzfisher in #12042
- Use "release" sentinel value for release attestation verification by @Copilot in #11991
- Improve docstring for release-create by @bdehamer in #11945
- Improve api command docs around --input and --field by @babakks in #12062
- Fix --interval flags docs in gh pr checks by @2003Aditya in #12053
:dependabot: Dependencies
- Bump Go to 1.25.3 by @github-actions[bot] in #11926
- chore(deps): bump github.com/cli/go-gh/v2 from 2.12.2 to 2.13.0 by @dependabot[bot] in #12095
- Update Go toolchain version to 1.24.9 by @BagToad in #12054
- chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0 by @dependabot[bot] in #11973
- chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 by @dependabot[bot] in #11974
- chore(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #12031
- chore(deps): bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #12032
- chore(deps): bump github.com/rivo/tview from 0.0.0-20250625164341-a4a78f1e05cb to 0.42.0 by @dependabot[bot] in #12000
- chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #11509
- chore(deps): bump mislav/bump-homebrew-formula-action from 3.4 to 3.6 by @dependabot[bot] in #11750
New Contributors
- @lucasmelin made their first contribution in #8826
- @jonzfisher made their first contribution in #12042
- @2003Aditya made their first contribution in #12053
Full Changelog: v2.82.1...v2.83.0

What's Changed
- Fix formatting in git/client_test.go comments for linter by @BagToad in #9969
- Bump github.com/gabriel-vasile/mimetype from 1.4.6 to 1.4.7 by @dependabot in #9942
- Clarify which commands correspond to which DNF version under Linux install instructions by @BagToad in #9976
- When renaming an existing remote as part of remote creation in gh repo fork, log the change by @timrogers in #9983
- Fix PR checkout panic when base repo is not in remotes by @williammartin in #9992

Security
- A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.
For more information, see GHSA-2m9h-r57g-45pj

Full Changelog: https://github.com/cli/cli/compare/v2.63.0...v2.63.1

What's Changed
- Support bare repo creation by @williammartin in #9905
- Refactor the getAttestations functions by @malancas in #9892
- Added a section on manual verification of the relases. by @kommendorkapten in #9936
- Adding option to return baseRefOid in pr view by @daliusd in #9938
- Update verification results printing by @malancas in #9937
- Fix some multiline command documentation to use heredoc strings by @BagToad in #9948
- Print friendly error when release create fails due to missing workflow OAuth scope by @BagToad in #9791

Full Changelog: https://github.com/cli/cli/compare/v2.62.0...v2.63.0

Security
- A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com.
For more information, see https://github.com/cli/cli/security/advisories/GHSA-jwcm-9g39-pmcw

New Contributors
- @daliusd made their first contribution in #9938

What's Changed
- Update monotonic verification logic and testing by @malancas in #9856
- Check extension for latest version when executed by @andyfeller in #9866
- Shorten extension release checking from 3s to 1s by @andyfeller in #9914
- Mention GitHub CLI team on discussion issues by @andyfeller in #9920

Full Changelog: https://github.com/cli/cli/compare/v2.61.0...v2.62.0

Security
- A security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the gh codespace ssh or gh codespace logs commands.
For more information, see https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87

GitHub CLI notifies users about latest extension upgrades
Similar to the notification of latest gh releases, the v2.62.0 version of GitHub CLI will notify users about latest extension upgrades when the extension is used.

This removes a common pain point of extension authors as they have had to reverse engineer and implement a similar mechanism within their extensions directly.

With this quality of life improvement, there are 2 big benefits:
1. Extension authors will hopefully see increased adoption of newer releases while having lower bar to maintaining their extensions.
2. GitHub CLI users will have greater awareness of new features, bug fixes, and security fixes to the extensions used.

Extension authors should review their extensions and consider removing any custom logic previously implemented to notify users of new releases.

Ensure users understand consequences before making repository visibility changes
In v2.61.0, gh repo edit command has been enhanced to inform users about consequences of changing visibility and ensure users are intentional before making irreversible changes:
1. Interactive gh repo edit visibility change requires confirmation when changing from public, private, or internal
2. Non-interactive gh repo edit --visibility change requires new --accept-visibility-change-consequences flag to confirm
3. New content to inform users of consequences
- Incorporate GitHub Docs content into help usage and interactive gh repo edit experience
- Expanded help usage to call out most concerning consequences
- Display repository star and watcher counts to understand impact before confirming

What's Changed
- Add acceptance test for project command by @jtmcg in #9816
- Add comprehensive testscript for gh ruleset by @andyfeller in #9815
- Add comprehensive testscript for gh ext commandset by @andyfeller in #9810
- Require visibility confirmation in gh repo edit by @andyfeller in #9845
- Clean up skipped online tests for gh attestation verify by @malancas in #9838
- gh attestation verify should only verify provenance attestations by default by @malancas in #9825
- Set dnf5 commands as default by @its-miroma in #9844
- Fix verbiage for deleting workflow runs by @akx in #9876
- Bump github.com/creack/pty from 1.1.23 to 1.1.24 by @dependabot in #9862
- gh attestation verify policy enforcement refactor by @malancas in #9848
- Simplify Sigstore verification result handling in gh attestation verify by @malancas in #9877
- Print empty array for gh cache list when --json is provided by @williammartin in #9883
- Bump actions/attest-build-provenance from 1.4.3 to 1.4.4 by @dependabot in #9884
- Create the automatic key when specified with -i by @cmbrose in #9881
- fix: gh pr create -w ignore template flag by @nilvng in #9863

New Contributors
- @akx made their first contribution in #9876
- @nilvng made their first contribution in #9863

Full Changelog: https://github.com/cli/cli/compare/v2.60.1...v2.61.0

This is a small patch release to fix installing gh via go install which was broken with v2.60.0.

What's Changed
- Update testscript to use hard fork by @williammartin in #9821

Full Changelog: https://github.com/cli/cli/compare/v2.60.0...v2.60.1

What's Changed
- Add ArchivedAt field by @tsukasaI in #9790
- Include startedAt, completedAt in run steps data by @andyfeller in #9774
- Adjust environment help for host and tokens by @williammartin in #9809
- Add handling of empty titles for Issues and PRs by @jtmcg in #9701
- LiveSigstoreVerifier.Verify should error if no attestations are present by @phillmv in #9742
- gh at verify retries fetching attestations if it receives a 5xx by @phillmv in #9797
- Prevent local extension installations with invalid names and conflicts with core commands and other extensions by @BagToad in #9794
- Rewrite a sentence in CONTRIBUTING.md by @muzimuzhi in #9772
- Use new GitHub preview terms in working-with-us.md by @BagToad in #9800
- Use new GitHub previews terminology in attestation commands' help docs by @BagToad in #9799
- Clarify in README that gh is supported on GitHub Enterprise Cloud by @BagToad in #9805
- build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.5 to 1.4.6 by @dependabot in #9752

Acceptance Test Changes
- Add acceptance tests for workflow, run, and cache commands by @BagToad in #9766
- Add basic api acceptance tests by @BagToad in #9770
- Add acceptance tests for release commands by @BagToad in #9771
- Add acceptance tests for org and ssh-key commands by @BagToad in #9812
- Add acceptance tests for gh auth commands by @jtmcg in #9787
- Add acceptance tests for repo commands by @jtmcg in #9783
- Add acceptance tests for search command by @BagToad in #9786
- Add acceptance tests for variable commands by @andyfeller in #978
- Add testscripts for gpg-key and label commands by @williammartin in #9811
- Use forked testscript for token redaction by @williammartin in #9804
- Add acceptance tests for secret commands by @andyfeller in #9782
- Note token redaction in Acceptance test README by @williammartin in #9813

New Contributors
- @tsukasaI made their first contribution in #9790

Full Changelog: https://github.com/cli/cli/compare/v2.59.0...v2.60.0

What's Changed
- Allow community submitted design work by @BagToad in #9683
- Improve SECURITY.md with expectations for privately reported vulnerabilities by @BagToad in #9687
- Emit a log message when extension installation falls back to a darwin-amd64 binary on an Apple Silicon macOS device by @timrogers in #9650
- Print the login URL even when opening a browser by @ulfjack in #7091
- configurable maxwidth for markdown WithWrap() by @smemsh in #9626
- Handle errors when parsing hostname in auth flow by @BagToad in #9729
- Add repo license list/view and repo gitignore list/view by @BagToad in #9721
- Introduce testscript acceptance tests generally, and for the PR command specifically by @williammartin in #9745
- Support GH_ACCEPTANCE_SCRIPT env var to target a single script by @williammartin in #9756
- Ensure Acceptance defer failures are debuggable by @williammartin in #9754
- Add acceptance task to makefile by @williammartin in #9748
- Add Acceptance tests for issue command by @williammartin in #9757
- Update IsEnterprise and IsTenancy for orthogonality using go-gh by @jtmcg in #9755
- Supporting filtering on gist list by @heaths in #9728

New Contributors
- @ulfjack made their first contribution in #7091
- @smemsh made their first contribution in #9626

Full Changelog: https://github.com/cli/cli/compare/v2.58.0...v2.59.0

What's Changed
- Better messaging for attestation verify custom issuer mismatch error by @bdehamer in #9616
- Enhance gh repo create docs, fix random cmd link by @andyfeller in #9630
- Add HasActiveToken method to AuthConfig to refactor auth check for attestation trusted-root command by @BagToad in #9635
- Improve the suggested command for creating an issue when an extension doesn't have a binary for your platform by @timrogers in #9608
- Disable auth check for attestation trusted-root command by @bdehamer in #9610
- build(deps): bump github.com/henvic/httpretty from 0.1.3 to 0.1.4 by @dependabot in #9645
- Fix tenant-awareness for trusted-root command by @bdehamer in #9638
- Replace "GitHub Enterprise Server" option with "other" in gh auth login prompting by @jtmcg in #9642
- build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.4 to 2.0.5 by @dependabot in #9634
- Add dnf5 instructions to docs/install_linux.md by @its-miroma in #9660
- build(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.0.0 to 2.0.1 by @dependabot in #9688

New Contributors
- @its-miroma made their first contribution in #9660

Full Changelog: https://github.com/cli/cli/compare/v2.57.0...v2.58.0

What's Changed
- Move non-integration tests to different test file by @codysoyland in #9577
- Added tenancy aware attestation commands by @kommendorkapten in #9542
- Added --active flag to the gh auth status command by @velumuruganr in #9520
- build(deps): bump github.com/sigstore/sigstore-go from 0.6.1 to 0.6.2 by @dependabot in #9601
- gh attestation verify test for custom OIDC issuers by @bdehamer in #9595
- Suggest installing Rosetta when extension installation fails due to missing darwin-arm64 binary, but a darwin-amd64 binary is available by @timrogers in #9599
- Update gh attestation verify bundle parsing and validation errors by @malancas in #9564
- Suppress attestation verify output when no TTY present by @bdehamer in #9612
- Use api subdomains for tenant hosts by @williammartin in #9618

New Contributors
- @kommendorkapten made their first contribution in #9542
- @velumuruganr made their first contribution in #9520
- @bdehamer made their first contribution in #9595
- @timrogers made their first contribution in #9599

Full Changelog: https://github.com/cli/cli/compare/v2.56.0...v2.57.0

What's Changed
- Always print URL scheme to stdout by @heaths in #9471
- Quote repo names consistently in gh repo sync stdout by @muzimuzhi in #9491
- Fetch bundle from OCI registry for verify by @ejahnGithub in #9421
- Remove Internal from gh repo create prompt when owner is not an org by @jtmcg in #9465
- Drop surplus trailing space char in flag names in web by @muzimuzhi in #9495
- fix the trimming of log filenames for gh run view by @benebsiny in #9482
- "offline" verification using the bundle of attestations without any additional handling of the file by @aryanbhosale in #9523
- build(deps): bump actions/attest-build-provenance from 1.4.1 to 1.4.2 by @dependabot in #9518
- Fix doc typo for repo sync by @muzimuzhi in #9509
- Correct the help message for -F by @Goooler in #9525
- chore: fix some function names by @crystalstall in #9555
- verify 2nd artifact without swapping order by @aryanbhosale in #9532
- gh attestation verify handles empty JSONL files by @malancas in #9541
- Enhance Linux installation docs to redirect users to GPG renewal issue, better troubleshooting support by @andyfeller in #9573
- Upgrade sigstore-go to v0.6.1 by @codysoyland in #9566
- Check for nil values to prevent nil dereference panic by @codysoyland in #9578
- build(deps): bump actions/attest-build-provenance from 1.4.2 to 1.4.3 by @dependabot in #9575

New Contributors
- @aryanbhosale made their first contribution in #9523
- @Goooler made their first contribution in #9525
- @crystalstall made their first contribution in #9555

Full Changelog: https://github.com/cli/cli/compare/v2.55.0...v2.56.0

What's Changed
- Update gh variable get to use repo host by @andyfeller in #9411
- build(deps): bump actions/attest-build-provenance from 1.3.3 to 1.4.0 by @dependabot in #9400
- Unify use of tab indent in non-test source files by @muzimuzhi in #9407
- Add Acceptance Criteria requirement to triage.md for accepted issues by @jtmcg in #9435
- Improve Unix compliance gh repo set-default by @thecaffeinedev in #9431
- Document that gh run download downloads the latest artifact by default by @sato11 in #9412
- build(deps): bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2 by @dependabot in #9432
- Replace --project.* flags' name with title in docs by @jtmcg in #9443
- Wrap flags with backticks, continued by @muzimuzhi in #9444
- Improve gh release create --notes-from-tag behavior with multiline tag annotation by @babakks in #9385
- Add pr create --editor by @benebsiny in #9433
- build(deps): bump actions/attest-build-provenance from 1.4.0 to 1.4.1 by @dependabot in #9451
- Require Sigstore Bundle v0.2+ when verifying with gh attestation by @codysoyland in #9442
- build(deps): bump github.com/creack/pty from 1.1.21 to 1.1.23 by @dependabot in #9459
- Update Go and other extension workflow templates to reflect recent enhancements to cli/gh-extension-precompile by @BagToad in #9462
- Add note for external contributors to working-with-us.md by @BagToad in #9468
- Update attestation TUF root by @codysoyland in #9467
- Improve documentation for pr checks and exit codes by @thecaffeinedev in #9452
- cmd/pr/checks: Describe bucket and state JSON fields by @arunsathiya in #9439
- Add Flox as an installation option by @bryanhonof in #9396
- fix behavior for gh issue develop -b does-not-exist-on-remote by @benebsiny in #9477
- Update --project <number> flags in gh search to owner/number by @jtmcg in #9453

New Contributors
- @jtmcg made their first contribution in #9435
- @thecaffeinedev made their first contribution in #9431
- @sato11 made their first contribution in #9412
- @codysoyland made their first contribution in #9442
- @BagToad made their first contribution in #9462
- @bryanhonof made their first contribution in #9396

Full Changelog: https://github.com/cli/cli/compare/v2.54.0...v2.55.0

What's Changed
- Remove redundant whitespace by @jessehouwing in #9334
- Remove attestation test that requires being online by @steiza in #9340
- Update documentation for gh api PATCH by @cmbuckley in #9352
- Clarify usage of template flags for PR and issue creation by @williammartin in #9354
- Expose json databaseId field for release commands by @williammartin in #9356
- Expose fullDatabaseId for PR json export by @williammartin in #9355
- Handle --bare clone targets by @hyperrealist in #9271
- Slightly clarify when CLI exits with code 4 by @williammartin in #9358
- Update sigstore-go in gh CLI to v0.5.1 by @steiza in #9366
- Exit with 1 on authentication issues by @Stausssi in #9240
- build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.4 to 1.4.5 by @dependabot in #9372
- build(deps): bump github.com/google/go-containerregistry from 0.20.0 to 0.20.1 by @dependabot in #9373
- Add --remove-milestone option to issue edit and pr edit by @babakks in #9344
- handle attest case insensitivity by @ejahnGithub in #9392

New Contributors
- @cmbuckley made their first contribution in #9352
- @hyperrealist made their first contribution in #9271
- @Stausssi made their first contribution in #9240
- @ejahnGithub made their first contribution in #9392

Full Changelog: https://github.com/cli/cli/compare/v2.53.0...v2.54.0

What's Changed
- Add --json option to variable get command by @babakks in https://github.com/cli/cli/pull/9128
- Add GH_DEBUG to issue template by @TWiStErRob in https://github.com/cli/cli/pull/9167
- Fetch variable selected repo relationship when required by @williammartin in https://github.com/cli/cli/pull/9256
- build(deps): bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7 by @dependabot in https://github.com/cli/cli/pull/9250
- Alternate gh attestation trusted-root subcommand by @steiza in https://github.com/cli/cli/pull/9206
- fix: indentation in 'gh release create --help' by @cchristous in https://github.com/cli/cli/pull/9296
- build(deps): bump actions/attest-build-provenance from 1.3.2 to 1.3.3 by @dependabot in https://github.com/cli/cli/pull/9305
- docs: Update documentation for gh repo create to clarify owner by @jessehouwing in https://github.com/cli/cli/pull/9309
- Fix panic when calling gh pr view --json stateReason by @williammartin in https://github.com/cli/cli/pull/9307
- Add issue create --editor by @notomo in https://github.com/cli/cli/pull/7193
- Add pr update-branch command by @babakks in https://github.com/cli/cli/pull/8953

