chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 by dependabot[bot] · Pull Request #13944 · cli/cli

dependabot · 2026-07-22T15:45:07Z

Bumps github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14.

Release notes

Sourced from github.com/gabriel-vasile/mimetype's releases.

v1.4.14 pyc, pcap, cycloned, gedcom support

Media type changes

newly added: application/x-bytecode.python, application/vnd.tcpdump.pcap, application/vnd.cyclonedx+xml, application/vnd.cyclonedx+json, text/vnd.familysearch.gedcom

superseded and demoted to aliases: image/vnd.mozilla.apng superseded by image/apng video/x-matroska superseded by video/matroska application/x-rar-compressed superseded by application/vnd.rar

Full changelog

scan: fix FullWord combined with other flags by @gabriel-vasile in gabriel-vasile/mimetype#763

shebang: individual flags for each signature by @gabriel-vasile in gabriel-vasile/mimetype#764

apk: add support with zipflinger virtual entry by @dmlambea in gabriel-vasile/mimetype#761

apng: search acTL for several chunks by @gabriel-vasile in gabriel-vasile/mimetype#770

CycloneDX: add support for JSON and XML types by @gabriel-vasile in gabriel-vasile/mimetype#771

pyc: add support; close #416 by @gabriel-vasile in gabriel-vasile/mimetype#773

mp3: harden ID3v2 check by @gabriel-vasile in gabriel-vasile/mimetype#783

MP3: add a frame parser and do linear search for headers by @gabriel-vasile in gabriel-vasile/mimetype#778

chore: go fix by @zdiff in gabriel-vasile/mimetype#797

csv: drop DropLastLine for better performance by @gabriel-vasile in gabriel-vasile/mimetype#799

ndjson: fix edge-case with new-lines by @gabriel-vasile in gabriel-vasile/mimetype#803

all: increase defaultLimit from 3072 to 4096 by @gabriel-vasile in gabriel-vasile/mimetype#796

rar: use vnd.rar instead of unregistered name by @gabriel-vasile in gabriel-vasile/mimetype#809

Add header "Message-ID" to eml hints to correctly detect type in enron email dataset by @zhel1 in gabriel-vasile/mimetype#791

ttf: use layout tables for detection too; fix #808 by @gabriel-vasile in gabriel-vasile/mimetype#810

ttf: add more missing tables by @gabriel-vasile in gabriel-vasile/mimetype#811

cdf: add parser for more reliable results by @gabriel-vasile in gabriel-vasile/mimetype#804

pcap: add support by @gabriel-vasile in gabriel-vasile/mimetype#817

all: run go fix by @gabriel-vasile in gabriel-vasile/mimetype#818

mkv: use IANA registered media type by @gabriel-vasile in gabriel-vasile/mimetype#819

docs: mention String() can return different values by @gabriel-vasile in gabriel-vasile/mimetype#820

charset: stop checking for ascii if utf8 is satisfied by @gabriel-vasile in gabriel-vasile/mimetype#768

Add support for text/vnd.familysearch.gedcom content type by @gorodet-sky in gabriel-vasile/mimetype#789

New Contributors

@zhel1 made their first contribution in gabriel-vasile/mimetype#791

@gorodet-sky made their first contribution in gabriel-vasile/mimetype#789

Full Changelog: gabriel-vasile/mimetype@v1.4.13...v1.4.14

v1.4.14-rc1 pyc, pcap, cycloned support

Media type changes

new media types: image/apng, video/matroska, application/vnd.rar, application/x-bytecode.python, application/vnd.tcpdump.pcap, application/vnd.cyclonedx+xml, application/vnd.cyclonedx+json

media types demoted to aliases: image/vnd.mozilla.apng, video/x-matroska, application/x-rar-compressed

Full changelog

scan: fix FullWord combined with other flags by @gabriel-vasile in gabriel-vasile/mimetype#763

shebang: individual flags for each signature by @gabriel-vasile in gabriel-vasile/mimetype#764

apk: add support with zipflinger virtual entry by @dmlambea in gabriel-vasile/mimetype#761

apng: search acTL for several chunks by @gabriel-vasile in gabriel-vasile/mimetype#770

CycloneDX: add support for JSON and XML types by @gabriel-vasile in gabriel-vasile/mimetype#771

pyc: add support; close #416 by @gabriel-vasile in gabriel-vasile/mimetype#773

mp3: harden ID3v2 check by @gabriel-vasile in gabriel-vasile/mimetype#783

... (truncated)

