GitHub CLI Files

Security

A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default.

Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible.

For more information see: https://github.com/cli/cli/security/advisories/GHSA-vfhh-p7hm-pxfh

Support worktrees in pr checkout

Users can now checkout a pull request into a git worktree by using the new --worktree PATH flag in gh pr checkout:

:::shell
gh pr checkout 12 --worktree ../wt-feature

Add semantic search to search issues

The gh search issues command now supports semantic search for issues. Users can select the search type by passing the --search-type flag:

:::shell
gh search issues --search-type semantic ...

gh search issues --search-type hybrid ...

For more information about semantic search see: "Improved Search for github issues is now generally available".

What's Changed

✨ Features

• Add --worktree flag to gh pr checkout by @tidy-dev in https://github.com/cli/cli/pull/13946
• Set GH_EXTENSION=1 when gh invokes an extension by @williammartin in https://github.com/cli/cli/pull/14072
• Add --search-type flag for semantic and hybrid issue search by @michaeljacholke in https://github.com/cli/cli/pull/14006

🐛 Fixes

• Fix RESTWithNext error type, repairing gh status and attestation retries by @williammartin in https://github.com/cli/cli/pull/13988
• Trim spaces when parsing X-Oauth-Scopes in gh release create by @williammartin in https://github.com/cli/cli/pull/14065
• Fix project item-add output for non-TTY by @zwick in https://github.com/cli/cli/pull/14056

📚 Docs & Chores

• Slim down dependabot triage comments by @williammartin in https://github.com/cli/cli/pull/14019
• Require explicit PR review ownership by @williammartin in https://github.com/cli/cli/pull/14028
• Collapse spam triage into the agentic issue-triage workflow by @williammartin in https://github.com/cli/cli/pull/14027
• Run Dependabot triage every hour by @sergiou87 in https://github.com/cli/cli/pull/14030
• Route deploy key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13989
• Route ssh key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13994
• Route gpg key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13997
• Route autolink requests through api.Client by @williammartin in https://github.com/cli/cli/pull/14013
• Route extension requests through api.Client by @williammartin in https://github.com/cli/cli/pull/14059
• Route release creation through api.Client by @williammartin in https://github.com/cli/cli/pull/14062
• Tell agents to use the PR template in AGENTS.md by @williammartin in https://github.com/cli/cli/pull/14074
• Make Dependabot triage cheaper and more decisive by @williammartin in https://github.com/cli/cli/pull/14079
• Route release deletions through api.Client by @williammartin in https://github.com/cli/cli/pull/14077
• Give Dependabot triage a real reachability check by @williammartin in https://github.com/cli/cli/pull/14087
• Restore automatic spam issue closure by @williammartin in https://github.com/cli/cli/pull/14088
• Add a scheduled tech debt burndown skill by @williammartin in https://github.com/cli/cli/pull/14095
• Use reflect.Pointer instead of deprecated reflect.Ptr by @williammartin in https://github.com/cli/cli/pull/14098
• Clarify what belongs in the PR template's testing section by @williammartin in https://github.com/cli/cli/pull/14103
• Rename cli-code-reviewer skill to code-review by @BagToad in https://github.com/cli/cli/pull/14116
• Add aw-actions group to dependabot configuration by @babakks in https://github.com/cli/cli/pull/14123
• Isolate tests from local machine's auth and git configuration by @BagToad in https://github.com/cli/cli/pull/14128
• Don't ask for feature detection cleanup comments when not needed by @babakks in https://github.com/cli/cli/pull/14139
• Accept pre-release tags in deployment validation by @BagToad in https://github.com/cli/cli/pull/14193
• ci: add temporary step to verify Linux repo signing keys by @babakks in https://github.com/cli/cli/pull/14202
• Revert "ci: add temporary step to verify Linux repo signing keys" by @babakks in https://github.com/cli/cli/pull/14203
• Fix issue triage action compatibility [skip changelog] by @tidy-dev in https://github.com/cli/cli/pull/14207

:dependabot: Dependencies

• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14047
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14049
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14048
• chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in https://github.com/cli/cli/pull/14066
• chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14100
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14101
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14091
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by @dependabot[bot] in https://github.com/cli/cli/pull/14068
• chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in https://github.com/cli/cli/pull/14119
• chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14120
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14147
• chore: sign APT repository with both keys by @babakks in https://github.com/cli/cli/pull/13271
• chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by @dependabot[bot] in https://github.com/cli/cli/pull/14029
• chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14050
• Bump golangci-lint in CI to v2.12.2 by @williammartin in https://github.com/cli/cli/pull/14102
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14124
• chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in https://github.com/cli/cli/pull/14140
• Upgrade gh-aw workflows to v0.85.4 by @tidy-dev in https://github.com/cli/cli/pull/14141
• Bump Go to 1.26.6 by @github-actions[bot] in https://github.com/cli/cli/pull/14143
• chore: bump go to 1.26.7 by @babakks in https://github.com/cli/cli/pull/14205
• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14204
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14169
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14164
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/14166
• Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by @BagToad in https://github.com/cli/cli/pull/14210

New Contributors

• @sergiou87 made their first contribution in https://github.com/cli/cli/pull/14030
• @michaeljacholke made their first contribution in https://github.com/cli/cli/pull/14006

Full Changelog: https://github.com/cli/cli/compare/v2.97.0...v2.98.0