Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features

• Allow gh release download without authentication on public repositories by @BagToad in #13723
• Detect additional third-party coding agents by @BagToad in #13722
• Support antigravity-cli and antigravity2.0 in gh skill by @BagToad in #13784

🐛 Fixes

• fix: show checks summary when all checks were cancelled by @s3onghyun in #13679
• fix(skills): install universal agent to ~/.agents/skills by @toller892 in #13681
• fix(skills): honor --dir without agent prompt by @happysnaker in #13766
• Fix concurrent map writes in codespace port forwarding by @williammartin in #13313
• Use int64 for GitHub database IDs by @williammartin in #13403

📚 Docs & Chores

• Pin reusable triage workflows to a commit SHA by @BagToad in #13705
• Add security disclosure guidance to AGENTS.md by @BagToad in #13720
• Clarify --clone boolean flag behaviour in gh repo fork help by @BagToad in #13786
• Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @pdostal in #13675
• docs(search): add examples for multiple qualifiers by @happysnaker in #13756
• docs: fix broken anchor link in release-process-deep-dive by @patrickwehbe in #13688
• docs: fix broken install command and link/grammar errors by @patrickwehbe in #13690
• docs: fix duplicated word in primer README by @s3onghyun in #13677

Dependencies

• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @dependabot in #13708
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #13703
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot in #13702
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #13740
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot in #13754
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot in #13759
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #13779

New Contributors

• @patrickwehbe made their first contribution in #13688
• @s3onghyun made their first contribution in #13679
• @toller892 made their first contribution in #13681
• @happysnaker made their first contribution in #13756

Full Changelog: v2.95.0...v2.96.0