New Contributors
- @TWiStErRob made their first contribution in https://github.com/cli/cli/pull/9167
- @cchristous made their first contribution in https://github.com/cli/cli/pull/9296
- @jessehouwing made their first contribution in https://github.com/cli/cli/pull/9309
- @notomo made their first contribution in https://github.com/cli/cli/pull/7193

Full Changelog: https://github.com/cli/cli/compare/v2.52.0...v2.53.0

What's Changed
- feat: add -a flag to gh run list by @joshuajtward in https://github.com/cli/cli/pull/9162
- Attestation Verification - Buffer Fix by @Forrin in https://github.com/cli/cli/pull/9198
- build(deps): bump actions/attest-build-provenance from 1.2.0 to 1.3.2 by @dependabot in https://github.com/cli/cli/pull/9222
- build(deps): bump github.com/gorilla/websocket from 1.5.2 to 1.5.3 by @dependabot in https://github.com/cli/cli/pull/9211
- build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in https://github.com/cli/cli/pull/9218
- build(deps): bump github.com/google/go-containerregistry from 0.19.1 to 0.19.2 by @dependabot in https://github.com/cli/cli/pull/9217
- Remove gh at verify public beta note by @phillmv in https://github.com/cli/cli/pull/9243

New Contributors
- @joshuajtward made their first contribution in https://github.com/cli/cli/pull/9162
- @Forrin made their first contribution in https://github.com/cli/cli/pull/9198

Full Changelog: https://github.com/cli/cli/compare/v2.51.0...v2.52.0

What's Changed
- Ensure signed RPMs have attestations by @andyfeller in https://github.com/cli/cli/pull/9143
- Add signer-repo and signer-workflow flags to gh attestation verify by @malancas in https://github.com/cli/cli/pull/9137
- Docs: Specify rpm repository to avoid conflicts with community repositories by @hbenali in https://github.com/cli/cli/pull/9151
- Replace --json-result flag with --format=json in the attestation cmd by @phillmv in https://github.com/cli/cli/pull/9172
- Bump go-keyring to fix keepassxc prompt confirmation by @AlanD20 in https://github.com/cli/cli/pull/9179
- build(deps): bump actions/attest-build-provenance from 1.1.2 to 1.2.0 by @dependabot in https://github.com/cli/cli/pull/9169
- build(deps): bump goreleaser/goreleaser-action from 5 to 6 by @dependabot in https://github.com/cli/cli/pull/9175
- build(deps): bump github.com/gorilla/websocket from 1.5.1 to 1.5.2 by @dependabot in https://github.com/cli/cli/pull/9192
- build(deps): bump google.golang.org/protobuf from 1.34.1 to 1.34.2 by @dependabot in https://github.com/cli/cli/pull/9197
- watch - handle annotation errors gracefully by @wingleung in https://github.com/cli/cli/pull/9113

New Contributors
- @hbenali made their first contribution in https://github.com/cli/cli/pull/9151
- @AlanD20 made their first contribution in https://github.com/cli/cli/pull/9179
- @wingleung made their first contribution in https://github.com/cli/cli/pull/9113

Full Changelog: https://github.com/cli/cli/compare/v2.50.0...v2.51.0

What's Changed
- Refactor git credential flow code by @williammartin in https://github.com/cli/cli/pull/9089
- feat: add json output for gh pr checks by @nobe4 in https://github.com/cli/cli/pull/9079
- Rework first auth tests with new gitcredential abstractions by @williammartin in https://github.com/cli/cli/pull/9095
- list the various alias permutations for the command and subcommands, via '--help' and 'gh reference' by @gabemontero in https://github.com/cli/cli/pull/8824
- Removed tty message when checking for extension upgrades by @leevic31 in https://github.com/cli/cli/pull/9088
- Fix doc bug for gh run watch by @jasonodonnell in https://github.com/cli/cli/pull/9052
- feat: add support for stateReason in gh pr view by @nobe4 in https://github.com/cli/cli/pull/9080
- fix: rename the Attempts field to Attempt; expose in gh run view and gh run ls by @cawfeecake in https://github.com/cli/cli/pull/8905
- Update regex in changedFilesNames to handle quoted paths by @anda3 in https://github.com/cli/cli/pull/9115
- Add a gh variable get FOO command by @arnested in https://github.com/cli/cli/pull/9106
- Add macOS pkg installer to deployment (https://github.com/cli/cli/issues/7554) by @paulober in https://github.com/cli/cli/pull/7555
- Add integration tests for gh attestation verify shared workflow use case by @malancas in https://github.com/cli/cli/pull/9107
- Add build provenance for gh CLI releases by @malancas in https://github.com/cli/cli/pull/9087
- build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.3 to 1.4.4 by @dependabot in https://github.com/cli/cli/pull/9124
- Build completions during release on macos by @williammartin in https://github.com/cli/cli/pull/9136
- Clarify Mac OS Installer packages are unsigned by @andyfeller in https://github.com/cli/cli/pull/9140

New Contributors
- @gabemontero made their first contribution in https://github.com/cli/cli/pull/8824
- @jasonodonnell made their first contribution in https://github.com/cli/cli/pull/9052
- @anda3 made their first contribution in https://github.com/cli/cli/pull/9115
- @arnested made their first contribution in https://github.com/cli/cli/pull/9106
- @paulober made their first contribution in https://github.com/cli/cli/pull/7555

