What's Changed

🐛 Fixes

• fix(gh auth status): explain expired expiring tokens with --no-refresh by @babakks in #14815

Full Changelog: v2.103.2...v2.103.3

🐛 Fixes

• Allow server to arbitrate which GitHub App installation tokens can attach files by @martinajir in #14804
• Defer --attach credential checks to the upload endpoint by @BagToad in #14805

New Contributors

• @martinajir made their first contribution in #14804

Full Changelog: v2.103.1...v2.103.2

What's Changed

🐛 Fixes

• Avoid repeating the skill installation safety warning by @tommaso-moro in #14784
• feat(gh auth login): hint at --expiring when no preference is set by @babakks in #14798

📚 Docs & Chores

• Document extrepo installation on Debian by @williammartin in #14796

Dependencies

• Update github.com/digitorus/pkcs7 dependency by @bdehamer in #14791

Full Changelog: v2.103.0...v2.103.1

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

What's Changed

✨ Features

• Replace extension browse with Bubble Tea by @williammartin in #14578
• gh issue artifact stack 1/12: Resolve --attach references against the body file's directory by @BagToad in #14564
• gh issue artifact stack 2/12: Attach one set of files to several Markdown documents by @BagToad in #14565
• gh issue artifact stack 3/12: Add the command group and list by @BagToad in #14566
• gh issue artifact stack 4/12: Add view by @BagToad in #14567
• gh issue artifact stack 5/12: Add delete by @BagToad in #14568
• gh issue artifact stack 6/12: Add download by @BagToad in #14569
• gh issue artifact stack 7/12: Add create by @BagToad in #14570
• gh issue artifact stack 8/12: Add edit by @BagToad in #14571
• gh issue artifact stack 10/12: Add edit --restore-version by @BagToad in #14580
• gh issue artifact stack 11/12: Address review feedback by @BagToad in #14640
• gh issue artifact stack 12/12: Add artifact URLs by @BagToad in #14678
• Support HTML documents in gh issue artifact by @BagToad in #14720
• Refreshable tokens (1/7): foundation credential model, storage migration, and file lock by @babakks in #14450
• Refreshable tokens (2/7): refresher domain, OAuth refresher, storage, and wiring by @babakks in #14451
• Refreshable tokens (3/7): short-lived login, refresh, and git credential path by @babakks in #14452
• Refreshable tokens (4/7): gh auth token refresh and secure-storage handling by @babakks in #14453
• Refreshable tokens (5/7): gh auth status short-lived token details by @babakks in #14454
• Refreshable tokens (6/7): agent-task and CAPI per-request refresh by @babakks in #14455
• Refreshable tokens: review fixes across the stack by @babakks in #14663
• Refreshable tokens: rename --short-lived flag to --expiring by @babakks in #14665
• Refreshable tokens: add prefer_expiring_credentials config option by @babakks in #14672
• Refreshable tokens: capture auth_invocation telemetry on login and refresh by @babakks in #14673
• Refreshable tokens: review fixes (round 2) by @babakks in #14717
• Refreshable tokens: show relative time-to-expiry in gh auth status by @babakks in #14745
• Refreshable tokens: build-gated debug overrides for testing token expiry by @babakks in #14752
• Refreshable tokens: bump cli/oauth to v1.3.0 and fix gh status column width by @babakks in #14768

🐛 Fixes

• Bump go-runewidth to v0.0.30 for faster startup by @williammartin in #14577
• Avoid spawning git for each extension at startup by @williammartin in #14620
• Fix the unclean background colors of gh-search-code by @A4-Tacks in #14648
• Fix help text that references nonexistent flags by @BagToad in #14719

