openSUSE-SU-2026:21663-1

This update for gh fixes the following issues:

Changes in gh:

• Update to version 2.98.0:

  • chore: fix extra whitespace
  • Default Codespaces port forwarding to loopback
  • Bump gh-aw-actions to v0.87.1 and recompile workflows
  • Fix issue triage action compatibility
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
  • chore: bump go to 1.26.7 (#14205)
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1
  • Revert "ci: add temporary step to verify Linux repo signing keys"
  • ci: add temporary step to verify Linux repo signing keys
  • Accept pre-release tags in deployment validation (#14193)
  • chore: sign APT repositories with both keys
  • chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6
  • chore(deps): bump the aw-actions group with 2 updates
  • chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
  • Bump Go to 1.26.6
  • Upgrade gh-aw workflows to v0.85.4
  • chore(deps): bump github.com/google/go-containerregistry
  • chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
  • Address review: drop cleanup markers, document search-type in skill
  • Reconcile feature detection cleanup comment rules in AGENTS.md
  • Update AGENTS.md with cleanup comment guidance
  • Address review feedback
  • Add --search-type flag for semantic and hybrid issue search
  • Rename config mock constructors to match repo convention
  • Document when to use the config mock or the isolated config
  • Accept config content in NewIsolatedTestConfig
  • Clear auth environment variables in isolated test config
  • Isolate git config in tests that shell out to git
  • Rename config stub file to test.go
  • chore(deps): bump the aw-actions group with 2 updates
  • Add aw-actions group to dependabot configuration
  • Rename cli-code-reviewer skill to code-review (#14116)
  • chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4
  • Reduce item-add test diff
  • Isolate item-add test mocks
  • Test item-add output through command path
  • Run lint workflow when the lint workflow changes
  • Bump golangci-lint in CI to v2.12.2
  • Clarify PR testing section expectations
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • chore(deps): bump azure/login from 3.0.0 to 3.0.1
  • chore(deps): bump actions/attest from 4.2.1 to 4.2.2
  • Use reflect.Pointer instead of deprecated reflect.Ptr
  • Add a scheduled tech debt burndown skill (#14095)
  • Restore automatic spam issue closure (#14088)
  • Give Dependabot triage a real reachability check (#14087)
  • Route release deletions through api.Client (#14077)
  • chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0
  • chore(deps): bump github.com/google/go-containerregistry
  • Grant the gate the scopes its CI read needs
  • Keep pre-flight dedup out of the integrity proxy
  • Key direct/indirect off the // indirect comment
  • Gate triager confidence on required evidence
  • Gate Dependabot triage on deterministic pre-flight check
  • Set GH_EXTENSION=1 when gh invokes an extension
  • Tell agents to use the PR template in AGENTS.md
  • Merge pull request #14062 from cli/williammartin-wp-08-release-create
  • Route extension requests through api.Client (#14059)
  • Route autolink requests through api.Client (#14013)
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • fix(release create): trim spaces when parsing X-Oauth-Scopes
  • Match worktree rev-parse stub against absolute path on Windows
  • fix(pr/checkout): pass -- before worktree path so dash paths work
  • docs(pr/checkout): add worktree usage example to help text
  • docs(skills): mention pr checkout worktree support
  • chore(pr checkout): polish worktree related tests
  • Route gpg key requests through api.Client (#13997)
  • Use generated key in ssh-key acceptance test
  • Route ssh key requests through api.Client
  • Fix item-add output for non-TTY
  • test(pr/checkout): add acceptance tests for worktree checkout
  • chore(deps): bump actions/attest from 4.2.0 to 4.2.1
  • chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0
  • Generate unique acceptance SSH keys
  • Route deploy key requests through api.Client
  • Collapse spam triage into the agentic issue-triage workflow (#14027)
  • Run Dependabot triage hourly
  • chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5
  • Require explicit PR review ownership (#14028)
  • Slim down dependabot triage comments (#14019)
  • Wrap RESTWithNext errors as api.HTTPError
  • Bail out early on unusable --worktree paths
  • Clarify current-worktree rejection message
  • Return ok bool from revParseFacts to satisfy nilerr
  • Drop docs on self-explanatory worktree helpers
  • Trim redundant comments and clarify worktree field names
  • Resolve worktree target once instead of re-querying git
  • Fix worktree toplevel stub to match Windows absolute paths
  • Detect worktrees via git rev-parse and reject the current worktree
  • Address review: restore TODO, flatten detachCmds, guard worktree symlink
  • Cover detach-reuse, worktree fetch dir, and symlink path resolution
  • Harden worktree submodule prefixing and cover cmd.Dir stripping
  • Create branch when reusing a worktree with a new --branch name
  • Extract authenticatedCommand helper to dedupe -C handling
  • Preserve no-force safety when reusing a worktree for fork PRs
  • Simplify submodule worktree prefix to inline conditional
  • Run submodule commands inside the worktree for pr checkout
  • tidying..
  • Refine PR checkout worktree flag help
  • Add --worktree flag to gh pr checkout

• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266618).

• Update to version 2.97.0, fixing four security issues (CVE-2026-64654, bsc#1276662, CVE-2026-64653, bsc#1276664, CVE-2026-64652, bsc#1276663, CVE-2026-64655, bsc#1276661):

  • CVE-2026-64654: terminal escape sequence injection in gist view, api, pr diff, release download --output -, codespace logs, skills preview and agent-task view/create
  • CVE-2026-64653: unescaped variable path components in request URLs could redirect gh to a different resource than intended
  • CVE-2026-64652: gh auth status could print part of the auth token in plaintext for token types with an underscore after the prefix
  • CVE-2026-64655: gh attestation verify built its --signer-repo/ --signer-workflow matcher without escaping regex metacharacters, allowing a lookalike signer to pass verification
  • Add named field columns to gh project item-list and item-edit