Path to this page:
Subject: CVS commit: pkgsrc/net/gh
From: Benny Siegert
Date: 2024-11-25 20:18:07
Message id: 20241125191807.803ABFC7D@cvs.NetBSD.org
Log Message:
gh: update to 2.62.0
GitHub CLI 2.62.0
* Update monotonic verification logic and testing
* Check extension for latest version when executed
* Shorten extension release checking from 3s to 1s
* Mention GitHub CLI team on discussion issues
* A security vulnerability has been identified in GitHub CLI that could allow
remote code execution (RCE) when users connect to a malicious Codespace SSH
server and use the gh codespace ssh or gh codespace logs commands.
For more information, see GHSA-p2h2-3vg9-4p87.
GitHub CLI 2.61.0
Ensure users understand consequences before making repository visibility
changes
In v2.61.0, gh repo edit command has been enhanced to inform users about
consequences of changing visibility and ensure users are intentional before
making irreversible changes:
1. Interactive gh repo edit visibility change requires confirmation when
changing from public, private, or internal
2. Non-interactive gh repo edit --visibility change requires new
--accept-visibility-change-consequences flag to confirm
3. New content to inform users of consequences
+ Incorporate GitHub Docs content into help usage and interactive gh repo
edit experience
+ Expanded help usage to call out most concerning consequences
+ Display repository star and watcher counts to understand impact before
confirming
What's Changed
* Add acceptance test for project command
* Add comprehensive testscript for gh ruleset
* Add comprehensive testscript for gh ext commandset
* Require visibility confirmation in gh repo edit
* Clean up skipped online tests for gh attestation verify
* gh attestation verify should only verify provenance attestations by default
* Set dnf5 commands as default
* Fix verbiage for deleting workflow runs
* Bump github.com/creack/pty from 1.1.23 to 1.1.24
* gh attestation verify policy enforcement refactor
* Simplify Sigstore verification result handling in gh attestation verify
* Print empty array for gh cache list when --json is provided
* Bump actions/attest-build-provenance from 1.4.3 to 1.4.4
* Create the automatic key when specified with -i
* fix: gh pr create -w ignore template flag
GitHub CLI 2.60.1
This is a small patch release to fix installing gh via go install which was
broken with v2.60.0.
GitHub CLI 2.60.0
* Add ArchivedAt field
* Include startedAt, completedAt in run steps data
* Adjust environment help for host and tokens
* Add handling of empty titles for Issues and PRs
* LiveSigstoreVerifier.Verify should error if no attestations are present
* gh at verify retries fetching attestations if it receives a 5xx
* Prevent local extension installations with invalid names and conflicts with
core commands and other extensions
* Rewrite a sentence in CONTRIBUTING.md
* Use new GitHub preview terms in working-with-us.md
* Use new GitHub previews terminology in attestation commands' help docs
* Clarify in README that gh is supported on GitHub Enterprise Cloud
Files: