{"id":"CVE-2026-64655","aliases":["AZL-95472","DEBIAN-CVE-2026-64655","EUVD-2026-54222","GHSA-mm27-mwq9-fr5g","GO-2026-6767","UBUNTU-CVE-2026-64655","openSUSE-SU-2026:11530-1","openSUSE-SU-2026:21663-1"],"status":"published","title":"GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00343,"percentile":0.28079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185"],"published":"2026-08-06T18:41:54Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"Go","package":"github.com/cli/cli/v2","fixed_in":["2.97.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.97.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0+dfsg1-1","2.24.3+dfsg1-1","2.27.0+dfsg1-1","2.30.0-1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.46.0-1","2.46.0-2","2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0+dfsg1-1","2.4.0+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2","2.45.0-1ubuntu0.2+esm1","2.45.0-1ubuntu0.2+esm2","2.45.0-1ubuntu0.3","2.45.0-1ubuntu0.3+esm1","2.45.0-1ubuntu0.3+esm2","2.45.0-1ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4","2.46.0-4ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.98.0-bp160.1.1"}]}],"bundled":5}],"products":[{"vendor":"cli","product":"cli"}],"references":[{"url":"https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/cli/cli/releases/tag/v2.97.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64655","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mm27-mwq9-fr5g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64655.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64655","tags":["advisory"]},{"url":"https://github.com/cli/cli","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-64655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64655","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64655","tags":["web"]},{"url":"https://bugzilla.suse.com/1266618","tags":["report"]},{"url":"https://bugzilla.suse.com/1276661","tags":["report"]},{"url":"https://bugzilla.suse.com/1276662","tags":["report"]},{"url":"https://bugzilla.suse.com/1276663","tags":["report"]},{"url":"https://bugzilla.suse.com/1276664","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64655","title":"GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T18:41:54.628Z","modified":"2026-08-08T02:23:17.134Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-54222","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T18:41:54Z","modified":"2026-08-08T02:23:17Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-mm27-mwq9-fr5g","title":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters","description":"### Summary\n\nA security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using `gh attestation verify` with `--signer-repo` or `--signer-workflow` flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacters, so a repository or workflow name is treated as a regular expression rather than a literal string. GitHub permits characters such as  `.`  in organization, repository, and workflow path names, and  `.`  is a regex wildcard, so a malicious actor can create a lookalike name that satisfies a matcher intended for a different, trusted signer.\n\n### Details\n\nGitHub CLI constructs a regular expression from the  `--signer-repo`  and  `--signer-workflow`  values and matches it against the signing certificate's SAN (Subject Alternative Name) during Sigstore attestation verification. The user-supplied value is interpolated into the pattern without escaping regex metacharacters, so any metacharacter permitted in a GitHub path is interpreted as regex syntax instead of a literal character.\n\nThe most practical case is  `.` , which GitHub allows in org/repo names and is a regex wildcard meaning \"any single character.\" For example, an attacker-controlled repository named:\n\n`github/artifact.attestations-workflows`\n\nmatches a verifier configured for the trusted signer:\n\n`github/artifact-attestations-workflows`\n\nbecause the unescaped  `.`  in the constructed pattern matches the  `-`  in the attacker's name (and any other single character at that position). This affected the `--signer-repo` and `--signer-workflow` flags but did not affect the `--repo` and `--owner` flags which include an exact string comparison.\n\nIn `v2.97.0`, the GitHub CLI escapes the user-supplied signer values before they are incorporated into the SAN matcher, so they are matched as literal strings.\n\n### Impact\n\nThe practical impact is limited, exploitation requires the attacker to create a plausible lookalike repository name and produce valid Sigstore attestations from it. This could undermine supply chain verification for CI/CD pipelines or policy gates that use these flags to pin trust to a specific signing workflow. \n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `v2.97.0` or later, which escapes signer values before matching.\n2. As a workaround, use `--repo` or `--owner` flags instead of `--signer-repo` or `--signer-workflow` where applicable.