chore(deps): update dependency cli/cli to v2.97.0 #28
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/cli-cli-2.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
2.96.0→2.97.0Release Notes
cli/cli (cli/cli)
v2.97.0: GitHub CLI 2.97.0Compare Source
Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version
v2.97.0as soon as possible.Several commands (including
gh gist view,gh api,gh pr diff,gh release download --output -,gh codespace logs,gh skills preview, andgh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.See https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46 for more information.
Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause
ghto address a different resource than intended.See https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 for more information.
gh auth status(without--show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such asgithub_pat_*,ghs_*, andghu_*.See https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm for more information.
gh attestation verifybuilt the certificate matcher from--signer-repoand--signer-workflowwithout escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.See https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g for more information.
Address project fields and items by name in
gh projectgh project item-editandgh project item-listcan now reference project fields and single-select options by name:What's Changed
✨ Features
gh project item-editby @zwick in #13807gh project item-listby @zwick in #13823gh skillagents by @tommaso-moro in #13987🐛 Fixes
📚 Docs & Chores
OWNER/REPOformat hint to thegh search --repoflag by @BagToad in #13922item-editas the first-class project flow in docs by @Solaris-star in #13927SITE_DEPLOY_PATwith the gh-cli-site-deployer App by @williammartin in #13492pkg/cmd/release/attestation/by @kobihikri in #13886:dependabot: Dependencies
ab275d0to309922bby @dependabot in #13878New Contributors
Full Changelog: https://github.com/cli/cli/compare/v2.96.0...v2.97.0
Configuration
📅 Schedule: (in timezone America/New_York)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
✅ Success: Pipelines as Code CI/pr-build for
8db258635eTask Statuses:
fetch-source
detect-changes
build-and-push
Full log available here
f4813faa818db258635e