📚 Docs & Chores

• docs: recommend nix-shell and declarative config for Nix/NixOS by @reginaldalfret in #14592
• Clarify issue view comment output modes by @babakks with @Copilot in #14616
• Add ACCESSIBILITY.md by @BagToad in #14583
• Bump shell-quote to 1.11.0 in cli-exercise skill by @williammartin in #14625
• Leave validation checks to CI in bump-go script by @williammartin in #14631
• Remove CLAUDE.md in favor of AGENTS.md by @jarrensj in #14474
• Clarify --repo and --owner checks for attestation bundles by @bdehamer in #14650
• Fix Go vendoring in Dependabot triage and bump gh-aw by @williammartin in #14682
• gh issue artifact stack 9/12: Document gh issue artifact in the gh skill by @BagToad in #14572
• Clarify --comments behavior when piped in view commands by @arsalanyavari in #14714
• Clarify release creation atomicity and immutability by @bdehamer in #14722
• Add deterministic Dependabot scheduler by @williammartin in #14750
• Merge v2.102.1 release branch into trunk by @BagToad in #14770
• Refreshable tokens (7/7): guided end-to-end verification scripts by @babakks in #14456
• Document expiring tokens in the gh skill by @babakks in #14782

Dependencies

• Bump Go to 1.27.2 by @github-actions[bot] in #14632
• chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #14633
• chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 by @dependabot[bot] in #14634
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in #14660
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #14656
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #14655
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #14654
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 by @dependabot[bot] in #14657
• chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #14485
• chore(deps): bump github.com/cli/go-gh/v2 from 2.16.1 to 2.16.2 by @dependabot[bot] in #14696
• chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #14697
• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @dependabot[bot] in #14707
• chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @dependabot[bot] in #14705
• chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot[bot] in https://github.com/cli/...

What's Changed

Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: v2.102.0...v2.102.1

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible.

gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links.

See GHSA-39wj-f2f4-978v for more information.

gh attestation verify compared the --source-ref value case-insensitively, so an attestation built from a branch whose name differs only in case could satisfy a policy that named a different branch.

See GHSA-4mq3-hpgx-9cx8 for more information.

Interactive gh skill search passed repository paths from search results to gh skill install without an option separator, so a search result could inject installer options and change where skill files were written.

See GHSA-qcwj-mr2r-2cx7 for more information.

gh attestation verify matched the --signer-workflow value against only the start of the signing certificate's identity, so an attestation signed by a different workflow in the pinned repository could pass verification when its path began with the pinned value.

See GHSA-wjmr-j3rp-mh2g for more information.

What's Changed

🐛 Fixes

• Allow ghu_ tokens for supported actors to attach files by @BagToad in #14516
• Allow repo set-default --unset without an argument by @williammartin in #14540

📚 Docs & Chores

• Prioritize HackerOne for vulnerability reports by @BagToad in #14497
• Clarify reviewer-facing PR guidance by @williammartin in #14509
• Add a skill for chaptered CLI recordings by @BagToad in #14475
• Improve CLI recording rendering by @williammartin in #14507
• Mention gh CLI in the README intro by @BagToad in #14517
• Document search operator support in gh search help by @waldyrious in #14519
• Remove host versions from gh project item-list help by @BagToad in #14553

Dependencies

• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14486
• chore(deps): bump nodeselector/setup-apple-codesign from 0.0.2 to 0.0.3 by @dependabot in #14487
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.9 to 2.0.10 by @dependabot in #14541
• chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1 by @dependabot in #14542
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14543

Full Changelog: v2.101.0...v2.102.0

Linux package repository signing key rotation

GitHub CLI's APT and RPM repositories, along with individual RPM packages, are now signed only with the new PGP key (fingerprint: 7F38BBB59D064DBCB3D84D725612B36462313325)

Copy authentication codes to the clipboard by default

gh auth login and gh auth refresh now copy OAuth device codes to the clipboard by default, saving a manual copy step during authentication.

To persistently opt out, run:

gh config set clipboard disabled

Explicit clipboard options still take precedence for an individual invocation.

