chore(deps): update dependency gh to v2.96.0

[renovate]

This PR contains the following updates:

Package	Update	Change
gh	minor	2.94.0 → 2.96.0

---

Release Notes

cli/cli (gh)

v2.96.0: GitHub CLI 2.96.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features

• Allow gh release download without authentication on public repositories by @​BagToad in #​13723
• Detect additional third-party coding agents by @​BagToad in #​13722
• Support antigravity-cli and antigravity2.0 in gh skill by @​BagToad in #​13784

🐛 Fixes

• fix: show checks summary when all checks were cancelled by @​s3onghyun in #​13679
• fix(skills): install universal agent to ~/.agents/skills by @​toller892 in #​13681
• fix(skills): honor --dir without agent prompt by @​happysnaker in #​13766
• Fix concurrent map writes in codespace port forwarding by @​williammartin in #​13313
• Use int64 for GitHub database IDs by @​williammartin in #​13403

📚 Docs & Chores

• Pin reusable triage workflows to a commit SHA by @​BagToad in #​13705
• Add security disclosure guidance to AGENTS.md by @​BagToad in #​13720
• Clarify --clone boolean flag behaviour in gh repo fork help by @​BagToad in #​13786
• Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @​pdostal in #​13675
• docs(search): add examples for multiple qualifiers by @​happysnaker in #​13756
• docs: fix broken anchor link in release-process-deep-dive by @​patrickwehbe in #​13688
• docs: fix broken install command and link/grammar errors by @​patrickwehbe in #​13690
• docs: fix duplicated word in primer README by @​s3onghyun in #​13677

Dependencies

• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @​dependabot in #​13708
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot in #​13703
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @​dependabot in #​13702
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot in #​13740
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @​dependabot in #​13754
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @​dependabot in #​13759
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot in #​13779

New Contributors

• @​patrickwehbe made their first contribution in #​13688
• @​s3onghyun made their first contribution in #​13679
• @​toller892 made their first contribution in #​13681
• @​happysnaker made their first contribution in #​13756

Full Changelog: cli/cli@v2.95.0...v2.96.0

v2.95.0: GitHub CLI 2.95.0

Compare Source

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

[!NOTE]
gh repo read-file and gh repo read-dir are in preview and subject to change without notice.

What's Changed

✨ Features

• feat: add repo read-file and repo read-dir by @​babakks in #​13580
• feat(skills): list available skills when install runs non-interactively by @​SamMorrowDrums in #​13548
• Support custom CLAUDE_CONFIG_DIR in install by @​tommaso-moro in #​13523

🐛 Fixes

• fix(skills): stage updates in a temp dir and swap in-place by @​SamMorrowDrums in #​13449

📚 Docs & Chores

• Make filtering by bot authors more discoverable by @​BagToad in #​13642
• docs(discussion): polish help docs by @​babakks in #​13632
• Bump Go in devcontainer by @​spenserblack in #​13674

Dependencies

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @​dependabot[bot] in #​13640
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @​dependabot[bot] in #​13663
• chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @​dependabot[bot] in #​13661
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @​dependabot[bot] in #​13619
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @​dependabot[bot] in #​13662
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​13641

Full Changelog: cli/cli@v2.94.0...v2.95.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.