Commits

bcd718d gedcom: add support for text/vnd.familysearch.gedcom (#789)
2995287 build(deps): bump the github-actions group across 1 directory with 7 updates ...
14cefcb fuzz: improvements for exploring more code paths (#824)
5b11e3a scan: fix panic and fuzz flags (#823)
5621f29 charset: stop checking for ascii if utf8 is satisfied (#768)
eb8d3f4 docs: mention String() can return different values (#820)
9268756 mkv: use IANA registered media type video/matroska (#819)
bb8a73a all: run go fix (#818)
ec8db0d pcap: add support (#817)
aac6f1c cdf: add parser for more reliable results (#804)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.13 to 1.4.14. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](gabriel-vasile/mimetype@v1.4.13...v1.4.14) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-version: 1.4.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

BagToad

(generated)

Reviewed the full v1.4.13...v1.4.14 diff against how we actually use this library. Approving.

We only use mimetype in gh gist, inside IsBinaryFile / IsBinaryContents, to classify a gist file as text or binary. The whole surface is Detect, DetectFile, and walking .Parent() for text/plain:

for mime := mimetype.Detect(contents); mime != nil; mime = mime.Parent() {
	if mime.Is("text/plain") {
		isBinary = false
		break
	}
}

Nothing in this release changes that behavior for us:

Detect, DetectFile, Parent, and Is are unchanged apart from the default read limit growing from 3072 to 4096 bytes.
The new text types (gedcom, CycloneDX XML/JSON) still carry text/plain in their parent chain, and the new binary detectors (pyc, pcap) plus the reworked mp3 detector all require non-text bytes, so a valid text file cannot start matching them. The boundary we depend on does not move.
Two changes nudge results toward correctness: the larger read limit catches a binary byte between offsets 3072 and 4096, and a stricter ID3v2 check means a text file that starts with ID3 now reads as text instead of binary.
No transitive dependency risk: mimetype depends only on the standard library, and its go.mod is identical between the two versions.