Full Changelog: https://github.com/cli/cli/compare/v2.49.2...v2.50.0

What's Changed
- Improve run list doc with available --json fields by @babakks in https://github.com/cli/cli/pull/8934
- Fix typos by @szepeviktor in https://github.com/cli/cli/pull/9068
- Move config interfaces into gh package by @williammartin in https://github.com/cli/cli/pull/9060
- Creating doc to capture Codespace usage guidance by @andyfeller in https://github.com/cli/cli/pull/9066
- Fix repo fork regression by @williammartin in https://github.com/cli/cli/pull/9063
- Add --latest=false to gh release create docs by @kuzdogan in https://github.com/cli/cli/pull/8987
- build(deps): bump github.com/sigstore/protobuf-specs from 0.3.1 to 0.3.2 by @dependabot in https://github.com/cli/cli/pull/9075

New Contributors
- @szepeviktor made their first contribution in https://github.com/cli/cli/pull/9068
- @kuzdogan made their first contribution in https://github.com/cli/cli/pull/8987

Full Changelog: https://github.com/cli/cli/compare/v2.49.1...v2.49.2

What's Changed
- Do not mutate headers when initialising tableprinter by @williammartin in https://github.com/cli/cli/pull/9033
- Document relationship between host and active account by @williammartin in https://github.com/cli/cli/pull/9032
- build(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in https://github.com/cli/cli/pull/9034
- Run attestation command set integration tests separately by @malancas in https://github.com/cli/cli/pull/9035
- Added support for jobs with long filenames by @shayn-orca in https://github.com/cli/cli/pull/8684
- Fix unused params across project by @williammartin in https://github.com/cli/cli/pull/9059
- Fix attestation verify source repository check bug by @malancas in https://github.com/cli/cli/pull/9053

New Contributors
- @shayn-orca made their first contribution in https://github.com/cli/cli/pull/8684

Full Changelog: https://github.com/cli/cli/compare/v2.49.0...v2.49.1

Support for GitHub Artifact Attestations
v2.49.0 release introduces the attestation command set for downloading and verifying attestations about artifacts built in GitHub Actions! This is part of the larger Artifact Attestations initiative. An artifact attestation is a piece of cryptographically signed metadata that is generated as part of your artifact build process. These attestations bind artifacts to the details of the workflow run that produced them, and allow you to guarantee the integrity and provenance of any artifact built in GitHub Actions.
To get started, check out gh help attestation. You can also use the `gh at <command>` alias for short.

What's Changed
- Improve gh run rerun docs by @sochotnicky in https://github.com/cli/cli/pull/8969
- build(deps): bump golang.org/x/net from 0.21.0 to 0.23.0 by @dependabot in https://github.com/cli/cli/pull/8981
- Update sigstore-go dependency to v0.3.0 by @malancas in https://github.com/cli/cli/pull/8977
- gh attestation tuf-root-verify offline test fix by @malancas in https://github.com/cli/cli/pull/8975
- Update gh attestation verify output by @malancas in https://github.com/cli/cli/pull/8991
- build(deps): bump google.golang.org/grpc from 1.62.1 to 1.62.2 by @dependabot in https://github.com/cli/cli/pull/8989
- Remove Hidden flag from gh attestation command by @malancas in https://github.com/cli/cli/pull/8998
- Add colon for gh secret set by @NeroBlackstone in https://github.com/cli/cli/pull/9004
- Improve errors when loading bundle locally fails by @williammartin in https://github.com/cli/cli/pull/8996
- Support offline mode for gh attestation verify by @steiza in https://github.com/cli/cli/pull/8997
- Add projectsV2 to JSON fields of gh repo commands by @babakks in https://github.com/cli/cli/pull/9007
- Support long URLs in gh repo clone by @babakks in https://github.com/cli/cli/pull/9008
- Fix issue with closing pager stream by @babakks in https://github.com/cli/cli/pull/9020
- proof of concept for flag-level disable auth check by @andyfeller in https://github.com/cli/cli/pull/9000
- Be more general with attestation host checks by @williammartin in https://github.com/cli/cli/pull/9019
- Add beta designation on attestation command set by @andyfeller in https://github.com/cli/cli/pull/9022
- Tweaked gh attestation help strings to generate nicer cli manual site. by @phillmv in https://github.com/cli/cli/pull/9025
- Update cli/go-gh to v2.9.0 by @andyfeller in https://github.com/cli/cli/pull/9023
- Document repo clone protocol behaviour by @williammartin in https://github.com/cli/cli/pull/9030

New Contributors
- @sochotnicky made their first contribution in https://github.com/cli/cli/pull/8969
- @NeroBlackstone made their first contribution in https://github.com/cli/cli/pull/9004
- @phillmv made their first contribution in https://github.com/cli/cli/pull/9025

Full Changelog: https://github.com/cli/cli/compare/v2.48.0...v2.49.0

The Big Stuff
- Added support for --slurping JSON responses in gh api by @heaths in https://github.com/cli/cli/pull/8620
- Added --skip-ssh-key option to gh auth login command by @babakks in https://github.com/cli/cli/pull/8935
- Added numSelectedRepos to JSON output of gh secret list by @babakks in https://github.com/cli/cli/pull/8899
- Added support for multiple items in gh api nested array by @Ebonsignori in https://github.com/cli/cli/pull/8762
- Fixed panic when running gh repo rename by @babakks in https://github.com/cli/cli/pull/8906
- Fixed panic when parsing IPv6 remote URLs by @babakks in https://github.com/cli/cli/pull/8893
- Fixed gh pr lock/unlock not working when URL is passed by @t4kamura in https://github.com/cli/cli/pull/8837
- Fixed viewing run logs with filenames that the regex didn't handle @zdrve in https://github.com/cli/cli/pull/8882

The Rest
- Tidy go.mod by @matthewhughes934 in https://github.com/cli/cli/pull/8958
- Fix cache contention in Go CI jobs by @matthewhughes934 in https://github.com/cli/cli/pull/8957
- Fix go directive in go.mod by @matthewhughes934 in https://github.com/cli/cli/pull/8956
- Update install_linux.md by @richterdavid in https://github.com/cli/cli/pull/8950
- build(deps): bump google.golang.org/grpc from 1.61.1 to 1.61.2 by @dependabot in https://github.com/cli/cli/pull/8925
- Add codeowners entry for the GitHub TUF root included in the attestation command set by @malancas in https://github.com/cli/cli/pull/8919
- Create stronger run log cache abstraction by @williammartin in https://github.com/cli/cli/pull/8931
- Remove naked returns from git ParseURL by @williammartin in https://github.com/cli/cli/pull/8929
- Fix api cache test by @williammartin in https://github.com/cli/cli/pull/8932
- Ensure run log cache creates cache dir if it doesn't exist by @williammartin in https://github.com/cli/cli/pull/8944
- Close zip file in run view tests by @williammartin in https://github.com/cli/cli/pull/8945
- Fix attestation cmd offline unit test failure by @malancas in https://github.com/cli/cli/pull/8933
- Add support to attestation command for more predicate types. by @steiza in https://github.com/cli/cli/pull/8949

New Contributors
- @babakks made their first contribution in https://github.com/cli/cli/pull/8906
- @t4kamura made their first contribution in https://github.com/cli/cli/pull/8837
- @zdrve made their first contribution in https://github.com/cli/cli/pull/8882
- @Ebonsignori made their first contribution in https://github.com/cli/cli/pull/8762
- @matthewhughes934 made their first contribution in https://github.com/cli/cli/pull/8958
- @richterdavid made their first contribution in https://github.com/cli/cli/pull/8950

Full Changelog: https://github.com/cli/cli/compare/v2.47.0...v2.48.0

What's Changed
- remove repetitive word by @cuinix in https://github.com/cli/cli/pull/8795
- fixed doc string by @gregsmi in https://github.com/cli/cli/pull/8797
- feat: consistent issue and PR owner/repo#number in various prompt by @nobe4 in https://github.com/cli/cli/pull/8778
- build(deps): bump google.golang.org/protobuf from 1.30.0 to 1.33.0 by @dependabot in https://github.com/cli/cli/pull/8811
- feat: support dry-run in gh pr create by @v1v in https://github.com/cli/cli/pull/8376
- Fix the description of gh release upload by @malor in https://github.com/cli/cli/pull/8834
- Bump go-keyring to fix race condition by @williammartin in https://github.com/cli/cli/pull/8833
- Gh docs multiple accounts by @jsoref in https://github.com/cli/cli/pull/8838
- Document auth switch behaviour for two or more accounts by @williammartin in https://github.com/cli/cli/pull/8839
- Document run watch and view not supporting fine grained PATs by @williammartin in https://github.com/cli/cli/pull/8843
- build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.3 to 2.0.4 by @dependabot in https://github.com/cli/cli/pull/8844
- Feat draft issue id by @yasunori0418 in https://github.com/cli/cli/pull/8754
New Contributors
- @cuinix made their first contribution in https://github.com/cli/cli/pull/8795
- @gregsmi made their first contribution in https://github.com/cli/cli/pull/8797
- @nobe4 made their first contribution in https://github.com/cli/cli/pull/8778
- @malor made their first contribution in https://github.com/cli/cli/pull/8834
- @yasunori0418 made their first contribution in https://github.com/cli/cli/pull/8754
Full Changelog: https://github.com/cli/cli/compare/v2.45.0...v2.46.0

- adding multiple accounts for GitHub.com and GitHub Enterprise with gh auth login
- switching manually between accounts for gh and git use with gh auth switch
- seeing multiple accounts with gh auth status
- logging out of accounts with gh auth logout
What's changed
- Better codespaces error handling when the display name flag exceeds 48 characters by @mateusmarquezini in #8361
- Better error handling in auth status when there are connection issues by @tal66 in #8337
- Filtering run list results by commit sha by @nelsonchen304 in #8350
- More informative pr merge output when running interactively by @ffalor in #8381
- Unification of doc mark-ups by @muzimuzhi in #8342
- Addition of progress indicator when installing an extension by @steiza in #8411
- Support for multiple accounts on a single host by @williammartin in #8425
Other technical changes
- Enhance discussion triage workflow by @andyfeller in #8394
- Simplify triage workflow given GitHub Actions limitations on OSS pull requests by @andyfeller in #8412
- andyfeller/triage the final enhancements by @andyfeller in #8420
- Simplify git AddRemote to remove unused arg by @samcoe in #8392
New Contributors
- @mateusmarquezini made their first contribution in #8361
- @tal66 made their first contribution in #8337
- @nelsonchen304 made their first contribution in #8350
- @steiza made their first contribution in #8411

What's Changed
- build(deps): bump github.com/creack/pty from 1.1.20 to 1.1.21 by @dependabot in #8345
- gh repo sync should be able to sync a local branch with an upstream remote by @benebsiny in #8229
- Update to latest go-gh by @samcoe in #8359
- Fix project status unmarshaling by @williammartin in #8384

What's Changed
- Fix executable location by @xqm32 in #8238
- Query project item status field properly by @samcoe in #8332
New Contributors
- @xqm32 made their first contribution in #8238