\n3. Manually inspect the signing certificate SAN in attestation output to confirm the signing workflow origin.","status":"published","published":"2026-10-15T18:08:20Z","modified":"2026-10-15T18:08:23Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-64655","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13.527Z","modified":"2026-09-10T20:36:14.34Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-64655","title":"GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T18:41:54.628Z","modified":"2026-10-28T02:31:10.452759283Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"DEBIAN-CVE-2026-64655","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13.527Z","modified":"2026-10-01T03:03:38.316113487Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"GHSA-mm27-mwq9-fr5g","title":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters","description":"### Summary\n\nA security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using `gh attestation verify` with `--signer-repo` or `--signer-workflow` flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacters, so a repository or workflow name is treated as a regular expression rather than a literal string. GitHub permits characters such as  `.`  in organization, repository, and workflow path names, and  `.`  is a regex wildcard, so a malicious actor can create a lookalike name that satisfies a matcher intended for a different, trusted signer.\n\n### Details\n\nGitHub CLI constructs a regular expression from the  `--signer-repo`  and  `--signer-workflow`  values and matches it against the signing certificate's SAN (Subject Alternative Name) during Sigstore attestation verification. The user-supplied value is interpolated into the pattern without escaping regex metacharacters, so any metacharacter permitted in a GitHub path is interpreted as regex syntax instead of a literal character.\n\nThe most practical case is  `.` , which GitHub allows in org/repo names and is a regex wildcard meaning \"any single character.\" For example, an attacker-controlled repository named:\n\n`github/artifact.attestations-workflows`\n\nmatches a verifier configured for the trusted signer:\n\n`github/artifact-attestations-workflows`\n\nbecause the unescaped  `.`  in the constructed pattern matches the  `-`  in the attacker's name (and any other single character at that position). This affected the `--signer-repo` and `--signer-workflow` flags but did not affect the `--repo` and `--owner` flags which include an exact string comparison.\n\nIn `v2.97.0`, the GitHub CLI escapes the user-supplied signer values before they are incorporated into the SAN matcher, so they are matched as literal strings.\n\n### Impact\n\nThe practical impact is limited, exploitation requires the attacker to create a plausible lookalike repository name and produce valid Sigstore attestations from it. This could undermine supply chain verification for CI/CD pipelines or policy gates that use these flags to pin trust to a specific signing workflow. \n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `v2.97.0` or later, which escapes signer values before matching.\n2. As a workaround, use `--repo` or `--owner` flags instead of `--signer-repo` or `--signer-workflow` where applicable.\n3. Manually inspect the signing certificate SAN in attestation output to confirm the signing workflow origin.","status":"published","published":"2026-10-15T18:08:20Z","modified":"2026-10-19T21:41:04.715150068Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"UBUNTU-CVE-2026-64655","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:00Z","modified":"2026-10-17T12:59:17.133117315Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"AZL-95472","title":"CVE-2026-64655 affecting package gh for versions less than 2.97.0-1","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13Z","modified":"2026-09-10T14:16:46.727013298Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"GO-2026-6767","title":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli","description":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli","status":"published","published":"2026-10-19T21:08:35Z","modified":"2026-10-19T21:31:49.979387869Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:11530-1","title":"gh-2.97.0-1.1 on GA media","description":"These are all security issues fixed in the gh-2.97.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-18T09:30:04.589760252Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21663-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.98.0:\n  * chore: fix extra whitespace\n  * Default Codespaces port forwarding to loopback\n  * Bump gh-aw-actions to v0.87.1 and recompile workflows\n  * Fix issue triage action compatibility\n  * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0\n  * chore: bump go to 1.26.7 (#14205)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1\n  * Revert \"ci: add temporary step to verify Linux repo signing keys\"\n  * ci: add temporary step to verify Linux repo signing keys\n  * Accept pre-release tags in deployment validation (#14193)\n  * chore: sign APT repositories with both keys\n  * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6\n  * chore(deps): bump the aw-actions group with 2 updates\n  * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2\n  * Bump Go to 1.26.6\n  * Upgrade gh-aw workflows to v0.85.4\n  * chore(deps): bump github.com/google/go-containerregistry\n  * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12\n  * Address review: drop cleanup markers, document search-type in skill\n  * Reconcile feature detection cleanup comment rules in AGENTS.md\n  * Update AGENTS.md with cleanup comment guidance\n  * Address review feedback\n  * Add --search-type flag for semantic and hybrid issue search\n  * Rename config mock constructors to match repo