GitHub CLI

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: https://github.com/cli/cli/security/advisories/GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features

• Allow gh release download without authentication on public repositories by @BagToad in #13723
• Detect additional third-party coding agents by @BagToad in #13722
• Support antigravity-cli and antigravity2.0 in gh skill by @BagToad in #13784

🐛 Fixes

• fix: show checks summary when all checks were cancelled by @s3onghyun in #13679
• fix(skills): install universal agent to ~/.agents/skills by @toller892 in #13681
• fix(skills): honor --dir without agent prompt by @happysnaker in #13766
• Fix concurrent map writes in codespace port forwarding by @williammartin in #13313
• Use int64 for GitHub database IDs by @williammartin in #13403

📚 Docs & Chores

• Pin reusable triage workflows to a commit SHA by @BagToad in #13705
• Add security disclosure guidance to AGENTS.md by @BagToad in #13720
• Clarify --clone boolean flag behaviour in gh repo fork help by @BagToad in #13786
• Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @pdostal in #13675
• docs(search): add examples for multiple qualifiers by @happysnaker in #13756
• docs: fix broken anchor link in release-process-deep-dive by @patrickwehbe in #13688
• docs: fix broken install command and link/grammar errors by @patrickwehbe in #13690
• docs: fix duplicated word in primer README by @s3onghyun in #13677

:dependabot: Dependencies

• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @dependabot in #13708
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #13703
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot in #13702
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #13740
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot in #13754
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot in #13759
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #13779

New Contributors

• @patrickwehbe made their first contribution in https://github.com/cli/cli/pull/13688
• @s3onghyun made their first contribution in https://github.com/cli/cli/pull/13679
• @toller892 made their first contribution in https://github.com/cli/cli/pull/13681
• @happysnaker made their first contribution in https://github.com/cli/cli/pull/13756

Full Changelog: https://github.com/cli/cli/compare/v2.95.0...v2.96.0

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

[!NOTE] gh repo read-file and gh repo read-dir are in preview and subject to change without notice.

What's Changed

✨ Features

• feat: add repo read-file and repo read-dir by @babakks in https://github.com/cli/cli/pull/13580
• feat(skills): list available skills when install runs non-interactively by @SamMorrowDrums in https://github.com/cli/cli/pull/13548
• Support custom CLAUDE_CONFIG_DIR in install by @tommaso-moro in https://github.com/cli/cli/pull/13523

🐛 Fixes

• fix(skills): stage updates in a temp dir and swap in-place by @SamMorrowDrums in https://github.com/cli/cli/pull/13449

📚 Docs & Chores

• Make filtering by bot authors more discoverable by @BagToad in https://github.com/cli/cli/pull/13642
• docs(discussion): polish help docs by @babakks in https://github.com/cli/cli/pull/13632
• Bump Go in devcontainer by @spenserblack in https://github.com/cli/cli/pull/13674

:dependabot: Dependencies

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13640
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13663
• chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13661
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13619
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13662
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13641

Full Changelog: https://github.com/cli/cli/compare/v2.94.0...v2.95.0

Issue types, sub-issues, and relationships in gh issue

<img width="2784" height="1494" alt="issue-view-monas-cafe-with-frame" src="https://github.com/user-attachments/assets/fd2c6a89-0ac2-472d-a1df-b4e6124f270b" />

This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

Manage discussions with gh discussion

<img width="2784" height="1179" alt="discussion-view-monas-cafe-with-frame" src="https://github.com/user-attachments/assets/c625fe16-b625-4b24-b8b1-80e0c5336b8c" />

This release introduces the discussion command set for working with GitHub Discussions in gh:

# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>

Run gh discussion --help for more information.

[!NOTE] The discussion command set is in preview and is subject to change without notice.

Equip your agents with new gh features

Teach your agents how to leverage new GitHub CLI features on release day by installing the gh skill:

# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh

What's Changed

✨ Features

• Add gh discussion command set (list, view, create, edit) as a preview by @babakks and @maxbeizer in #13541
• Add gh discussion comment to comment on and reply to discussions by @babakks in #13620
• Add Issues 2.0 support: issue types, sub-issues, and relationships by @BagToad in #13057
• Add gh skill list to inventory installed agent skills by @tommaso-moro in #13418
• Add --all flag to gh skill install to install every skill in a repository by @tommaso-moro in #13471
• Skip skills without metadata when running gh skill update --all by @tommaso-moro in #13469
• Alias gh extension uninstall to gh extension remove by @BagToad in #13599
• Auto-install official extensions in CI by @BagToad in #13581

🐛 Fixes

• fix(skill): support skill discovery in nested directories by @tommaso-moro in #13459