Highlights
- extension install no longer errors unhelpfully if the extension is already installed by @Delta456 in #8211
- All tables now have headers by @heaths in #8157
- project commands have a clearer error message when no owner can be resolved by @ffalor in #8235
- workflow run now presents a select for choice workflow input types by @adarshjhaa100 in #8180
- codespace create no longer polls for additional codespace permissions unnecessarily by @dmgardiner25 in #8267
- go install now works with the removal of our crypto fork by @samcoe in #8204
Everything Else
- Additional testing for config by @williammartin in #8213
- Bumped cpuguy83/go-md2man from 2.0.1 to 2.0.3 by @mikelolasagasti in #8209
- Bumped mattn/go-isatty from 0.0.19 to 0.0.20 by @dependabot in #8205
- Bumped google.golang.org/grpc from 1.53.0 to 1.56.3 by @dependabot in #8251
- Bumped creack/pty from 1.1.18 to 1.1.20 by @dependabot in #8265
- Provide default config to bumped go-gh by @samcoe in #8244
New Contributors
- @mikelolasagasti made their first contribution in #8209
- @Delta456 made their first contribution in #8211
- @adarshjhaa100 made their first contribution in #8180

What's Changed
- codespace: Hint adding codespace scope when not logged in by @rajhawaldar in #7961
- codespace ports: Forward codespace ports over Dev Tunnels by @dmgardiner25 in #8023
- cache delete: Percent-encode keys by @benoit-pierre in #8030
- gpg-key delete, run watch: Return HTTP errors properly by @heaths in #8037
- pr checks: Show cancelled checks by @rajhawaldar in #7960
- cache list: Add JSON exporting support by @siketyan in #7954
- auth: Fix startup panic when logged out by @alrs in #8105
- secret list, deploy-key list: Support standard output format flags by @rajhawaldar in #8081
- pr create: Update the docs on flag --fill by @peterramaldes in #8080
- run view: Use attempt input when fetching jobs by @arunsathiya in #7831
- project item-edit: New clear flag to remove item field value by @arunsathiya in #8024
- build(deps): Bump mislav/bump-homebrew-formula-action from 2 to 3 by @dependabot in #8033
- Update triage documentation with link to unlabeled open issues by @andyfeller in #8082
New Contributors
- @benoit-pierre made their first contribution in #8030
- @siketyan made their first contribution in #7954
- @alrs made their first contribution in #8105
- @peterramaldes made their first contribution in #8080
- @arunsathiya made their first contribution in #7831

What's Changed
- codespace: Hint adding codespace scope when not logged in by @rajhawaldar in #7961
- codespace ports: Forward codespace ports over Dev Tunnels by @dmgardiner25 in #8023
- cache delete: Percent-encode keys by @benoit-pierre in #8030
- gpg-key delete, run watch: Return HTTP errors properly by @heaths in #8037
- pr checks: Show cancelled checks by @rajhawaldar in #7960
- cache list: Add JSON exporting support by @siketyan in #7954
- auth: Fix startup panic when logged out by @alrs in #8105
- secret list, deploy-key list: Support standard output format flags by @rajhawaldar in #8081
- pr create: Update the docs on flag --fill by @peterramaldes in #8080
- run view: Use attempt input when fetching jobs by @arunsathiya in #7831
- project item-edit: New clear flag to remove item field value by @arunsathiya in #8024
- build(deps): Bump mislav/bump-homebrew-formula-action from 2 to 3 by @dependabot in #8033
- Update triage documentation with link to unlabeled open issues by @andyfeller in #8082
New Contributors
- @benoit-pierre made their first contribution in #8030
- @siketyan made their first contribution in #7954
- @alrs made their first contribution in #8105
- @peterramaldes made their first contribution in #8080
- @arunsathiya made their first contribution in #7831

What's New
- gh alias delete now supports the --all flag by @JunNishimura in #7900
- gh release delete now supports the --cleanup-tag flag by @kemingy in #7884
- gh release create now supports the --notes-from-tag flag by @kbailey4444 in #7861
What's Changed
- Clarified gh repo list --fork and --source behavior for orgs @ncalteen in #7964
- gh cs create now shows the full permissions URL by @joshmgross in #7983
- Documented when gh auth login falls back to using insecure storage by @kbailey4444 in #7781
- Bumped goreleaser/goreleaser-action from 4 to 5 by @dependabot in #7981
New Contributors
- @kemingy made their first contribution in #7884
- @ncalteen made their first contribution in #7964
- @kbailey4444 made their first contribution in #7861

What's New
- api: Add --verbose flag by @JunNishimura in #7826
- config clear-cache: New command to clear the cli cache by @ffalor in #7693
- workflow list: Add --json, --jq and --template flags by @rajhawaldar in #7902
- project mark-template: New command to control project template options by @mntlty in #7916 #7923
What's Changed
- docs: Fix Nix/NixOS install docs by @junaga in #7891
- repo rename: Properly rename remote for GHES hosts by @samcoe in #7890
- pr checks: Return different exit code for PENDING vs FAILED by @rajhawaldar in #7866
- repo create: Execute clone when readme option is enabled by @shion1305 in #7837
- repo create: Allow --disable-wiki flag with --template flag by @utouto97 in #7886
- auth status: Reword token invalid message by @kousikmitra in #7906
- status: Show status even if a comment 404s by @rwe in #7873
- run view: Fetch all run jobs by @harveysanders in #7879
- Use go-gh prompter package by @samcoe in #7896
- Add formula-path to homebrew-bump step by @williammartin in #7930
- build(deps): bump actions/checkout from 3 to 4 by @dependabot in #7937
New Contributors
- @junaga made their first contribution in #7891
- @utouto97 made their first contribution in #7886
- @rwe made their first contribution in #7873

