npx @buildinternet/releases get github-cliFixes four vulnerabilities: gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to unintended local files via symlinks, while gh attestation verify matched --source-ref case-insensitively and validated --signer-workflow against only the start of the certificate identity, and interactive gh skill search could inject installer options into gh skill install. Users are advised to update to v2.102.0 as soon as possible.
The APT and RPM repositories and individual RPM packages are now signed only with a new PGP key, so Linux users who installed from the official repos before April 8, 2026 and haven't refreshed their keyring may see install or update failures. gh auth login and gh auth refresh now copy OAuth device codes to the clipboard by default, opt out with gh config set clipboard disabled.
Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host config, settable via gh config set api_host. The original host remains in use for authentication, Git remotes, and browser URLs; the feature is experimental and not a security boundary. Also added the webhook extension and telemetry fixes for unauthenticated GHES requests.
The repeatable --attach flag uploads local images and videos and adds them to issue, pull request, or comment bodies, replacing local file paths with uploaded URLs. gh issue develop can now create a linked branch and check it out in a new Git worktree with --checkout --worktree, leaving your current working copy unchanged. Plus fixes for repo sync, PR merge, and worktree handling.
Fixed a security vulnerability where gh codespace ports forward bound the forwarded port to all network interfaces by default; users are advised to update immediately. gh pr checkout now supports a --worktree PATH flag, and gh search issues gains semantic and hybrid --search-type options.
Four security vulnerabilities are fixed, including terminal escape sequence injection across multiple commands and a potential auth token leak in gh auth status. Project fields and single-select options can now be referenced by name in gh project item-edit and gh project item-list.
A critical vulnerability in gh codespace jupyter that could allow command execution from a malicious Codespace is fixed — users should update immediately. gh release download now works on public repositories without authentication.
Two new preview commands, gh repo read-file and gh repo read-dir, read repository contents directly from GitHub without cloning. Both support --ref, --json, --jq, and --template for scripting, and default to the repository's default branch.
The GitHub CLI now supports managing issue types, sub-issues, and relationships with gh issue commands, and introduces a new preview gh discussion command set for managing GitHub Discussions. Also added gh skill list and the ability to auto-install official extensions in CI.
A security vulnerability that incorrectly included authorization headers in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands has been fixed. The gh secret command set can now set agent secrets. Also fixed a PR API validation optimization that was skipped and improved digest algorithm derivation in release verify commands.
skill commandsetNow gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts…
To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudoanonymous telemetry.
See Telemetry for more details on what's…
gh skill (Public Preview)Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install,…
gh agent-task now works on ghe.com tenanciesgh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works…
pr commands failing with read:project scope errorv2.88.0 introduced a regression where pr commands would fail with the error:
error: your authentication token is missing required scopes [read:project]
To request it, run: gh auth refresh -s…ghgh pr create and gh pr edit now support [Copilot Code…
Full Changelog: https://github.com/cli/cli/compare/v2.87.2...v2.87.3
This release was cut primarily to resolve a publishing issue. We recommend reviewing the v2.87.1 release notes for the complete set of latest features and fixes.
The v2.87.1 release experienced a failure in our workflow and is not fully published to the designated package managers/repositories. This is resolved in v2.87.2, so we recommend using that release…
gh workflow run immediately returns workflow run URLOne of our most requested features - with the latest changes in GitHub API, gh workflow run will immediately print the created workflow run URL.
gh auth login experience in VM/WSL environmentsWe…
