Skip to content

Update gh to 2.97.0 - #546

Merged
twitchyliquid64 merged 1 commit into
mainfrom
update-gh-2.97.0
Jul 31, 2026
Merged

Update gh to 2.97.0#546
twitchyliquid64 merged 1 commit into
mainfrom
update-gh-2.97.0

Conversation

@gominimal-pkgmgr-mgr

Copy link
Copy Markdown
Contributor

Update gh 2.96.02.97.0

Source: github:cli/cli
Release: https://github.com/cli/cli/releases/tag/v2.97.0
Changelog: cli/cli@v2.96.0...v2.97.0
Released: 14 hours ago (2026-07-31)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 2.97.0 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 4 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (4)

This update clears 4 vulnerabilities affecting 2.96.0:

CVE / GHSA Severity Fixed in
GHSA-3m3g-3wcr-px46 MEDIUM via range: <= 2.96.0
GHSA-4fjg-2h4q-fwg3 LOW via range: <= 2.96.0
GHSA-cg6r-mpgc-h9mm LOW via range: <= 2.96.0
GHSA-mm27-mwq9-fr5g LOW via range: <= 2.96.0
Advisory summaries
  • GHSA-3m3g-3wcr-px46 — Terminal escape sequence injection in multiple gh commands (Published 2026-07-31)
  • GHSA-4fjg-2h4q-fwg3 — Unescaped variable components in request URLs could allow path traversal in GitHub CLI (Published 2026-07-31)
  • GHSA-cg6r-mpgc-h9mm — Partial token disclosure in gh auth status output (Published 2026-07-31)
  • GHSA-mm27-mwq9-fr5g — Attestation verification bypass via unescaped regex metacharacters in SAN matching (Published 2026-07-31)

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ gh 2.96.0 2.97.0
~ gh-upstream 2.96.0 2.97.0

Changes

Old New
Version 2.96.0 2.97.0
SHA256 8d80d0aeccea7bec... 18cd1280f70911c9...
Size 14.8 MB 14.9 MB
Source gs://minimal-staging-archives/cli/cli/v2.96.0.tar.gz gs://minimal-staging-archives/cli/cli/v2.97.0.tar.gz
  • License: MIT (source: GitHub + tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@twitchyliquid64
twitchyliquid64 added this pull request to the merge queue Jul 31, 2026
Merged via the queue into main with commit f857c10 Jul 31, 2026
9 checks passed
@twitchyliquid64
twitchyliquid64 deleted the update-gh-2.97.0 branch July 31, 2026 22:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant