releases.shpreview
GitHubGitHub/GitHub CLI

Four security fixes; project fields can now be referenced by name

v2.97.0

July 31, 2026GitHub CLIView original ↗
2 features4 fixesThis release2 featuresNew capabilities4 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features

🐛 Fixes

  • Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @malancas in #13624
  • Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @kofuk in #13787
  • Fix skill picker label wrapping by @tommaso-moro in #13967

📚 Docs & Chores

:dependabot: Dependencies

New Contributors

Full Changelog: https://github.com/cli/cli/compare/v2.96.0...v2.97.0

Fetched July 31, 2026