📚 Docs & Chores

• Bump Go to 1.26.4 by @github-actions[bot] in #13578
• Clean up deferred issue update helper by @BagToad in #13584
• Add terminal-mockup canvas extension for marketing screenshots by @BagToad in #13612
• Add gh discussion and Issues 2.0 reference to the gh skill, plus a README note by @BagToad in #13631

:dependabot: Dependencies

• chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot in #13521
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10 by @dependabot in #13520
• chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @dependabot in #13572
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7 by @dependabot in #13595
• chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot in #13596
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot in #13597

Full Changelog: https://github.com/cli/cli/compare/v2.93.0...v2.94.0

What's Changed

• chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13297
• Add missing //go:build integration tag to verify_integration_test.go by @pdostal in https://github.com/cli/cli/pull/13303
• Fix flaky accessible prompter Password test timeout by @pdostal in https://github.com/cli/cli/pull/13304
• Enable extended PR screening for external PRs by @tidy-dev in https://github.com/cli/cli/pull/13312
• fix(pr): remove numberFieldOnly optimization that skips API validation by @williammartin in https://github.com/cli/cli/pull/13327
• Print gh auth refresh for 401 returns by @333fred in https://github.com/cli/cli/pull/13068
• Grammar fixes by @scop in https://github.com/cli/cli/pull/13326
• Bump gh copilot telemetry sampling to 100% by @williammartin in https://github.com/cli/cli/pull/13362
• Record accessibility feature state in telemetry by @williammartin in https://github.com/cli/cli/pull/13363
• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13328
• Poll TTY echo mode instead of sleeping in password tests by @pdostal in https://github.com/cli/cli/pull/13305
• Switch from actions/attest-build-provenance to actions/attest by @scop in https://github.com/cli/cli/pull/13325
• Fix skills acceptance tests by @williammartin in https://github.com/cli/cli/pull/13365
• Bump Go toolchain to 1.26.3 by @Copilot in https://github.com/cli/cli/pull/13367
• Trigger triage check-requirements on ready_for_review by @BagToad in https://github.com/cli/cli/pull/13383
• fix(copilot): hint to run copilot directly when exec fails by @babakks in https://github.com/cli/cli/pull/13393
• Update installation commands for GitHub CLI by @sassdawe in https://github.com/cli/cli/pull/13126
• chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13381
• chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13396
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13346
• chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13397
• Update CODEOWNERS for skills directory ownership by @williammartin in https://github.com/cli/cli/pull/13416
• fix(telemetry): prevent tzutil console flash on Windows by @adehad in https://github.com/cli/cli/pull/13353
• Fix bump-go.sh to tolerate missing toolchain directive by @Copilot in https://github.com/cli/cli/pull/12581
• chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13420
• chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13436
• Derive digest algorithm from ref length in release verify commands by @bdehamer in https://github.com/cli/cli/pull/13430
• docs: drop --repo gh-cli from dnf install lines by @c-tonneslan in https://github.com/cli/cli/pull/13444
• Remove third-party license debris by @williammartin in https://github.com/cli/cli/pull/13470
• Remove dependency on persistent token by @williammartin in https://github.com/cli/cli/pull/13474
• Remove discussion workflow by @williammartin in https://github.com/cli/cli/pull/13476
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13461
• Stop bumping homebrew on release by @williammartin in https://github.com/cli/cli/pull/13479
• build: update golang.org/x/crypto by @tommaso-moro in https://github.com/cli/cli/pull/13486
• Add 3 day dependabot cooldown period by @williammartin in https://github.com/cli/cli/pull/13488
• Run govulncheck daily instead of weekly by @williammartin in https://github.com/cli/cli/pull/13487
• chore(deps): bump github/codeql-action from 4 to 4.35.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13489
• SHA pin first-party GitHub Actions by @williammartin in https://github.com/cli/cli/pull/13491
• Allow agents as application for secrets by @tenjaa in https://github.com/cli/cli/pull/13421
• Link to Accessibility category for community discussions instead of ACR by @mxie in https://github.com/cli/cli/pull/13481
• docs: fix duplicated "of" in release-process-deep-dive by @vip892766gma in https://github.com/cli/cli/pull/13425
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13462
• chore(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13457
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @BagToad in https://github.com/cli/cli/pull/13510
• docs: note immutable releases starting v2.93.0 by @BagToad in https://github.com/cli/cli/pull/13518
• fix CI attestation integration tests after rename by @BagToad in https://github.com/cli/cli/pull/13536

New Contributors

• @pdostal made their first contribution in https://github.com/cli/cli/pull/13303
• @333fred made their first contribution in https://github.com/cli/cli/pull/13068
• @scop made their first contribution in https://github.com/cli/cli/pull/13326
• @sassdawe made their first contribution in https://github.com/cli/cli/pull/13126
• @adehad made their first contribution in https://github.com/cli/cli/pull/13353
• @c-tonneslan made their first contribution in https://github.com/cli/cli/pull/13444
• @tenjaa made their first contribution in https://github.com/cli/cli/pull/13421
• @mxie made their first contribution in https://github.com/cli/cli/pull/13481
• @vip892766gma made their first contribution in https://github.com/cli/cli/pull/13425

Full Changelog: https://github.com/cli/cli/compare/v2.92.0...v2.93.0

Support GitHub Enterprise Cloud (GHEC) in skill commandset

Now gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts with data residency.

Add --allow-hidden-dirs flag to skill preview

Following the addition of --allow-hidden-dirs to skill install in the previous release, now the flag is also supported in skill preview, allowing users to preview skills located in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

What's Changed

✨ Features

• feat(skills): add --allow-hidden-dirs flag to preview command by @SamMorrowDrums in https://github.com/cli/cli/pull/13265
• feat(skills): support GHEC with data residency hosts by @SamMorrowDrums in https://github.com/cli/cli/pull/13264

🐛 Fixes

• Fix SetSampleRate not updating sample_rate dimension by @williammartin in https://github.com/cli/cli/pull/13259
• Fix log terminal injection by @williammartin in https://github.com/cli/cli/pull/13272
• Add "Resource not accessible" to ProjectsV2IgnorableError by @maxbeizer in https://github.com/cli/cli/pull/13281

📚 Docs & Chores

• fix: using variable interpolation `${{ in deployment.yml... by @orbisai0security in https://github.com/cli/cli/pull/13258
• docs: correct typo in Linux Homebrew copy by @cassidyjames in https://github.com/cli/cli/pull/13273
• Install skills flat by Name, not namespaced InstallName by @SamMorrowDrums in https://github.com/cli/cli/pull/13266
• chore: fix zsh completion on debian by @babakks in https://github.com/cli/cli/pull/13274
• Add trust disclaimer to extension help text by @travellertales in https://github.com/cli/cli/pull/13296
• Bump Go to 1.26.2 by @github-actions[bot] in https://github.com/cli/cli/pull/13301

:dependabot: Dependencies

• chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by @dependabot[bot] in https://github.com/cli/cli/pull/13161
• chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13162
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 by @dependabot[bot] in https://github.com/cli/cli/pull/13163
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13206
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 by @dependabot[bot] in https://github.com/cli/cli/pull/13241
• chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in https://github.com/cli/cli/pull/13298

New Contributors

• @orbisai0security made their first contribution in https://github.com/cli/cli/pull/13258
• @cassidyjames made their first contribution in https://github.com/cli/cli/pull/13273
• @travellertales made their first contribution in https://github.com/cli/cli/pull/13296

Full Changelog: https://github.com/cli/cli/compare/v2.91.0...v2.92.0

GitHub CLI now collects pseudoanonymous telemetry

To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudoanonymous telemetry.

See Telemetry for more details on what's collected, why, and how to opt out.

Support more agents in gh skill

Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help for the list of available agents.

Improve skill discovery

gh skill install now adds the --allow-hidden-dirs flag to support discovering skills in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

Detect skills re-published from other sources

GitHut CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The --upstream flag is also added for non-interactive use cases.

What's Changed

:sparkles: Features

• Add support for installation in multiple agent hosts in gh skills install by @tommaso-moro in https://github.com/cli/cli/pull/13209
• Add --allow-hidden-dirs flag to gh skill install by @SamMorrowDrums in https://github.com/cli/cli/pull/13213
• Make skill discovery less strict: support nested skills/ directories by @SamMorrowDrums in https://github.com/cli/cli/pull/13235
• feat(skills): detect re-published skills and offer upstream install by @SamMorrowDrums in https://github.com/cli/cli/pull/13236

:bug: Fixes

• Fix skills publish --fix to not publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13237
• fix(skills): match skills by install name in preview command by @SamMorrowDrums in https://github.com/cli/cli/pull/13249

:books: Docs & Chores

• Remove misleading text by @tommaso-moro in https://github.com/cli/cli/pull/13203
• Add sampled command telemetry by @williammartin in https://github.com/cli/cli/pull/13191
• Do not send telemetry for aliases by @williammartin in https://github.com/cli/cli/pull/13192
• Add skills specific telemetry by @williammartin in https://github.com/cli/cli/pull/13204
• Record CI context in telemetry by @williammartin in https://github.com/cli/cli/pull/13210
• Record official extension telemetry by @williammartin in https://github.com/cli/cli/pull/13205
• Add telemetry command by @williammartin in https://github.com/cli/cli/pull/13253
• Log when there is no telemetry by @williammartin in https://github.com/cli/cli/pull/13255
• docs(skills): add gh and gh-skill agent skills by @BagToad in https://github.com/cli/cli/pull/13244
• Enable telemetry without env var by @williammartin in https://github.com/cli/cli/pull/13254

