ဤဗားရှင်းသည် ဗားရှင်းဟောင်း ဖြစ်ပါသည်။ နောက်ဆုံးဗားရှင်းမှာ 2.103.2 ဖြစ်ပါသည်။ GitHub CLI 2.103.2 · ထုတ်ဝေသည့်နေ့:
Installer ဖိုင်များ 2.102.0
| Architecture | အမျိုးအစား | ထည့်သွင်းမှု နယ်ပယ် | ဖိုင်အရွယ်အစား | ဒေါင်းလုဒ် | SHA256 |
|---|---|---|---|---|---|
| 64-bit | MSI | အသုံးပြုသူအားလုံး | — | github.com | VirusTotal |
| 64-bit | ZIP → Portable | — | — | github.com | VirusTotal |
| ARM64 | MSI | အသုံးပြုသူအားလုံး | — | github.com | VirusTotal |
| ARM64 | ZIP → Portable | — | — | github.com | VirusTotal |
| 32-bit | MSI | အသုံးပြုသူအားလုံး | — | github.com | VirusTotal |
| 32-bit | ZIP → Portable | — | — | github.com | VirusTotal |
လင့်ခ်နှင့် SHA256 ကို Windows Package Manager community manifest မှ ယူထားပါသည်။ ဒေါင်းလုဒ်လုပ်ထားသော ဖိုင်ကို မဖွင့်မီ hash ကို တိုက်ဆိုင်စစ်ဆေးပါ။
Release notes
Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible.
gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links.
See https://github.com/cli/cli/security/advisories/GHSA-39wj-f2f4-978v for more information.
gh attestation verify compared the --source-ref value case-insensitively, so an attestation built from a branch whose name differs only in case could satisfy a policy that named a different branch.
See https://github.com/cli/cli/security/advisories/GHSA-4mq3-hpgx-9cx8 for more information.
Interactive gh skill search passed repository paths from search results to gh skill install without an option separator, so a search result could inject installer options and change where skill files were written.
See https://github.com/cli/cli/security/advisories/GHSA-qcwj-mr2r-2cx7 for more information.
gh attestation verify matched the --signer-workflow value against only the start of the signing certificate's identity, so an attestation signed by a different workflow in the pinned repository could pass verification when its path began with the pinned value.
See https://github.com/cli/cli/security/advisories/GHSA-wjmr-j3rp-mh2g for more information.
What's Changed
🐛 Fixes
- Allow ghu_ tokens for supported actors to attach files by @BagToad in #14516
- Allow repo set-default --unset without an argument by @williammartin in #14540
📚 Docs & Chores
- Prioritize HackerOne for vulnerability reports by @BagToad in #14497
- Clarify reviewer-facing PR guidance by @williammartin in #14509
- Add a skill for chaptered CLI recordings by @BagToad in #14475
- Improve CLI recording rendering by @williammartin in #14507
- Mention gh CLI in the README intro by @BagToad in #14517
- Document search operator support in gh search help by @waldyrious in #14519
- Remove host versions from gh project item-list help by @BagToad in #14553
Dependencies
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14486
- chore(deps): bump nodeselector/setup-apple-codesign from 0.0.2 to 0.0.3 by @dependabot in #14487
- chore(deps): bump charm.land/bubbletea/v2 from 2.0.9 to 2.0.10 by @dependabot in #14541
- chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1 by @dependabot in #14542
- chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14543