@me

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28

* docs(search): reword raw qualifier examples * Add dry_run flag to gate release publishing Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <[email protected]> * Fix macOS signing/notarization keychain and gating Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <[email protected]> * Update deployment.yml * Use workflow_dispatch for deployment flow Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication. * Update deployment.yml * Update deployment.yml * Add draft issue-triage gh-aw workflow (issue-intents starting point) Net-new draft agentic issue-triage labeller for cli/cli built with gh-aw. On a newly opened issue (or manual workflow_dispatch) an agent reads the issue and, only when confident, applies a small allowlist of existing cli/cli labels and posts one short rationale comment via native issue-intents safe outputs. Conservative starting point for discussion, not a final triage configuration. Inert until issue_intents is enabled for the org/repo and a repo admin sets the GH_AW_RUNTIME_FEATURES=issue_intents repository variable. Co-authored-by: Copilot App <[email protected]> * Retune issue-triage stub to the team's documented triage process Rework the draft workflow to follow gh-cli-and-desktop triage-process.md: the objective is to drive an issue toward removing needs-triage by landing the minimal correct end-state labels, surfaced for maintainer approval via issue-intents rationale and confidence rather than silent auto-apply. - Prompt now follows the documented issues decision tree (closeable / duplicate / spam / abuse / off-topic / no-help-wanted-issue, then bug + priority or unable-to-reproduce, then enhancement or more-info-needed). - add-labels allowlist switched to the real cli/cli triage taxonomy: bug, priority-1/2/3, enhancement, more-info-needed, unable-to-reproduce, off-topic, no-help-wanted-issue, invalid, suspected-spam, duplicate. needs-triage is intentionally excluded (the agent must not add it). - max labels 3, add-comment max 1; engine copilot, strict:false, permissions contents:read + issues:read, github toolset [issues], triggers issues:opened + workflow_dispatch, timeout 10m, intents wiring unchanged. Co-authored-by: Copilot App <[email protected]> * Let's try a different approach * Add diagnostic step to list macOS signing identities Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <[email protected]> * Try this then * Don't see how this could have worked in the past * Don't need this any more * Update release deep-dive doc for macOS signing and dry_run changes Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <[email protected]> * Forward dry_run to deployment workflow from script/release The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <[email protected]> * Remove ref input from deployment workflow The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <[email protected]> * Pass macOS signing secrets via env instead of inline interpolation Interpolating ${{ secrets.* }} directly into the run: script meant a certificate password containing a single quote (or other shell metacharacters) would break quoting and could inject commands. Map the cert and password into the step env and reference them as quoted shell variables instead, and remove the temporary .p12 after import. Co-authored-by: Copilot <[email protected]> * Gate macOS signing on DO_SIGN_ARTIFACTS Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <[email protected]> * Mark dry runs in the workflow run name Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <[email protected]> * Revert to missing var * chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2ee...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Support antigravity-cli and antigravity2.0 in gh skill (#13784) Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Kynan Ware <[email protected]> Co-authored-by: Copilot App <[email protected]> * fix(skills): honor --dir without agent prompt (#13766) * docs: fix duplicated word in primer README (#13677) Signed-off-by: s3onghyun <[email protected]> * Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786) Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Kynan Ware <[email protected]> * docs: fix broken install command and link/grammar errors (#13690) Co-authored-by: Patrick Wehbe <[email protected]> * Fix concurrent map writes in codespace port forwarding (#13313) Co-authored-by: Copilot <[email protected]> Co-authored-by: Kynan Ware <[email protected]> * Merge commit from fork * Validate Jupyter Server URLs * Validate Jupyter Server URLs: address reviews * Validate Jupyter Server URLs: address test reviews * Validate Jupyter Server URLs: address test reviews * Gate publishing the site on the production environment * Fix pkg installer var in deep-dive code snippet The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <[email protected]> * Correct pkg signing NOTE in deep-dive The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <[email protected]> * Quote $KEYCHAIN in notarytool submit invocation Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <[email protected]> * Bump keyring operation timeout from 3s to 60s The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react. Fixes #11005 * Apply suggestions from code review Co-authored-by: Babak K. Shandiz <[email protected]> * Update deep-dive doc for final release workflow state Bring the release deep-dive in line with the final branch state: site steps gated on production, createrepo/reprepro gate on environment instead of GPG_SIGN, dropped github.token fallback, quoted keychain paths, and documented the script/release --dry-run default. Also restore the reprepro env: key that was dropped when GPG_SIGN was removed, which had left the workflow YAML invalid. Co-authored-by: Copilot <[email protected]> * chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5) --- updated-dependencies: - dependency-name: charm.land/lipgloss/v2 dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.39.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Bump Go to 1.26.5 * chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Adopt skills-driven triage approach from desktop/desktop Replace the inline decision tree with the shared skills-driven approach used in desktop/desktop. The workflow now fetches triage instructions from desktop/gh-cli-and-desktop-shared-workflows at runtime, uses a GitHub App token for auth, and always suggests labels at medium confidence or lower so all suggestions require maintainer approval. Key changes: - Add repos toolset and allowed-repos for cross-repo skill loading - Add min-integrity: none for reading untrusted issue content - Add github-app safe-output with CLI_TRIAGE_APP secret refs - Replace inline decision tree with 5-step skills-driven flow - Keep duplicate label (cli/cli has one, unlike desktop) Co-authored-by: Copilot App <[email protected]> * Remove medium-confidence instruction from Step 5 Co-authored-by: Copilot App <[email protected]> * Use Actions token for Copilot inference instead of PAT Add copilot-requests: write permission so the workflow uses the built-in GitHub Actions token for LLM calls, removing the need for a separate COPILOT_GITHUB_TOKEN secret. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.81.6 to 0.82.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/ba6380cc6e5be5d21677bebe04d52fb48e3abec7...3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1) --- updated-dependencies: - dependency-name: charm.land/bubbles/v2 dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump codeql-action/init and upload-sarif to v4.36.3 All three codeql-action sub-actions (init, analyze, upload-sarif) must be the same version to avoid version mismatch errors. This commit brings init and upload-sarif in line with the analyze bump. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. - [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.2 to 0.82.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a...eb6dc28843ed52402ea15a0ddf6334c40330eab4) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * drop notPanics assertion Signed-off-by: Meredith Lancaster <[email protected]> * Add Grok skill host support Co-authored-by: Copilot App <[email protected]> * Clarify agent host examples Co-authored-by: Copilot App <[email protected]> * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.36.2...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.3 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.3 to 0.82.8. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/eb6dc28843ed52402ea15a0ddf6334c40330eab4...99d9d888952ee25fce70c6b3120ca490d7d8da95) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore: remove dead CODEOWNERS rule for non-existent pkg/cmd/release/attestation/ * docs(search): note OWNER/REPO format on --repo flag The search --repo flag feeds GitHub's repo:OWNER/REPO qualifier, but its help never showed the expected format, so a full URL silently matched nothing. Add an OWNER/REPO placeholder and format hint to the code, commits, issues, and prs subcommands. Co-authored-by: Copilot App <[email protected]> * Add name-based resolution to gh project item-edit (#13807) Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.8.2 to 1.8.4. - [Release notes](https://github.com/yuin/goldmark/releases) - [Commits](https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.4) --- updated-dependencies: - dependency-name: github.com/yuin/goldmark dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Upgrade CodeQL action to version 4.37.1 Updated CodeQL action versions to v4.37.1 for analysis and SARIF upload. * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/attest from 4.1.1 to 4.2.0 Bumps [actions/attest](https://github.com/actions/attest) from 4.1.1 to 4.2.0. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.8 to 0.82.13. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/99d9d888952ee25fce70c6b3120ca490d7d8da95...a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(typos): fix typos in code and documentation * chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.0...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Group CodeQL Dependabot updates Co-authored-by: Copilot App <[email protected]> Copilot-Session: b6ceb930-bece-4da4-b457-7b142c3a322b * Add --worktree flag to gh pr checkout Support checking out a pull request into a new git worktree via `gh pr checkout <pr> --worktree <path>`. Re-running against the same path fast-forwards the existing worktree (idempotent, matching plain checkout), and checking out a branch already present in another worktree fails with a clear message. Adds a git.Client.Worktrees() helper that parses `git worktree list --porcelain`. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 (#13944) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Refine PR checkout worktree flag help * tidying.. * chore(deps): bump nodeselector/setup-apple-codesign from ab275d0f6fb63ef9e20b12b42ea0d567f935723c to 309922bbe4c7277c477635e68d3a1af52d8ad06b (#13878) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Run submodule commands inside the worktree for pr checkout When --worktree is combined with --recurse-submodules, the submodule sync/update commands ran in the main worktree instead of the newly created one, leaving the worktree's submodules uninitialized. Prefix the submodule commands with -C <path> (applied as cmd.Dir, mirroring the fetch handling) so they operate on the correct worktree. Co-authored-by: Copilot App <[email protected]> * Simplify submodule worktree prefix to inline conditional Co-authored-by: Copilot App <[email protected]> * Preserve no-force safety when reusing a worktree for fork PRs The missing-remote existing-worktree path used checkout -B <branch> FETCH_HEAD, which unconditionally reset the branch and could discard local commits even without --force. Switch to existence-aware logic that mirrors the non-worktree paths: when the branch exists, check it out and sync with merge --ff-only (or reset --hard under --force); only create the branch from FETCH_HEAD when it does not exist yet. Co-authored-by: Copilot App <[email protected]> * Extract authenticatedCommand helper to dedupe -C handling Co-authored-by: Copilot App <[email protected]> * Create branch when reusing a worktree with a new --branch name The existing-remote worktree-reuse path assumed the target branch already existed and ran checkout <branch>, which failed when a new --branch name was supplied for an already-existing worktree (e.g. repointing a review worktree at a different PR). Create the branch tracking the remote when it does not exist yet, mirroring the new-worktree path. Co-authored-by: Copilot App <[email protected]> * Harden worktree submodule prefixing and cover cmd.Dir stripping Use slices.Concat instead of append(prefix, ...) when building the worktree-scoped submodule commands so the shared prefix slice can never alias between the two commands. Add a unit test on authenticatedCommand asserting the leading -C <path> is applied as cmd.Dir and stripped from the args, which the CommandStubber-based tests cannot observe. Co-authored-by: Copilot App <[email protected]> * Add named field columns to gh project item-list (#13823) Co-authored-by: Copilot App <[email protected]> * docs(project): present by-name item-edit as the first-class flow (#13927) Signed-off-by: Solaris-star <[email protected]> * Fix duplicated-word typos in comments (#13900) Co-authored-by: Claude Sonnet 5 <[email protected]> * Cover detach-reuse, worktree fetch dir, and symlink path resolution Add the coverage gaps surfaced by review: re-running --detach against an existing worktree (the per-worktree FETCH_HEAD path), a cmd.Dir assertion for the worktree-local fetch shape (the real fork/detach production combo, not just submodule), and a symlink-resolving isWorktreeAtPath unit test so worktree reuse keeps working when git reports a canonical path but the user passes a symlinked one. Drop the custom-branch new-worktree case, which duplicated the new-branch path already covered by the existing-worktree custom-branch case. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.0 to 1.19.1. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.13 to 0.82.14. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996...b6d1443e05b8716267fa19425b99aa4f12006b4a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore: refresh agentic workflows to stable gh-aw v0.82.14 Upgrade the gh-aw toolchain from v0.81.6 to the latest stable release (v0.82.14, not a pre-release) and recompile the existing issue-triage agentic workflow with `gh aw compile`. The source workflow (issue-triage.md) is unchanged: frontmatter_hash and body_hash are identical, and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated runtime infrastructure: - issue-triage.lock.yml: compiler v0.81.6->v0.82.14, engine 1.0.65->1.0.71, action/container SHA bumps, new OAuth-token/lockdown steps, dropped .crush support, whitespace normalization. - .github/aw/actions-lock.json: setup action v0.81.6->v0.82.14 (+setup-cli). - .gitattributes: gh-aw-managed linguist-generated marker for lock files. - agentics-maintenance.yml: auto-generated companion for the workflow's expiring safe outputs (new in v0.82.14). Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget agentic workflows to pre-release gh-aw v0.83.0 Bump the gh-aw compiler from stable v0.82.14 to pre-release v0.83.0 and recompile the existing issue-triage workflow with `gh aw compile`. Source workflow issue-triage.md is unchanged: frontmatter_hash and body_hash are identical and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated: - issue-triage.lock.yml: compiler v0.82.14->v0.83.0, engine 1.0.71->1.0.73. - agentics-maintenance.yml: regenerated companion, version bumps only. - .github/aw/actions-lock.json: setup/setup-cli action v0.82.14->v0.83.0. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * feat(issue-triage): enable native issue-intent on supported safe outputs Add hyphenated `issue-intent: true` to every configured safe-output tool that supports it under gh-aw v0.83.0. Inspected all configured outputs against the v0.83.0 schema: - add-labels: supported -> issue-intent enabled (native rationale/ confidence/suggest on suggested labels). - add-comment: not an issue-intent-capable output type in v0.83.0 -> left unchanged. No safe-output tools were added or removed. Recompiled the issue-triage workflow with `gh aw compile`; the generated handler config now carries "add_labels":{...,"issue_intent":true}. frontmatter_hash changes as an intentional result of this config edit; body_hash is unchanged. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(issue-triage): scope refresh to issue-triage; drop unrelated maintenance workflow The setup PR (cli/cli#13777) meaningfully updated only the issue-triage workflow, so this refresh must touch issue-triage alone. gh-aw v0.83.0 otherwise auto-generates a repo-wide agentics-maintenance.yml companion workflow, which is out of scope here. Suppress that generation with the documented compiler toggle `.github/workflows/aw.json` {"maintenance": false} and remove the previously generated agentics-maintenance.yml. No repo variables changed and no safe-output tools added. issue-triage is unaffected: its lock, the issue-intent enablement on add-labels, and the v0.83.0 toolchain bump are all preserved. Validated with `gh aw compile` (v0.83.0) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile (maintenance workflow does not regenerate). Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget issue-triage agentic workflow to stable gh-aw v0.83.1 Bump the gh-aw compiler from v0.83.0 to the latest stable release v0.83.1 and recompile the issue-triage workflow. Scope is unchanged: only the issue-triage source/lock plus the directly required shared action lock; the maintenance workflow stays suppressed via aw.json. Source issue-triage.md is unchanged: frontmatter_hash and body_hash are identical, so the add-labels issue-intent enablement and all workflow behavior are preserved. Generated changes only: - issue-triage.lock.yml: compiler v0.83.0->v0.83.1, AWF v0.27.37->v0.27.38. - .github/aw/actions-lock.json: setup action v0.83.0->v0.83.1 (v0.83.1 no longer emits a separate setup-cli entry). Validated with `gh aw compile` (v0.83.1) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile, maintenance workflow not regenerated. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> * chore: initialize agentic workflow tooling Add the gh-aw agent, dispatcher skill, MCP configuration, Copilot setup workflow, and generated maintenance workflow. Co-authored-by: Copilot App <[email protected]> * Add macos keyring security doc (#13960) * chore(deps): bump github.com/gabriel-vasile/mimetype Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.14 to 1.4.15. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.14...v1.4.15) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-version: 1.4.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.23 to 0.0.24. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.23...v0.0.24) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Replace Windsurf with Devin in skill agents Co-authored-by: Copilot App <[email protected]> Copilot-Session: 93e6d7e7-48ed-4f1c-9ec2-a182d419e40d * chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Rewrite the pull request template The old template asked for nothing, so a pull request could satisfy it with an empty body. It now asks only for things a reviewer cannot get from the diff: the problem, testing evidence, reviewer guidance, and who is accountable for answering review. Co-authored-by: Copilot App <[email protected]> * Address review: restore TODO, flatten detachCmds, guard worktree symlink - Restore the non-fast-forward // TODO breadcrumb in syncBranchCmds - Early-return the non-worktree case in detachCmds to reduce nesting - Reject a --worktree target that is a leaf symlink or non-directory via ensureWorktreePathSafe, with unit coverage Co-authored-by: Copilot App <[email protected]> * Detect worktrees via git rev-parse and reject the current worktree - Replace isWorktreeAtPath path-matching with git rev-parse --show-prefix --git-common-dir, letting git resolve symlinks, "..", case, and trailing slashes; delete resolvePath/EvalSymlinks - Reject a --worktree target that resolves to the current worktree, which would otherwise silently switch the current tree's branch and print a nonsensical "cd ." hint Co-authored-by: Copilot App <[email protected]> * Fix worktree toplevel stub to match Windows absolute paths isCurrentWorktree resolves the target with filepath.Abs, which yields a drive-letter path on Windows (e.g. D:\path\to\wt). Match the -C target via a wildcard so the show-toplevel stub matches on all platforms. Co-authored-by: Copilot App <[email protected]> * Resolve worktree target once instead of re-querying git Collapse the separate worktree-detection helpers (isWorktreeAtPath, isCurrentWorktree, worktreeToplevel, worktreeInfoAtPath, repoCommonDir) into a single resolveWorktreeTarget call made once in checkoutRun. It runs two rev-parse queries (current + target) instead of the previous four and hands the command builders a plain reuseWorktree bool, so they no longer depend on the git client for detection and stay pure. Co-authored-by: Copilot App <[email protected]> * Trim redundant comments and clarify worktree field names Streamline comments in the worktree checkout path to only the non-obvious rationale, and rename the worktreeTarget fields to isCurrentWorktree and isExistingWorktree so they read clearly without explanation. Co-authored-by: Copilot App <[email protected]> * Drop docs on self-explanatory worktree helpers Match the surrounding codebase, which rarely documents unexported helpers: remove the godoc on worktreeCheckoutCmds and tighten syncBranchCmds, keeping comments only where the rationale is non-obvious. Co-authored-by: Copilot App <[email protected]> * Return ok bool from revParseFacts to satisfy nilerr resolveWorktreeTarget deliberately proceeds with default flags when a rev-parse fails, which the nilerr linter flagged as returning a nil error after a non-nil one. Have revParseFacts report success via an ok bool instead so the best-effort fallthrough is explicit and lint-clean. Co-authored-by: Copilot App <[email protected]> * Clarify current-worktree rejection message Reword the --worktree rejection to avoid the "current worktree" jargon, which is confusing for users who don't think of their main checkout as a worktree. Point at "the repository you're already in" instead. Co-authored-by: Copilot App <[email protected]> * Bail out early on unusable --worktree paths Reject --worktree paths that point inside a different repository or nest inside an existing worktree with clear messages, instead of deferring to git (which silently creates a nested worktree or emits a generic error). Fold all rejection cases into resolveWorktreeTarget, which now returns (reuseWorktree bool, error), removing the worktreeTarget struct and simplifying the checkoutRun guard. Co-authored-by: Copilot App <[email protected]> * Merge pull request #13985 from cli/williammartin-dependabot-triage-dry-run Add dependabot-triage agentic workflow * Fix skill picker label wrapping (#13967) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 9bf61d1c-810a-4324-874c-665275a607a9 * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.3 to 0.83.4. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/v0.83.3...e89c65e17eb281bbd5ff2ff9e9199a03e96654c7) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Add a code review agent skill (#14003) Co-authored-by: Copilot App <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Babak K. Shandiz <[email protected]> * Merge commit from fork * Add terminal-safety mechanisms for untrusted content Introduce the building blocks for keeping untrusted external content (HTTP response bodies and the like) from reaching a terminal as live ANSI escape sequences, while leaving the application's own styled output untouched. - iostreams.Untrusted: a value type that wraps external content. The raw bytes are unexported; String sanitizes and is called automatically by fmt, so the default print path is safe. Raw and RawBytes are the explicit, greppable opt-out for non-terminal uses (disk, the API, hashing), and the type carries its label across JSON decoding so a decoded field stays marked. - iostreams.ContentOut and SetContentSanitization: a sink that sanitizes raw external streams by default and becomes a passthrough when a command opts out, so the sanitization decision is made at the moment of writing. - A CodeQL query (with help text, examples, and a per-category test suite) that flags HTTP response content reaching a terminal writer other than ContentOut without sanitization, treating ContentOut, Untrusted.String, the asciisanitizer wrap, and structured JSON decoding as the accepted resolutions. Wire it into the existing CodeQL workflow. Co-authored-by: Copilot App <[email protected]> * Migrate gist view to the terminal-safety mechanisms GetRawGistFile now returns iostreams.Untrusted, so the two callers are forced to declare intent. gist view carries the value to the render function and lets the sink decide: the raw dump goes through ContentOut (which honors --allow-escape-sequences) and the markdown path sanitizes its input with String before rendering to Out. gist edit takes Raw, because the content is opened in an editor and sent back to the API and must round-trip verbatim. Co-authored-by: Copilot App <[email protected]> * Migrate skills to the terminal-safety mechanisms FetchBlob base64-decodes blob content out of the JSON response, so it now returns iostreams.Untrusted and its callers split by intent: skills preview sanitizes for display, while the installer (writes the file to disk) and the frontmatter parsers take Raw to operate on the verbatim bytes. Co-authored-by: Copilot App <[email protected]> * Migrate agent-task streaming logs to the terminal-safety mechanisms The agent-task chat completion chunk's Content and ReasoningText fields arrive over a streaming response, which is not a JSON content type, so the JSON transport sanitizer does not run on them. Type those fields as iostreams.Untrusted so provenance survives the per-line json.Unmarshal; printing them later sanitizes, and presence checks use Empty. This covers a path that flows resp.Body through json.Unmarshal to a printed field, which value dataflow cannot track but the type expresses directly. Co-authored-by: Copilot App <[email protected]> * Migrate repo read-file to the terminal-safety mechanisms read-file already refuses to print terminal escape sequences by default (and opts in with --allow-escape-sequences), so it guards its own bytes. Route its two raw writes through ContentOut instead of Out, in passthrough mode, so it uses the one sink the terminal-safety query recognizes while keeping its refuse-by-default behavior. Passthrough is required here: sanitizing would corrupt binary files and strip the escapes that --allow-escape-sequences explicitly allows. Co-authored-by: Copilot App <[email