Full Changelog: https://github.com/cli/cli/compare/v2.90.0...v2.91.0

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features

• Add gh skill command group: install, preview, search, update, publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13165
• Suggest and install official extensions for unknown commands by @BagToad in https://github.com/cli/cli/pull/13175
• gh skill publish: auto-push unpushed commits before publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13171
• Disable auth check for gh extension install by @BagToad in https://github.com/cli/cli/pull/13176

🐛 Fixes

• Fix infinite loop in gh release list --limit 0 by @Bahtya in https://github.com/cli/cli/pull/13097
• Ensure api and auth commands record agentic invocations by @williammartin in https://github.com/cli/cli/pull/13046
• Disable auth check for local-only skill flags by @SamMorrowDrums in https://github.com/cli/cli/pull/13173
• URL-encode parentPath in skills discovery API call by @SamMorrowDrums in https://github.com/cli/cli/pull/13172
• Fix: use target directory remotes in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13169
• Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in https://github.com/cli/cli/pull/13170

📚 Docs & Chores

• docs: include PGP key fingerprints by @babakks in https://github.com/cli/cli/pull/13112
• docs: add sha/md5 checksums of keyring files by @babakks in https://github.com/cli/cli/pull/13150
• docs: fix SHA512 checksum for GPG key by @timsu92 in https://github.com/cli/cli/pull/13157
• docs(skill): polish skill commandset docs by @babakks in https://github.com/cli/cli/pull/13183
• Document dependency CVE policy in SECURITY.md by @BagToad in https://github.com/cli/cli/pull/13119
• Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in https://github.com/cli/cli/pull/13048
• chore: bump to go1.26.2 by @babakks in https://github.com/cli/cli/pull/13116
• chore: delete experimental script/debian-devel by @babakks in https://github.com/cli/cli/pull/13127
• Suggest first party extensions by @williammartin in https://github.com/cli/cli/pull/13182
• Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in https://github.com/cli/cli/pull/13189
• Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in https://github.com/cli/cli/pull/13190
• Address post-merge review feedback for skills commands by @SamMorrowDrums in https://github.com/cli/cli/pull/13185
• Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in https://github.com/cli/cli/pull/13187
• Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in https://github.com/cli/cli/pull/13188
• Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13168
• Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in https://github.com/cli/cli/pull/13167

:dependabot: Dependencies

• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13071
• chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13045
• chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13051
• chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13152
• chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13129
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13128
• chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13044
• chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12918
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13076
• chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13065

New Contributors

• @thaJeztah made their first contribution in https://github.com/cli/cli/pull/13048
• @Bahtya made their first contribution in https://github.com/cli/cli/pull/13097
• @timsu92 made their first contribution in https://github.com/cli/cli/pull/13157
• @SamMorrowDrums made their first contribution in https://github.com/cli/cli/pull/13173

Full Changelog: https://github.com/cli/cli/compare/v2.89.0...v2.90.0

:copilot: gh agent-task now works on ghe.com tenancies

gh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works correctly regardless of your GitHub hosting environment.

Experimental new prompter

A new TUI-based prompter powered by charmbracelet/huh is available behind the GH_EXPERIMENTAL_PROMPTER environment variable. This is an early preview — try it out and share feedback!

export GH_EXPERIMENTAL_PROMPTER=1

gh issue create and gh issue transfer no longer require extra token scopes

gh issue create and gh issue transfer previously fetched repository fields they didn't need, which could require additional token scopes. These commands now fetch only the minimal fields necessary for issue operations.

What's Changed

✨ Features

• gh pr create, gh issue create, gh issue edit: search-based assignee selection and login-based mutation on github.com by @BagToad in #13009
• Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER by @BagToad in #12859

🐛 Fixes

• fix(agent-task): resolve Copilot API URL dynamically for ghe.com tenancies by @BagToad in #12956
• fix(issue): avoid fetching unnecessary fields in issue create and issue transfer by @babakks in #12884
• fix: resolve data race in codespaces port forwarder by @Lslightly in #13033

📚 Docs & Chores

• Record agentic invocations in User-Agent header by @williammartin in #13023
• docs: clarify that gh pr edit --add-reviewer can re-request reviews by @joshjohanning in #13021
• Add AGENTS.md by @williammartin in #13024
• Fix typo: remove extra space in README.md link by @realMelTuc in #12725
• Align triage.md with current triage process by @tidy-dev in #13030
• Remove auto-labels from issue templates by @tidy-dev in #12972
• Consolidate actor-mode signals into ApiActorsSupported by @BagToad in #13025
• Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by @BagToad in #13037

:dependabot: Dependencies

• chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #12963
• chore(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.3 by @dependabot[bot] in #12962
• chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 by @dependabot[bot] in #13031
• chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 by @dependabot[bot] in #13005
• chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by @dependabot[bot] in #13004
• chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #12951

New Contributors

• @joshjohanning made their first contribution in #13021
• @realMelTuc made their first contribution in #12725
• @Lslightly made their first contribution in #13033

Full Changelog: v2.88.1...v2.89.0

Fix pr commands failing with read:project scope error

v2.88.0 introduced a regression where pr commands would fail with the error:

error: your authentication token is missing required scopes [read:project]
To request it, run:  gh auth refresh -s read:project

Previously, missing read:project scope was gracefully handled, and project data was silently skipped. A change inadvertently broke the error matching that enabled this graceful degradation. v2.88.1 reverts these changes so that pr commands work correctly without requiring the read:project scope.

What's Changed

• Migrate Windows code signing from client secret to OIDC by @BagToad in https://github.com/cli/cli/pull/12911
• Revert "refactor: deduplicate scope error handling between api/client.go and project queries" by @williammartin in https://github.com/cli/cli/pull/12914
• Revert "fix: clarify scope error while creating issues for projects" by @williammartin in https://github.com/cli/cli/pull/12915

Full Changelog: https://github.com/cli/cli/compare/v2.88.0...v2.88.1

:copilot: Request Copilot Code Review from gh

<img width="80%" height="80%" alt="image" src="https://github.com/user-attachments/assets/c9b86700-5934-44b6-9210-227495a18d8e" />

gh pr create and gh pr edit now support Copilot Code Review as a reviewer. Request a review with --add-reviewer @copilot, or select Copilot interactively from the searchable reviewer prompt.

Create a pull request and request review from Copilot:

gh pr create --reviewer @copilot

Edit a pull request and request review from Copilot:

gh pr edit --add-reviewer @copilot

Close issues as duplicates with gh issue close --duplicate-of

You can now close issues as duplicates and link to a duplicate issue directly from the CLI. The new --duplicate-of flag accepts an issue number or URL and marks the closed issue as a duplicate of the referenced one. You can also use --reason duplicate to set the close reason without linking a specific issue.

# Close as duplicate, linking to the original issue
gh issue close 123 --duplicate-of 456

# Close with duplicate reason only
gh issue close 123 --reason duplicate

JSON support for gh agent-task

gh agent-task list and gh agent-task view now support --json, --jq, and --template flags, consistent with other gh commands.

gh agent-task list --json id,name,state
gh agent-task view <id> --json state --jq '.state'

What's Changed

✨ Features

• gh pr create: login-based reviewer requests and search-based interactive selection by @BagToad in https://github.com/cli/cli/pull/12627
• gh pr view and gh issue view: show friendly display names for all actors by @BagToad in https://github.com/cli/cli/pull/12854
• gh issue close: add --duplicate-of flag and duplicate reason by @tksohishi in https://github.com/cli/cli/pull/12811
• gh pr diff: add --exclude flag to filter files from diff output by @yuvrajangadsingh in https://github.com/cli/cli/pull/12655
• gh pr view/list: add changeType field to files JSON output by @yuvrajangadsingh in https://github.com/cli/cli/pull/12657
• gh repo clone: add --no-upstream flag by @4RH1T3CT0R7 in https://github.com/cli/cli/pull/12686
• gh repo edit: add --squash-merge-commit-message flag by @yuvrajangadsingh in https://github.com/cli/cli/pull/12846
• gh browse: add --blame flag by @masonmcelvain in https://github.com/cli/cli/pull/11486
• gh agent-task list: add --json support by @maxbeizer in https://github.com/cli/cli/pull/12806
• gh agent-task view: add --json support by @maxbeizer in https://github.com/cli/cli/pull/12807
• gh copilot: set COPILOT_GH env var when launching Copilot CLI by @devm33 in https://github.com/cli/cli/pull/12821

🐛 Fixes

• Fix gh project item-edit error when editing Draft Issue with only one (--title/--body) flag by @ManManavadaria in https://github.com/cli/cli/pull/12787
• Fix extension install error message showing raw struct instead of owner/repo by @Copilot in https://github.com/cli/cli/pull/12836
• Fix incorrect integer conversion from int to uint16 in port forwarder by @BagToad in https://github.com/cli/cli/pull/12831
• Fix invalid ANSI SGR escape code in JSON and diff colorization by @BagToad in https://github.com/cli/cli/pull/12720
• Fix assignees databaseId always being 0 in --json output by @srt32 in https://github.com/cli/cli/pull/12783
• Fix error when --remote flag used with repo argument by @majiayu000 in https://github.com/cli/cli/pull/12375
• Fix redundant API call in gh issue view --comments by @VishnuVV27 in https://github.com/cli/cli/pull/12652
• Clarify scope error while creating issues for projects by @elijahthis in https://github.com/cli/cli/pull/12596
• Reject pull request-only search qualifiers in gh issue list by @LouisLau-art in https://github.com/cli/cli/pull/12623
• Prevent .git/config corruption on repeated issue develop --name invocation by @gunadhya in https://github.com/cli/cli/pull/12651
• Use pre-compiled regexp for matching Content-Type by @itchyny in https://github.com/cli/cli/pull/12781
• Isolate generated licenses per platform (os/arch) by @babakks in https://github.com/cli/cli/pull/12774