What's Changed

✨ Features

• Add clipboard preference for auth flows and default to enabled by @williammartin in #14345

🐛 Fixes

• Use API SSH URLs for repository clones by @williammartin in #14346
• Validate repository names during interactive creation by @sergiou87 in #14313
• Finalize telemetry at invocation completion by @williammartin in #14390
• Record attachment operation counts in telemetry by @BagToad in #14360
• Propagate gh path to extensions by @williammartin in #14282
• Delete repo garden command by @williammartin in #14416
• Fix remote branch deletion for owner case mismatch by @williammartin in #14429
• Retire multi-account migration by @williammartin in #14430

📚 Docs & Chores

• docs: announce Linux PGP key rotation by @babakks in #14340
• Require verified SHAs in issue-triage permalinks by @sergiou87 in #14343
• Add VHS demo skill by @williammartin in #14334
• docs: fix broken "GitHub language" link in primer foundations by @areesh-ali in #14363
• Fix and validate Go bump workflow by @williammartin in #14347
• chore: sign Linux repositories only with the new PGP key by @babakks in #14197
• Rewrite CLI agent guidance by @williammartin in #14388
• Prepare exit errors for Go 1.27 by @williammartin in #14397
• Reduce rate limiting and reduce time taken for acceptance tests by @williammartin in #14320
• Filter acceptance tests for installation token capabilities by @williammartin in #14354
• Fix Go bump workflow authentication by @williammartin in #14412
• Run acceptance tests in Actions with a GitHub App token by @williammartin in #14356
• Fix acceptance script paths on Windows by @williammartin in #14414
• Wait for repository readiness before archiving by @williammartin in #14415
• Update Go bump validation tools by @williammartin in #14428
• Recognize maintainer authorization by @williammartin in #14438
• Safely replace stale Go bump branches by @williammartin in #14441
• Use internal Apple codesign action by @williammartin in #14437
• Test explicit default repository resolution by @williammartin in #14460
• Revert "Use internal Apple codesign action" by @williammartin in #14462

Dependencies

• chore(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 by @dependabot[bot] in #14376
• chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in #14377
• chore(deps): bump github.com/yuin/goldmark from 1.8.5 to 1.8.6 by @dependabot[bot] in #14378
• chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 by @dependabot[bot] in #14391
• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.27 to 0.2.0 by @dependabot[bot] in #14375
• chore(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 by @dependabot[bot] in #14417
• Bump Go to 1.27.1 by @github-actions[bot] in #14442
• chore(deps): bump azure/login from 3.0.2 to 3.1.0 by @dependabot[bot] in #14447
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #14446
• chore(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 by @dependabot[bot] in #14445
• chore(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 by @dependabot[bot] in #14444
• chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in #14443
• Bump github.com/cli/go-gh/v2 to v2.16.1 by @niik in #14461

New Contributors

• @areesh-ali made their first contribution in #14363

Full Changelog: v2.100.0...v2.101.0

Experimental: Route GitHub API traffic through a custom host

Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration:

# Route API traffic for github.com through a gateway
gh config set api_host gh-gateway.example.com --host github.com

# Read the configured API host
gh config get api_host --host github.com

The original host remains in use for authentication, Git remotes, and browser URLs.

What's Changed

✨ Features

• Honor per-host api_host routing across GitHub API requests by @williammartin in #14104
• Expose api_host through gh config get and gh config set by @williammartin in #14332
• Add webhook as an official extension by @williammartin in #14326
• Print full command help after command misuse when gh is invoked by a coding agent by @niik in #14198

🐛 Fixes

• fix(api): disable telemetry for unauthenticated GHES requests using absolute hostnames by @williammartin in #14337

📚 Docs & Chores

• Fix discussion acceptance test flags by @williammartin in #14321
• Clarify supported GHES versions by @williammartin in #14324
• Improve automated issue triage analysis by @sergiou87 in #14318
• Record attachment counts in telemetry by @BagToad in #14327

Dependencies

• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @babakks in #14331
• chore(deps): bump Go toolchain from 1.26.7 to 1.26.8 by @babakks in #14330
• chore(deps): bump github.com/cli/go-gh/v2 from 2.15.0 to 2.16.0 by @williammartin in #14338

Full Changelog: v2.99.0...v2.100.0

Attach images and videos to issues and pull requests

The repeatable --attach flag uploads local images and videos and adds them to issue, pull request, or comment bodies. If a body already references the local path, gh replaces it with the uploaded URL; otherwise it appends the attachment:

# Attach files when creating or editing an issue
gh issue create --attach './repro.png#The error state'
gh issue edit 123 --attach ./walkthrough.mp4

# Attach files when creating or editing a pull request
gh pr create --attach ./before.png
gh pr edit 456 --attach ./after.png

# Attach files to comments
gh issue comment 123 --attach ./repro.png
gh pr comment 456 --attach ./result.mp4

Repeat the flag to attach multiple files in a single invocation. Attachments are available on GitHub.com and GitHub Enterprise Cloud.

For more information see https://gh.io/gh-attach and https://github.blog/changelog/2026-09-01-github-cli-media-in-issues-pull-requests-and-comments/

Worktree support extended to gh issue develop

gh issue develop can now create a linked branch and check it out in a new Git worktree, leaving your current working copy unchanged:

# Create a linked branch for an issue and check it out in a worktree
gh issue develop 123 --checkout --worktree /path/to/wt-feature

What's Changed

✨ Features

• Add token and repository metadata required for attachment uploads by @BagToad in #14177
• Add validation for attachable image and video files by @BagToad in #14178
• Rewrite local Markdown references to uploaded attachment URLs by @BagToad in #14179
• Add attachment uploads to GitHub by @BagToad in #14180
• Add repeatable --attach flag parsing and upload orchestration by @BagToad in #14181
• Add --attach to gh pr comment and gh issue comment by @BagToad in #14182
• Add --attach to gh pr create and gh pr edit by @BagToad in #14183
• Add --attach to gh issue create and gh issue edit by @BagToad in #14184
• Add worktree checkout to gh issue develop by @sergiou87 in #14136
• Use text-only spinner output when gh is invoked by a coding agent by @niik in #14191
• Honor PI_CODING_AGENT_DIR for Pi user skills by @tommaso-moro in #14260

🐛 Fixes

• fix(repo sync): explain when the target branch is checked out in another worktree by @williammartin in #14076
• fix(pr merge): safely handle --delete-branch with linked worktrees by @tidy-dev in #14007
• fix(copilot): end the declined-install warning with a newline by @BagToad in #14222
• fix(attach): clarify retry windows and attachment path resolution by @BagToad in #14262
• fix(issue develop): reject non-empty worktree targets before creating a branch by @tidy-dev in #14244
• fix(repo sync): prevent linked-worktree corruption by @sergiou87 in #14060
• fix(view): reject --comments with --json by @BagToad in #14215
• fix(attach): limit batches to 50 files by @BagToad in #14289
• fix(skills): install Codex user skills to ~/.agents/skills by @scarletkc in #14154

📚 Docs & Chores

• Address review feedback across the --attach stack by @BagToad in #14200
• Refactor commands to own attachment flag policy by @BagToad in #14255
• Document attachment support in the gh skill by @BagToad in #14261
• Document gh issue develop --checkout --worktree in the gh skill by @babakks in #14265
• Clarify pull request testing guidance by @williammartin in #14272
• Fix issue triage to apply suspected-spam labels directly by @williammartin in #14271
• Prevent Dependabot from updating agentic-workflow dependencies by @williammartin in #14274
• Modernize Go code with go fix by @BagToad in #14278

Dependencies

• chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot in #14247
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 by @dependabot in #14248
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot in #14250
• chore(deps): bump charm.land/bubbles/v2 from 2.1.1 to 2.2.0 by @dependabot in #14249
• chore(deps): bump agentic-workflows to 0.87.5 by @williammartin in #14273
• chore(deps): bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 by @dependabot in #14275
• chore(deps): bump https://github.com/sigstore/protobuf-specs from 0.5.1 to 0.5.2 by @dependabot in #14258
• chore(deps): bump https://github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot in #14267
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot in #14299
• chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @dependabot in #14301
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #14300

New Contributors

• @scarletkc made their first contribution in #14154

Full Changelog: v2.98.0...v2.99.0

Security

A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default.

Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible.

For more information see: GHSA-vfhh-p7hm-pxfh

Support worktrees in pr checkout

Users can now checkout a pull request into a git worktree by using the new --worktree PATH flag in gh pr checkout:

gh pr checkout 12 --worktree ../wt-feature

Add semantic search to search issues

The gh search issues command now supports semantic search for issues. Users can select the search type by passing the --search-type flag:

gh search issues --search-type semantic ...

gh search issues --search-type hybrid ...

For more information about semantic search see: "Improved Search for github issues is now generally available".

What's Changed

✨ Features

• Add --worktree flag to gh pr checkout by @tidy-dev in #13946
• Set GH_EXTENSION=1 when gh invokes an extension by @williammartin in #14072
• Add --search-type flag for semantic and hybrid issue search by @michaeljacholke in #14006

🐛 Fixes

• Fix RESTWithNext error type, repairing gh status and attestation retries by @williammartin in #13988
• Trim spaces when parsing X-Oauth-Scopes in gh release create by @williammartin in #14065
• Fix project item-add output for non-TTY by @zwick in #14056

📚 Docs & Chores

• Slim down dependabot triage comments by @williammartin in #14019
• Require explicit PR review ownership by @williammartin in #14028
• Collapse spam triage into the agentic issue-triage workflow by @williammartin in #14027
• Run Dependabot triage every hour by @sergiou87 in #14030
• Route deploy key requests through api.Client by @williammartin in #13989
• Route ssh key requests through api.Client by @williammartin in #13994
• Route gpg key requests through api.Client by @williammartin in #13997
• Route autolink requests through api.Client by @williammartin in #14013
• Route extension requests through api.Client by @williammartin in #14059
• Route release creation through api.Client by @williammartin in #14062
• Tell agents to use the PR template in AGENTS.md by @williammartin in #14074
• Make Dependabot triage cheaper and more decisive by @williammartin in #14079
• Route release deletions through api.Client by @williammartin in #14077
• Give Dependabot triage a real reachability check by @williammartin in #14087
• Restore automatic spam issue closure by @williammartin in #14088
• Add a scheduled tech debt burndown skill by @williammartin in #14095
• Use reflect.Pointer instead of deprecated reflect.Ptr by @williammartin in #14098
• Clarify what belongs in the PR template's testing section by @williammartin in #14103
• Rename cli-code-reviewer skill to code-review by @BagToad in #14116
• Add aw-actions group to dependabot configuration by @babakks in #14123
• Isolate tests from local machine's auth and git configuration by @BagToad in #14128
• Don't ask for feature detection cleanup comments when not needed by @babakks in #14139
• Accept pre-release tags in deployment validation by @BagToad in #14193
• ci: add temporary step to verify Linux repo signing keys by @babakks in #14202
• Revert "ci: add temporary step to verify Linux repo signing keys" by @babakks in #14203
• Fix issue triage action compatibility [skip changelog] by @tidy-dev in #14207

Dependencies

• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in #14047
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #14049
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #14048
• chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #14066
• chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in #14100
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in #14101
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #14091
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by @dependabot[bot] in #14068
• chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #14119
• chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in #14120
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in #14147
• chore: sign APT repository with both keys by @babakks in #13271
• chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by @dependabot[bot] in #14029
• chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in #14050
• Bump golangci-lint in CI to v2.12.2 by @williammartin in #14102
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in #14124
• chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in #14140
• Upgrade gh-aw workflows to v0.85.4 by @tidy-dev in #14141
• Bump Go to 1.26.6 by @github-actions[bot] in #14143
• chore: bump go to 1.26.7 by @babakks in #14205
• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in #14204
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #14169
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #14164
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by @dependabot[bot] in #14166
• Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by @BagToad in #14210

New Contributors

• @sergiou87 made their first contribution in #14030
• @michaeljacholke made their first contribution in #14006

Full Changelog: v2.97.0...v2.98.0