What's Changed
- Delete local branch more often when merging PR by @armandgrillet in #7709
- Do not allow issue and pr templates to be symlinks by @samcoe in #7756
- release create: Trim spaces on tag name by @harveysanders in #7759
- Use filepath.
Base to sanitize path for archive downloads by @samcoe in #7805
- Codespaces: Use the host name from the logged in server for commands by @jkeech in #7795
- Update CONTRIBUTING.md by @andyfeller in #7812
- Allow --org parameter in lieu of a repo context for rulesets, add current_user_can_bypass to rs view by @vaindil in #7747
- add missing ls aliases to list subcommands by @cawfeecake in #7818
- port repo edit prompts by @vilmibm in #7816
- add clobber flag to alias set by @JunNishimura in #7787
- Remove GHE handling for workflow by @jamietanna in #7841
- Upgrade to Go 1.21 by @samcoe in #7843
- switch to prompter in workflow commands by @vilmibm in #7847
- update more prompts by @vilmibm in #7850
- switch to prompter in pr shared code by @vilmibm in #7859
- THE FINAL PROMPTDOWN by @vilmibm in #7860
- codespace: Handle HTTP request retry interruption by @azrsh in #7846
New Contributors
- @armandgrillet made their first contribution in #7709
- @harveysanders made their first contribution in #7759
- @andyfeller made their first contribution in #7812
- @JunNishimura made their first contribution in #7787
- @jamietanna made their first contribution in #7841
- @azrsh made their first contribution in #7846

What's Changed
- pr checks: Fix regression making it unusable in GHES versions older than 3.9 by @samcoe in #7725
- pr edit: Do not make reviewer update request if there are no reviewer changes by @samcoe in #7730
- repo view: Sanitize file contents before displaying them by @samcoe in #7694
- release download: Use filepath.
Clean to sanitize path for archive downloads by @samcoe in #7720
- auth: Do not add auth token to redirect requests which do not have the same host as the initial request by @samcoe in #7692
- Use asciisanitization package from go-gh by @samcoe in #7745

What's Changed
- Fix up Linux packaging regression by @samcoe in #6621

What's new:
- label edit: Command to edit existing labels by @heaths in #5519
- label clone: Command to clone labels between repositories by @heaths in #5452
- label create: Add --force flag to forcibly create labels by @heaths in #5451
- codespaces: Support for multi devcontainer by @reybard in #5076
What's changed:
- label list: Add column for displaying the label color by @heaths in #5462
- pr merge: Warn if PR is already merged by @mntlty in #5463
- gist delete: Avoid crash when deleting gist with no owner by @mislav in #5510
- list commands: Standardize output when no entries found by @rpadaki in #5479
- repo list: Add ls alias to command by @rpadaki in #5480
- issue/pr list: Fix searching by --state flag by @samcoe in #5513
- search prs: Correct displayed header when searching prs command by @samcoe in #5488
- pr create: Document that --body-file reads from stdin by @lukekarrys in #5461
- Add tab completion descriptions for aliases and extensions by @rpadaki in #5447
- Replace deprecated ioutil package with io and os package replacements by @estensen in #5498

What's New
• New release edit command
• issue close: add --comment flag to close with comment
• issue delete: add --confirm flag
• pr merge: provide instructions for resolving merge conflicts
• codespace select: add hidden select command for extensions
• codespace create: make location an optional flag
• codespace create: handle idle timeout notice
• codespace code: add --web flag to open in Visual Studio Code web mode
• gist edit: allow non-interactive file replacement
• extension upgrade: add --dry-run flag
• Add new alias to all create commands

What's Changed
• Add support for installing binary extensions on M1 Macs
• status: respect GitHub host configuration
• codespace ssh/cp: check paths safely
• codespace edit: remove unsupported idle timeout flag
• extension list: speed up output by avoiding checking for upgrades
• extension list: don't error if no extensions are installed
• auth login: fix flow when ~/.config/gh/config.yml is read-only
• Fix table printer crash in narrow terminals
• Improve DNF installation instructions
• Change issue close color from red to purple
• Replace old search query builder

Find your work across repositories
• Add gh status command
• The status command displays issues and pull requests assigned to you from anywhere on GitHub, as well as requests for your review, mentions of your name, and notifications.
• gh search: Add search issues and search pull requests commands

Other New Features
• Add label list and label create commands
• Add ability to filter issue and pull request lists by app
• extension install: Add option to pin extensions to a version
• Add support for Dependabot secrets
• Add GH_DEBUG environment variable, deprecate DEBUG for verbose mode

Fixes
• Codespaces: Disallow some operations on codespaces that have a pending operation
• Codespaces: Listen to agent port-forwarding events when forwarding ports
• cs ssh: remove unwanted trailing quote
• cs ssh: use setup example that should work with any ssh config
• cs cp: parse additional scp args
• cs create: rename repo permissions opt-out parameter
• pr view: respect GH_FORCE_TTY
• extension upgrade --all: do not throw an error if no extensions are installed
• run download: fix extracting to root path
• pr create --web: fix escaping URL path components
• release list: fix "latest" release logic
• Text editor: only add UTF-8 BOM on Windows
• Bump github.com/AlecAivazis/survey/v2 from 2.3.2 to 2.3.4

Codespaces Updates
• Allow Editing Codespaces by @veverkap in #5211
• Updates wording for codespaces accept permissions flow by @markphelps in #5276
• Add VSCS Target to gh cs list by @cmbrose in #5296
• Adds internal codespace developer flags by @joshspicer in #5287
• Add --profile option to gh cs cp by @cmbrose in #5297

Other New Features
• add interactive repository edit functionality by @g14a in #4895
• Support setting Dependabot secrets by @joshmgross in #5134
• Add version to extension list command by @seachicken in #5219
• after merge, switch to base branch if available by @bstncartwright in #5251

Bugfixes
• pr close skips deleting local branch if not in a git repo by @ganboonhong in #5254
• pr checks: fix error message when no checks were found by @mislav in #5286
• Fixed permission for workflow by @neilnaveen in #5279

Docs & Development
• Bump actions/checkout from 2 to 3 by @dependabot in #5271
• Bump Cobra to eliminate Viper by @mislav in #5293
• Bump golangci-lint version by @mislav in #5298'