convention\n  * Document when to use the config mock or the isolated config\n  * Accept config content in NewIsolatedTestConfig\n  * Clear auth environment variables in isolated test config\n  * Isolate git config in tests that shell out to git\n  * Rename config stub file to test.go\n  * chore(deps): bump the aw-actions group with 2 updates\n  * Add aw-actions group to dependabot configuration\n  * Rename cli-code-reviewer skill to code-review (#14116)\n  * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4\n  * Reduce item-add test diff\n  * Isolate item-add test mocks\n  * Test item-add output through command path\n  * Run lint workflow when the lint workflow changes\n  * Bump golangci-lint in CI to v2.12.2\n  * Clarify PR testing section expectations\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump azure/login from 3.0.0 to 3.0.1\n  * chore(deps): bump actions/attest from 4.2.1 to 4.2.2\n  * Use reflect.Pointer instead of deprecated reflect.Ptr\n  * Add a scheduled tech debt burndown skill (#14095)\n  * Restore automatic spam issue closure (#14088)\n  * Give Dependabot triage a real reachability check (#14087)\n  * Route release deletions through api.Client (#14077)\n  * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0\n  * chore(deps): bump github.com/google/go-containerregistry\n  * Grant the gate the scopes its CI read needs\n  * Keep pre-flight dedup out of the integrity proxy\n  * Key direct/indirect off the // indirect comment\n  * Gate triager confidence on required evidence\n  * Gate Dependabot triage on deterministic pre-flight check\n  * Set GH_EXTENSION=1 when gh invokes an extension\n  * Tell agents to use the PR template in AGENTS.md\n  * Merge pull request #14062 from cli/williammartin-wp-08-release-create\n  * Route extension requests through api.Client (#14059)\n  * Route autolink requests through api.Client (#14013)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * fix(release create): trim spaces when parsing X-Oauth-Scopes\n  * Match worktree rev-parse stub against absolute path on Windows\n  * fix(pr/checkout): pass -- before worktree path so dash paths work\n  * docs(pr/checkout): add worktree usage example to help text\n  * docs(skills): mention pr checkout worktree support\n  * chore(pr checkout): polish worktree related tests\n  * Route gpg key requests through api.Client (#13997)\n  * Use generated key in ssh-key acceptance test\n  * Route ssh key requests through api.Client\n  * Fix item-add output for non-TTY\n  * test(pr/checkout): add acceptance tests for worktree checkout\n  * chore(deps): bump actions/attest from 4.2.0 to 4.2.1\n  * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0\n  * Generate unique acceptance SSH keys\n  * Route deploy key requests through api.Client\n  * Collapse spam triage into the agentic issue-triage workflow (#14027)\n  * Run Dependabot triage hourly\n  * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5\n  * Require explicit PR review ownership (#14028)\n  * Slim down dependabot triage comments (#14019)\n  * Wrap RESTWithNext errors as api.HTTPError\n  * Bail out early on unusable --worktree paths\n  * Clarify current-worktree rejection message\n  * Return ok bool from revParseFacts to satisfy nilerr\n  * Drop docs on self-explanatory worktree helpers\n  * Trim redundant comments and clarify worktree field names\n  * Resolve worktree target once instead of re-querying git\n  * Fix worktree toplevel stub to match Windows absolute paths\n  * Detect worktrees via git rev-parse and reject the current worktree\n  * Address review: restore TODO, flatten detachCmds, guard worktree symlink\n  * Cover detach-reuse, worktree fetch dir, and symlink path resolution\n  * Harden worktree submodule prefixing and cover cmd.Dir stripping\n  * Create branch when reusing a worktree with a new --branch name\n  * Extract authenticatedCommand helper to dedupe -C handling\n  * Preserve no-force safety when reusing a worktree for fork PRs\n  * Simplify submodule worktree prefix to inline conditional\n  * Run submodule commands inside the worktree for pr checkout\n  * tidying..\n  * Refine PR checkout worktree flag help\n  * Add --worktree flag to gh pr checkout\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only\n  Punycode-encoded labels allows for validation bypass and privilege\n  escalation (bsc#1266618).\n\n- Update to version 2.97.0, fixing four security issues (CVE-2026-64654, bsc#1276662,\n  CVE-2026-64653, bsc#1276664, CVE-2026-64652, bsc#1276663, CVE-2026-64655, bsc#1276661):\n  * CVE-2026-64654: terminal escape sequence injection in gist view, api,\n    pr diff, release download --output -, codespace logs, skills preview\n    and agent-task view/create\n  * CVE-2026-64653: unescaped variable path components in request URLs\n    could redirect gh to a different resource than intended\n  * CVE-2026-64652: gh auth status could print part of the auth token in\n    plaintext for token types with an underscore after the prefix\n  * CVE-2026-64655: gh attestation verify built its --signer-repo/\n    --signer-workflow matcher without escaping regex metacharacters,\n    allowing a lookalike signer to pass verification\n  * Add named field columns to gh project item-list and item-edit\n","status":"published","published":"2026-08-26T16:15:07Z","modified":"2026-08-27T17:30:03.684853288Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}