chore(deps): update dependency gh to v2.96.0

[renovate]

This PR contains the following updates:

Package	Update	Change
gh	minor	2.95.0 → 2.96.0

---

Release Notes

cli/cli (gh)

v2.96.0: GitHub CLI 2.96.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features

• Allow gh release download without authentication on public repositories by @​BagToad in #​13723
• Detect additional third-party coding agents by @​BagToad in #​13722
• Support antigravity-cli and antigravity2.0 in gh skill by @​BagToad in #​13784

🐛 Fixes

• fix: show checks summary when all checks were cancelled by @​s3onghyun in #​13679
• fix(skills): install universal agent to ~/.agents/skills by @​toller892 in #​13681
• fix(skills): honor --dir without agent prompt by @​happysnaker in #​13766
• Fix concurrent map writes in codespace port forwarding by @​williammartin in #​13313
• Use int64 for GitHub database IDs by @​williammartin in #​13403

📚 Docs & Chores

• Pin reusable triage workflows to a commit SHA by @​BagToad in #​13705
• Add security disclosure guidance to AGENTS.md by @​BagToad in #​13720
• Clarify --clone boolean flag behaviour in gh repo fork help by @​BagToad in #​13786
• Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @​pdostal in #​13675
• docs(search): add examples for multiple qualifiers by @​happysnaker in #​13756
• docs: fix broken anchor link in release-process-deep-dive by @​patrickwehbe in #​13688
• docs: fix broken install command and link/grammar errors by @​patrickwehbe in #​13690
• docs: fix duplicated word in primer README by @​s3onghyun in #​13677

Dependencies

• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @​dependabot in #​13708
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot in #​13703
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @​dependabot in #​13702
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot in #​13740
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @​dependabot in #​13754
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @​dependabot in #​13759
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot in #​13779

New Contributors

• @​patrickwehbe made their first contribution in #​13688
• @​s3onghyun made their first contribution in #​13679
• @​toller892 made their first contribution in #​13681
• @​happysnaker made their first contribution in #​13756

Full Changelog: cli/cli@v2.95.0...v2.96.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud