New release devlooped/ghx@2.98.0-preview

[kzu]

Security

A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default.

Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible.

For more information see: GHSA-vfhh-p7hm-pxfh

Support worktrees in pr checkout

Users can now checkout a pull request into a git worktree by using the new --worktree PATH flag in gh pr checkout:

gh pr checkout 12 --worktree ../wt-feature

Add semantic search to search issues

The gh search issues command now supports semantic search for issues. Users can select the search type by passing the --search-type flag:

gh search issues --search-type semantic ...

gh search issues --search-type hybrid ...

For more information about semantic search see: "Improved Search for github issues is now generally available".

What's Changed

✨ Features

• Add --worktree flag to gh pr checkout by @tidy-dev in Add --worktree flag to gh pr checkout cli/cli#13946
• Set GH_EXTENSION=1 when gh invokes an extension by @williammartin in Set GH_EXTENSION=1 when gh invokes an extension cli/cli#14072
• Add --search-type flag for semantic and hybrid issue search by @michaeljacholke in Add --search-type flag for semantic and hybrid issue search cli/cli#14006

🐛 Fixes

• Fix RESTWithNext error type, repairing gh status and attestation retries by @williammartin in Fix RESTWithNext error type, repairing gh status and attestation retries cli/cli#13988
• Trim spaces when parsing X-Oauth-Scopes in gh release create by @williammartin in Trim spaces when parsing X-Oauth-Scopes in gh release create cli/cli#14065
• Fix project item-add output for non-TTY by @zwick in Fix project item-add output for non-TTY cli/cli#14056

📚 Docs & Chores

• Slim down dependabot triage comments by @williammartin in Slim down dependabot triage comments cli/cli#14019
• Require explicit PR review ownership by @williammartin in Require explicit PR review ownership cli/cli#14028
• Collapse spam triage into the agentic issue-triage workflow by @williammartin in Collapse spam triage into the agentic issue-triage workflow cli/cli#14027
• Run Dependabot triage every hour by @sergiou87 in Run Dependabot triage every hour cli/cli#14030
• Route deploy key requests through api.Client by @williammartin in Route deploy key requests through api.Client cli/cli#13989
• Route ssh key requests through api.Client by @williammartin in Route ssh key requests through api.Client cli/cli#13994
• Route gpg key requests through api.Client by @williammartin in Route gpg key requests through api.Client cli/cli#13997
• Route autolink requests through api.Client by @williammartin in Route autolink requests through api.Client cli/cli#14013
• Route extension requests through api.Client by @williammartin in Route extension requests through api.Client cli/cli#14059
• Route release creation through api.Client by @williammartin in Route release creation through api.Client cli/cli#14062
• Tell agents to use the PR template in AGENTS.md by @williammartin in Tell agents to use the PR template in AGENTS.md cli/cli#14074
• Make Dependabot triage cheaper and more decisive by @williammartin in Make Dependabot triage cheaper and more decisive cli/cli#14079
• Route release deletions through api.Client by @williammartin in Route release deletions through api.Client cli/cli#14077
• Give Dependabot triage a real reachability check by @williammartin in Give Dependabot triage a real reachability check cli/cli#14087
• Restore automatic spam issue closure by @williammartin in Restore automatic spam issue closure cli/cli#14088
• Add a scheduled tech debt burndown skill by @williammartin in Add a scheduled tech debt burndown skill cli/cli#14095
• Use reflect.Pointer instead of deprecated reflect.Ptr by @williammartin in Use reflect.Pointer instead of deprecated reflect.Ptr cli/cli#14098
• Clarify what belongs in the PR template's testing section by @williammartin in Clarify what belongs in the PR template's testing section cli/cli#14103
• Rename cli-code-reviewer skill to code-review by @BagToad in Rename cli-code-reviewer skill to code-review cli/cli#14116
• Add aw-actions group to dependabot configuration by @babakks in Add aw-actions group to dependabot configuration cli/cli#14123
• Isolate tests from local machine's auth and git configuration by @BagToad in Isolate tests from local machine's auth and git configuration cli/cli#14128
• Don't ask for feature detection cleanup comments when not needed by @babakks in Don't ask for feature detection cleanup comments when not needed cli/cli#14139
• Accept pre-release tags in deployment validation by @BagToad in Accept pre-release tags in deployment validation cli/cli#14193
• ci: add temporary step to verify Linux repo signing keys by @babakks in ci: add temporary step to verify Linux repo signing keys cli/cli#14202
• Revert "ci: add temporary step to verify Linux repo signing keys" by @babakks in Revert "ci: add temporary step to verify Linux repo signing keys" cli/cli#14203
• Fix issue triage action compatibility [skip changelog] by @tidy-dev in Fix issue triage action compatibility [skip changelog] cli/cli#14207

Dependencies

• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 cli/cli#14047
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in chore(deps): bump the codeql-actions group across 1 directory with 3 updates cli/cli#14049
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 cli/cli#14048
• chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 cli/cli#14066
• chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in chore(deps): bump actions/attest from 4.2.1 to 4.2.2 cli/cli#14100
• chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in chore(deps): bump azure/login from 3.0.0 to 3.0.1 cli/cli#14101
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in chore(deps): bump the codeql-actions group across 1 directory with 3 updates cli/cli#14091
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by @dependabot[bot] in chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 cli/cli#14068
• chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 cli/cli#14119
• chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 cli/cli#14120
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in chore(deps): bump the aw-actions group with 2 updates cli/cli#14147
• chore: sign APT repository with both keys by @babakks in chore: sign APT repository with both keys cli/cli#13271
• chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by @dependabot[bot] in chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 cli/cli#14029
• chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in chore(deps): bump actions/attest from 4.2.0 to 4.2.1 cli/cli#14050
• Bump golangci-lint in CI to v2.12.2 by @williammartin in Bump golangci-lint in CI to v2.12.2 cli/cli#14102
• chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in chore(deps): bump the aw-actions group with 2 updates cli/cli#14124
• chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 cli/cli#14140
• Upgrade gh-aw workflows to v0.85.4 by @tidy-dev in Upgrade gh-aw workflows to v0.85.4 cli/cli#14141
• Bump Go to 1.26.6 by @github-actions[bot] in Bump Go to 1.26.6 cli/cli#14143
• chore: bump go to 1.26.7 by @babakks in chore: bump go to 1.26.7 cli/cli#14205
• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 cli/cli#14204
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in chore(deps): bump the codeql-actions group across 1 directory with 3 updates cli/cli#14169
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 cli/cli#14164
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by @dependabot[bot] in chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 cli/cli#14166
• Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by @BagToad in Bump gh-aw-actions to v0.87.1 and recompile agentic workflows cli/cli#14210

New Contributors

• @sergiou87 made their first contribution in Run Dependabot triage every hour cli/cli#14030
• @michaeljacholke made their first contribution in Add --search-type flag for semantic and hybrid issue search cli/cli#14006

Full Changelog: cli/cli@v2.97.0...v2.98.0

https://github.com/cli/cli/releases/tag/v2.98.0

Sponsors

The following sponsors made this release possible: @clarius, @MFB-Technologies-Inc, @sandrock, @drivenet, @Keflon, @tbolon, @rbnswartz, @jfoshee, @Mrxx99, @eajhnsn1, @Jonathan-Hickey, @KenBonny, @SimonCropp, @agileworks-eu, @arsdragonfly, @vezel-dev, @ChilliCream, @4OTC, @DominicSchell, @adalon, @torutek, @mccaffers, @SeikaLogiciel, @wizardness, @eska-gmbh, @geodata-no, @jslachta.

Thanks 💜

---

🔗 View Release

[BagToad]

@kzu please adjust your automation to remove all the @ mentioning of different maintainers. This is spam.

[kzu]

Agreed. Will do. Thanks for raising the issue 🙏