Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible. gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links. See GHSA-39wj-f2f4-978v for more informatio…
Linux package repository signing key rotation GitHub CLI's APT and RPM repositories, along with individual RPM packages, are now signed only with the new PGP key (fingerprint: 7F38BBB59D064DBCB3D84D725612B36462313325) ImportantLinux users who installed gh from the official APT or RPM repositories before April 8, 2026, and have not refreshed their keyring, may now see package installation or update…
Experimental: Route GitHub API traffic through a custom host Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration: # Route API traffic for github.com through a gateway gh config set api_host gh-gateway.example.com --host github.com # Read the configured API host gh config get api_host --host github.com The original host remains in…
Attach images and videos to issues and pull requests The repeatable --attach flag uploads local images and videos and adds them to issue, pull request, or comment bodies. If a body already references the local path, gh replaces it with the uploaded URL; otherwise it appends the attachment: # Attach files when creating or editing an issue gh issue create --attach './repro.png#The error state' gh is…
Security A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default. Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible. For more information see: GHSA-vfhh-p7hm-pxfh Support worktrees in pr checkout Users can now checkout a pull request into a git worktree by using the…
Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible. Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape se…
Security A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter. Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible. For more information see: GHSA-8cg3-r6g9-fpg2 Download release assets without authentication gh release download now…
Read repository files and directories with gh repo read-file and gh repo read-dir Two new preview commands read repository contents without cloning: # Read a single file to stdout gh repo read-file README.md --repo cli/cli # Read from a specific branch, tag, or commit gh repo read-file go.mod --ref v2.94.0 --repo cli/cli # Write a file to disk (use --clobber to overwrite) gh repo read-file README.…
Issue types, sub-issues, and relationships in gh issue This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line: # Set an issue's type gh issue create --type Bug gh issue edit 123 --type Bug # Organize work with…
Security A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. Users are advised to update gh to version v2.93.0 as soon as possible. For more information see: GHSA-8xvp-7hj6-mcj9 Support agents in gh secret command set The gh…
GitHub CLI now collects pseudonymous telemetry To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry. See Telemetry for more details on what's collected, why, and how to opt out. Support more agents in gh skill Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help…
Security A security vulnerability has been identified, and fixed, that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. Users are advised to update gh to version v2.92.0 as soon as possible. For more information see: GHSA-crc3-h8v6-qh57 Support GitHub Enterprise Cloud (GHEC) in skill commandset Now gh s…
Manage agent skills with gh skill (Public Preview) Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI. # Discover skills gh skill search copilot # Preview a skill without installing…
gh agent-task now works on ghe.com tenancies gh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works correctly regardless of your GitHub hosting environment. Experimental new prompter A new TUI-based prompter powered by charmbracelet/huh is avail…
Fix pr commands failing with read:project scope error v2.88.0 introduced a regression where pr commands would fail with the error: error: your authentication token is missing required scopes [read:project] To request it, run: gh auth refresh -s read:project Previously, missing read:project scope was gracefully handled, and project data was silently skipped. A change inadvertently broke the error m…
Request Copilot Code Review from gh gh pr create and gh pr edit now support Copilot Code Review as a reviewer. Request a review with --add-reviewer @copilot, or select Copilot interactively from the searchable reviewer prompt. Create a pull request and request review from Copilot: gh pr create --reviewer @copilot Edit a pull request and request review from Copilot: gh pr edit --add-reviewer @copil…
What's Changed Fix project mutation query variable usage by @williammartin in #12757 Full Changelog: v2.87.2...v2.87.3