📚 Docs & Chores

• Add examples to gh issue close help text by @BagToad in https://github.com/cli/cli/pull/12830
• Customizable install prefix in Makefile by @scarf005 in https://github.com/cli/cli/pull/11714
• Deduplicate scope error handling between api/client.go and project queries by @yuvrajangadsingh in https://github.com/cli/cli/pull/12845
• Remove unnecessary StateReason and StateReasonDuplicate feature detection by @BagToad in https://github.com/cli/cli/pull/12838
• Update Go version requirement to 1.26+ by @BagToad in https://github.com/cli/cli/pull/12864
• Add monthly pitch surfacing workflow by @tidy-dev in https://github.com/cli/cli/pull/12894

:dependabot: Dependencies

• Bump Go from 1.25.7 to 1.26.1 by @BagToad in https://github.com/cli/cli/pull/12860
• chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12886
• chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.2 by @dependabot[bot] in https://github.com/cli/cli/pull/12851
• chore(deps): bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible by @dependabot[bot] in https://github.com/cli/cli/pull/12842
• chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12759
• chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12760
• chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in https://github.com/cli/cli/pull/12797
• chore(deps): bump actions/download-artifact from 7 to 8 by @dependabot[bot] in https://github.com/cli/cli/pull/12796
• chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12795
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.11 to 1.4.13 by @dependabot[bot] in https://github.com/cli/cli/pull/12615

New Contributors

• @srt32 made their first contribution in https://github.com/cli/cli/pull/12783
• @itchyny made their first contribution in https://github.com/cli/cli/pull/12781
• @VishnuVV27 made their first contribution in https://github.com/cli/cli/pull/12652
• @elijahthis made their first contribution in https://github.com/cli/cli/pull/12596
• @ManManavadaria made their first contribution in https://github.com/cli/cli/pull/12787
• @maxbeizer made their first contribution in https://github.com/cli/cli/pull/12806
• @LouisLau-art made their first contribution in https://github.com/cli/cli/pull/12623
• @4RH1T3CT0R7 made their first contribution in https://github.com/cli/cli/pull/12686
• @yuvrajangadsingh made their first contribution in https://github.com/cli/cli/pull/12657
• @masonmcelvain made their first contribution in https://github.com/cli/cli/pull/11486
• @scarf005 made their first contribution in https://github.com/cli/cli/pull/11714
• @tksohishi made their first contribution in https://github.com/cli/cli/pull/12811
• @tidy-dev made their first contribution in https://github.com/cli/cli/pull/12894

Full Changelog: https://github.com/cli/cli/compare/v2.87.3...v2.88.0

What's Changed

• Fix project mutation query variable usage by @williammartin in https://github.com/cli/cli/pull/12757

Full Changelog: https://github.com/cli/cli/compare/v2.87.2...v2.87.3

ℹ️ Note

This release was cut primarily to resolve a publishing issue. We recommend reviewing the v2.87.1 release notes for the complete set of latest features and fixes.

What's Changed

• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12659

Full Changelog: https://github.com/cli/cli/compare/v2.87.1...v2.87.2

⚠️ Incomplete Release

The v2.87.1 release experienced a failure in our workflow and is not fully published to the designated package managers/repositories. This is resolved in v2.87.2, so we recommend using that release instead.

What's Changed

• Remove license bundling debris by @williammartin in https://github.com/cli/cli/pull/12716
• fix(agent-task/capi): use a fixed CAPI API version by @babakks in https://github.com/cli/cli/pull/12731

Full Changelog: https://github.com/cli/cli/compare/v2.87.0...v2.87.1

gh workflow run immediately returns workflow run URL

One of our most requested features - with the latest changes in GitHub API, gh workflow run will immediately print the created workflow run URL.

Improved gh auth login experience in VM/WSL environments

We have observed rare cases of time drift between the wall and monotonic clocks, mostly in WSL or VM environments, causing failures during polling for the OAuth token. This new release implements measures to account for such situations.

If you continue to experience gh auth login issues in WSL, please comment in https://github.com/cli/cli/issues/9370

:copilot: Request Copilot Code Review from gh + performance improvements

gh pr edit now supports Copilot Code Review as a reviewer. You can request a review from Copilot using the --add-reviewer @copilot flag or interactively by selecting reviewers in the prompts.

This release also introduces a new search experience for selecting reviewers and assignees in gh pr edit. Instead of loading all collaborators and teams upfront, results are now fetched based on inputs to a new search option. Initial options are suggestions based on those involved with the pull request already.

? Reviewers  [Use arrows to move, space to select, <right> to all, <left> to none, type to filter]
  [ ]  Search (7472 more)
  [x]  BagToad (Kynan Ware)
> [x]  Copilot (AI)

This experience will follow in gh pr create and gh issue for assignees in a later release.

What's Changed

✨ Features

• Bundle licenses at release time by @williammartin in https://github.com/cli/cli/pull/12625
• Add --query flag to project item-list by @williammartin in https://github.com/cli/cli/pull/12696
• feat(workflow run): retrieve workflow dispatch run details by @babakks in https://github.com/cli/cli/pull/12695
• Pin REST API version to 2022-11-28 by @williammartin in https://github.com/cli/cli/pull/12680
• Respect --exit-status with --log and --log-failed in run view by @williammartin in https://github.com/cli/cli/pull/12679
• Fork with default branch only during pr create by @williammartin in https://github.com/cli/cli/pull/12673
• gh pr edit: Add support for Copilot as reviewer with search capability, performance and accessibility improvements by @BagToad in https://github.com/cli/cli/pull/12567
• gh pr edit: new interactive prompt for assignee selection, performance and accessibility improvements by @BagToad in https://github.com/cli/cli/pull/12526

📚 Docs & Chores

• Clean up project item-list query addition changes by @williammartin in https://github.com/cli/cli/pull/12714
• gh release upload: Clarify --clobber flag deletes assets before re-uploading by @BagToad in https://github.com/cli/cli/pull/12711
• Add usage examples to gh gist edit command by @BagToad in https://github.com/cli/cli/pull/12710
• Remove feedback issue template by @BagToad in https://github.com/cli/cli/pull/12708
• Migrate issue triage workflows to shared workflows by @BagToad in https://github.com/cli/cli/pull/12677
• Migrate PR triage workflows to shared workflows by @BagToad in https://github.com/cli/cli/pull/12707
• Add missing TODO comments for featuredetection if-statements by @BagToad in https://github.com/cli/cli/pull/12701
• Add manual dispatch to bump-go workflow by @BagToad in https://github.com/cli/cli/pull/12631
• typo: dont to don't by @cuiweixie in https://github.com/cli/cli/pull/12554
• Fix fmt.Errorf format argument in ParseFullReference by @mikelolasagasti in https://github.com/cli/cli/pull/12516
• Lint source.md by @Sethispr in https://github.com/cli/cli/pull/12521

:dependabot: Dependencies

• chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12468
• chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12616
• Bump go to 1.25.7 by @BagToad in https://github.com/cli/cli/pull/12630
• chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12629
• chore: bump cli/oauth to v1.2.2 by @babakks in https://github.com/cli/cli/pull/12573
• update Go to 1.25.6 by @BagToad in https://github.com/cli/cli/pull/12580
• chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12558
• chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12524
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12555
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.4 to 2.13.7 by @dependabot[bot] in https://github.com/cli/cli/pull/12469
• chore(deps): bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 by @dependabot[bot] in https://github.com/cli/cli/pull/12525
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12515
• chore(deps): bump actions/download-artifact from 6 to 7 by @dependabot[bot] in https://github.com/cli/cli/pull/12314
• chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in https://github.com/cli/cli/pull/12315
• chore(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.4.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12354

New Contributors

• @Sethispr made their first contribution in https://github.com/cli/cli/pull/12521
• @cuiweixie made their first contribution in https://github.com/cli/cli/pull/12554

Full Changelog: https://github.com/cli/cli/compare/v2.86.0...v2.87.0

:copilot: Install and run GitHub Copilot CLI directly from gh

Since we deprecated the GitHub Copilot in the CLI extension in favor of the new agentic GitHub Copilot CLI, we want to give developers using gh a simple way to get started using our most powerful terminal assistant.

• gh copilot will prompt to install, then run Copilot CLI
• gh copilot <args> will execute the Copilot CLI, forwarding any arguments and flags

For more information and usage options, run gh copilot --help.

What's Changed

✨ Features

• gh copilot: add native copilot command to execute/install copilot cli by @devm33 in https://github.com/cli/cli/pull/12444
• gh cache delete: allow for delete all caches for a ref by @davidspek in https://github.com/cli/cli/pull/12101
• gh pr create: error when head and base refs are identical in pr create by @majiayu000 in https://github.com/cli/cli/pull/12376

📚 Docs & Chores

• Fix Windows asset URL in copilot command tests by @babakks in https://github.com/cli/cli/pull/12500
• Update contributing guidelines for clarity by @BagToad in https://github.com/cli/cli/pull/12505

New Contributors

• @devm33 made their first contribution in https://github.com/cli/cli/pull/12444
• @davidspek made their first contribution in https://github.com/cli/cli/pull/12101

Full Changelog: https://github.com/cli/cli/compare/v2.85.0...v2.86.0

What's Changed

✨ Features

• Add gh browse --actions flag by @rneatherway in https://github.com/cli/cli/pull/12091
• feat: allow git remote names in gh repo set-default by @majiayu000 in https://github.com/cli/cli/pull/12377

🐛 Fixes

• Fix Debian CLI package link in installation guide by @andyfeller in https://github.com/cli/cli/pull/12291
• fix: prevent panic when processing null project items by @chrishenzie in https://github.com/cli/cli/pull/12324

📚 Docs & Chores

• chore: upgrade to cli/oauth@v1.2.1 by @babakks in https://github.com/cli/cli/pull/12337
• ci: upgrade to GoReleaser v2 by @babakks in https://github.com/cli/cli/pull/12318
• CI: Update Azure Code Signing client to 1.0.95 by @BagToad in https://github.com/cli/cli/pull/12424
• CI: Update Azure Code Signing endpoint URL by @BagToad in https://github.com/cli/cli/pull/12425
• ci: tag per build job by @babakks in https://github.com/cli/cli/pull/12428
• CI: Add shell specification for temporary tag creation on Windows by @BagToad in https://github.com/cli/cli/pull/12429
• Bump sigstore-go to v1.1.4 by @williammartin in https://github.com/cli/cli/pull/12289
• Update actions/checkout to v6 in extension workflow templates by @fchimpan in https://github.com/cli/cli/pull/12393
• ci: enable noop linters by @babakks in https://github.com/cli/cli/pull/12440

:dependabot: Dependencies

• chore(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12274
• chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12281
• chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12282
• chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by @dependabot[bot] in https://github.com/cli/cli/pull/12255
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.1 to 2.13.2 by @dependabot[bot] in https://github.com/cli/cli/pull/12262
• chore(deps): bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12252
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.2 to 2.13.4 by @dependabot[bot] in https://github.com/cli/cli/pull/12302
• chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12300
• chore(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12339
• chore(deps): bump github.com/yuin/goldmark from 1.7.13 to 1.7.16 by @dependabot[bot] in https://github.com/cli/cli/pull/12452

New Contributors

• @chrishenzie made their first contribution in https://github.com/cli/cli/pull/12324
• @fchimpan made their first contribution in https://github.com/cli/cli/pull/12393
• @majiayu000 made their first contribution in https://github.com/cli/cli/pull/12377

Full Changelog: https://github.com/cli/cli/compare/v2.83.2...v2.85.0

What's Changed

🐛 Fixes

• Isolate user-provided search query from contextual qualifiers by @babakks in https://github.com/cli/cli/pull/12170

📚 Docs & Chores

• Refactor cfg out of CAPI Client by @williammartin in https://github.com/cli/cli/pull/12148
• Remove extra flag default from help usage by @andyfeller in https://github.com/cli/cli/pull/12154
• Add PGP key rotation PoC by @babakks in https://github.com/cli/cli/pull/12176
• Add Debian/Ubuntu to unofficial packages by @andyfeller in https://github.com/cli/cli/pull/12191
• Error if go-licenses is not on the PATH by @williammartin in https://github.com/cli/cli/pull/12238
• refactor: drop multierror in favor of std by @ferhatelmas in https://github.com/cli/cli/pull/12234

:dependabot: Dependencies

• chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12165
• chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/cli/cli/pull/12178
• chore(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 by @dependabot[bot] in https://github.com/cli/cli/pull/12037
• chore(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12189
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.2.0 to 2.3.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12100
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.10 to 1.4.11 by @dependabot[bot] in https://github.com/cli/cli/pull/12051
• chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.76.0 by @dependabot[bot] in https://github.com/cli/cli/pull/11972
• chore(deps): bump github.com/charmbracelet/huh from 0.7.0 to 0.8.0 by @dependabot[bot] in https://github.com/cli/cli/pull/11971
• Bump Go to 1.25.4 by @github-actions[bot] in https://github.com/cli/cli/pull/12104
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.9.0 to 2.13.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12246
• chore(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 by @dependabot[bot] in https://github.com/cli/cli/pull/12247
• chore(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7 by @dependabot[bot] in https://github.com/cli/cli/pull/12245
• Bump Go to 1.25.5 by @github-actions[bot] in https://github.com/cli/cli/pull/12250
• Bump dev-tunnels SDK 0.1.13 to 0.1.19 by @sam-byng in https://github.com/cli/cli/pull/12285

New Contributors

• @ferhatelmas made their first contribution in https://github.com/cli/cli/pull/12234
• @sam-byng made their first contribution in https://github.com/cli/cli/pull/12285

Full Changelog: https://github.com/cli/cli/compare/v2.83.1...v2.83.2