protected]> * Migrate pr diff to the terminal-safety mechanisms pr diff neutralized escape sequences only when stdout was a terminal, leaving piped and redirected output raw. Neutralize by default in all modes instead: the plain and name-only paths write through ContentOut, and the colored path wraps the diff reader in the shared asciisanitizer, since colored output is always terminal-bound. Add --allow-escape-sequences to opt back into raw bytes for the non-colored paths, for example when piping a patch to another program. This also replaces the command's bespoke sanitizer with the shared asciisanitizer. Co-authored-by: Copilot App <[email protected]> * Migrate api response output to the terminal-safety mechanisms gh api copied non-JSON response bodies straight to stdout, so escape sequences in the response reached the terminal unneutralized (JSON bodies are already cleaned by the transport). Route the raw copy through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped so binary payloads are not corrupted, and honors --allow-escape-sequences. Silent, verbose, and slurp writers are left in place. The colorized JSON path now sanitizes its input before jsoncolor adds color, keeping the color intact while removing the raw bytes. Co-authored-by: Copilot App <[email protected]> * Migrate release download stdout to the terminal-safety mechanisms release download --output - copied asset bytes straight to stdout, so escape sequences in an asset reached the terminal unneutralized. Route the stdout write through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped or redirected so binary assets are not corrupted, and honors --allow-escape-sequences. File downloads are unaffected. Co-authored-by: Copilot App <[email protected]> * Migrate codespace logs to the terminal-safety mechanisms gh codespace logs streams a remote log file over ssh by running cat or tail -f, and the shared ssh helper wires the command's stdout straight to os.Stdout, so the file's bytes reach the terminal without passing through this process and cannot be neutralized. Point the logs command's stdout at ContentOut instead: on a terminal this sanitizes escape sequences and forces the remote output through the process, while piped output stays raw so a follow stream is not buffered and saved logs keep their exact bytes. The shared helper is left untouched so the interactive ssh shell still passes control sequences through. Co-authored-by: Copilot App <[email protected]> * Build the CodeQL Go database from the shipped build The Go analysis previously relied on autobuild, which walks the whole tree and extracts the nested module under .github/codeql/queries' test fixtures as well as the main module. Both declare the same module path with their own pkg/iostreams, so the analyzer conflated the two and reported a flow through unrelated code. Switch the Go job to build-mode: manual and build with make, the same command the integration tests use. Extraction is then scoped to the packages the released gh binary compiles, which excludes the separate fixtures module, so the spurious finding is gone and the analyzed code matches what we ship. The actions job builds nothing, so it is marked build-mode: none. The query's own test suite is unchanged and still runs each fixture directory in isolation. Co-authored-by: Copilot App <[email protected]> * Match guarded-content errors by kind in tests Replace the binary-error boolean with a `wantErrAs` field so the table matches typed errors with errors.As and sentinels with errors.Is, mirroring how callers detect them. Any future typed error slots in without a new field. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Clarify that Untrusted wraps string content Co-authored-by: Copilot App <[email protected]> * Convert Untrusted tests to testify assertions Co-authored-by: Copilot App <[email protected]> * Collapse guarded content cases into the table test Co-authored-by: Copilot App <[email protected]> * Match binary terminal errors with errors.AsType Co-authored-by: Copilot App <[email protected]> * Reuse the raw gist content when writing it out Co-authored-by: Copilot App <[email protected]> * Cover the non-truncated gist file path Co-authored-by: Copilot App <[email protected]> * Document the refusal guarantee on CopyGuardedContent Co-authored-by: Copilot App <[email protected]> * Clear stale content when unmarshaling JSON null Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Merge commit from fork * feat(safeurl): add SafeURL package and CodeQL enforcement query Introduce internal/safeurl, which builds HTTP request URLs from variable components that are percent-encoded when rendered, so user or server controlled values cannot break the path or change which resource is addressed. It provides the SafeURL interface, the MutableSafeURL and ImmutableSafeURL implementations, the JoinPath and JoinPathWithHostPrefix builders, and NewImmutableSafeURL for entrusting already-formed URLs. Because percent-encoding leaves a component that is exactly ".." intact as a real path segment, JoinPath and JoinPathWithHostPrefix reject any such component and return an error, which callers bubble up to the command level. Also add a CodeQL query that flags any HTTP request URL argument that is not literally the result of a safeurl.SafeURL.String call. Co-authored-by: Copilot <[email protected]> * refactor(api): route REST paths through SafeURL Build the hand-written REST paths in the shared API layer with safeurl so their variable components are escaped. CreateRepoTransformToV4 now takes a safeurl.SafeURL path instead of a string. Co-authored-by: Copilot <[email protected]> * refactor(repo): build REST paths with SafeURL Escape the variable components of the repo command REST paths. The new read-file command builds its Contents API URL with safeurl, and the repo create and edit commands pass a safeurl.SafeURL to CreateRepoTransformToV4. Co-authored-by: Copilot <[email protected]> * refactor(run): build REST paths with SafeURL Escape the variable components of the run command REST paths. GetJobs no longer mutates the Run; it takes an entrusted jobs URL and a run id and returns the jobs, so its callers assign them explicitly. Co-authored-by: Copilot <[email protected]> * refactor(release): build REST paths with SafeURL Escape the variable components of the release command REST paths. The upload and delete-asset pipeline threads a safeurl.SafeURL through, so the asset upload URL and AssetForUpload.ExistingURL are carried as SafeURL. Co-authored-by: Copilot <[email protected]> * refactor(codespace): build REST paths with SafeURL Escape the variable components of the codespace command REST paths. The NWO validation helper moves out of safeurl into the codespace package, where it is the only remaining caller. Co-authored-by…

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 22, 2026

dependabot Bot requested a review from a team as a code owner July 22, 2026 15:45

dependabot Bot requested a review from williammartin July 22, 2026 15:45

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 22, 2026

BagToad approved these changes Jul 22, 2026

View reviewed changes

BagToad merged commit 2f012c2 into trunk Jul 22, 2026
42 checks passed

BagToad deleted the dependabot/go_modules/github.com/gabriel-vasile/mimetype-1.4.14 branch July 22, 2026 16:32

BrewTestBot mentioned this pull request Jul 31, 2026

gh 2.97.0 Homebrew/homebrew-core#296261

Merged

scottames-github-bot Bot mentioned this pull request Aug 4, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1003

Merged

1 task

Navigation Menu

Uh oh!

chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 - #13944

chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14#13944
BagToad merged 1 commit into
trunkfrom
dependabot/go_modules/github.com/gabriel-vasile/mimetype-1.4.14

dependabot Bot commented on behalf of github Jul 22, 2026

Uh oh!

BagToad left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 22, 2026

v1.4.14 pyc, pcap, cycloned, gedcom support

Media type changes

Full changelog

New Contributors

v1.4.14-rc1 pyc, pcap, cycloned support

Media type changes

Full changelog

Uh oh!

BagToad left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant