chore(deps): update dependency github:cli/cli to v2.91.0

[ivy-s-renovate-bot]

This PR contains the following updates:

Package	Update	Change
github:cli/cli	minor	2.87.3 → 2.91.0

---

Release Notes

cli/cli (github:cli/cli)

v2.91.0: GitHub CLI 2.91.0

Compare Source

GitHub CLI now collects pseudonymous telemetry

To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry.

See Telemetry for more details on what's collected, why, and how to opt out.

Support more agents in gh skill

Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help for the list of available agents.

Improve skill discovery

gh skill install now adds the --allow-hidden-dirs flag to support discovering skills in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

Detect skills re-published from other sources

GitHut CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The --upstream flag is also added for non-interactive use cases.

What's Changed

✨ Features

• Add support for installation in multiple agent hosts in gh skills install by @​tommaso-moro in #​13209
• Add --allow-hidden-dirs flag to gh skill install by @​SamMorrowDrums in #​13213
• Make skill discovery less strict: support nested skills/ directories by @​SamMorrowDrums in #​13235
• feat(skills): detect re-published skills and offer upstream install by @​SamMorrowDrums in #​13236

🐛 Fixes

• Fix skills publish --fix to not publish by @​SamMorrowDrums in #​13237
• fix(skills): match skills by install name in preview command by @​SamMorrowDrums in #​13249

📚 Docs & Chores

• Remove misleading text by @​tommaso-moro in #​13203
• Add sampled command telemetry by @​williammartin in #​13191
• Do not send telemetry for aliases by @​williammartin in #​13192
• Add skills specific telemetry by @​williammartin in #​13204
• Record CI context in telemetry by @​williammartin in #​13210
• Record official extension telemetry by @​williammartin in #​13205
• Add telemetry command by @​williammartin in #​13253
• Log when there is no telemetry by @​williammartin in #​13255
• docs(skills): add gh and gh-skill agent skills by @​BagToad in #​13244
• Enable telemetry without env var by @​williammartin in #​13254

Full Changelog: cli/cli@v2.90.0...v2.91.0

v2.90.0: GitHub CLI 2.90.0

Compare Source

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features

• Add gh skill command group: install, preview, search, update, publish by @​SamMorrowDrums and @​tommaso-moro in #​13165
• Suggest and install official extensions for unknown commands by @​BagToad in #​13175
• gh skill publish: auto-push unpushed commits before publish by @​SamMorrowDrums in #​13171
• Disable auth check for gh extension install by @​BagToad in #​13176

🐛 Fixes

• Fix infinite loop in gh release list --limit 0 by @​Bahtya in #​13097
• Ensure api and auth commands record agentic invocations by @​williammartin in #​13046
• Disable auth check for local-only skill flags by @​SamMorrowDrums in #​13173
• URL-encode parentPath in skills discovery API call by @​SamMorrowDrums in #​13172
• Fix: use target directory remotes in skills publish by @​SamMorrowDrums in #​13169
• Fix: preserve namespace in skills search deduplication by @​SamMorrowDrums in #​13170

📚 Docs & Chores

• docs: include PGP key fingerprints by @​babakks in #​13112
• docs: add sha/md5 checksums of keyring files by @​babakks in #​13150
• docs: fix SHA512 checksum for GPG key by @​timsu92 in #​13157
• docs(skill): polish skill commandset docs by @​babakks in #​13183
• Document dependency CVE policy in SECURITY.md by @​BagToad in #​13119
• Replace github.com/golang/snappy with klauspost/compress/snappy by @​thaJeztah in #​13048
• chore: bump to go1.26.2 by @​babakks in #​13116
• chore: delete experimental script/debian-devel by @​babakks in #​13127
• Suggest first party extensions by @​williammartin in #​13182
• Add cli/skill-reviewers as CODEOWNERS for skills packages by @​BagToad in #​13189
• Add @​cli/code-reviewers to all CODEOWNERS rules by @​BagToad in #​13190
• Address post-merge review feedback for skills commands by @​SamMorrowDrums in #​13185
• Fix skills-publish-dry-run acceptance test error message mismatch by @​SamMorrowDrums in #​13187
• Skills: replace real git in publish tests with CommandStubber by @​SamMorrowDrums in #​13188
• Remove redundant nil-client fallback in skills publish by @​SamMorrowDrums in #​13168
• Publish: use shared discovery logic instead of requiring skills/ directory by @​SamMorrowDrums in #​13167

Dependencies

• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @​dependabot[bot] in #​13071
• chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @​dependabot[bot] in #​13045
• chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @​dependabot[bot] in #​13051
• chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @​dependabot[bot] in #​13152
• chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @​dependabot[bot] in #​13129
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @​dependabot[bot] in #​13128
• chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @​dependabot[bot] in #​13044
• chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @​dependabot[bot] in #​12918
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @​dependabot[bot] in #​13076
• chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @​dependabot[bot] in #​13065

New Contributors

• @​thaJeztah made their first contribution in #​13048
• @​Bahtya made their first contribution in #​13097
• @​timsu92 made their first contribution in #​13157
• @​SamMorrowDrums made their first contribution in #​13173
• @​tommaso-moro made their first contribution in #​13165

Full Changelog: cli/cli@v2.89.0...v2.90.0

v2.89.0: GitHub CLI 2.89.0

Compare Source

gh agent-task now works on ghe.com tenancies

gh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works correctly regardless of your GitHub hosting environment.

Experimental new prompter

A new TUI-based prompter powered by charmbracelet/huh is available behind the GH_EXPERIMENTAL_PROMPTER environment variable. This is an early preview — try it out and share feedback!

export GH_EXPERIMENTAL_PROMPTER=1

gh issue create and gh issue transfer no longer require extra token scopes

gh issue create and gh issue transfer previously fetched repository fields they didn't need, which could require additional token scopes. These commands now fetch only the minimal fields necessary for issue operations.

What's Changed

✨ Features

• gh pr create, gh issue create, gh issue edit: search-based assignee selection and login-based mutation on github.com by @​BagToad in #​13009
• Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER by @​BagToad in #​12859

🐛 Fixes

• fix(agent-task): resolve Copilot API URL dynamically for ghe.com tenancies by @​BagToad in #​12956
• fix(issue): avoid fetching unnecessary fields in issue create and issue transfer by @​babakks in #​12884
• fix: resolve data race in codespaces port forwarder by @​Lslightly in #​13033

📚 Docs & Chores

• Record agentic invocations in User-Agent header by @​williammartin in #​13023
• docs: clarify that gh pr edit --add-reviewer can re-request reviews by @​joshjohanning in #​13021
• Add AGENTS.md by @​williammartin in #​13024
• Fix typo: remove extra space in README.md link by @​realMelTuc in #​12725
• Align triage.md with current triage process by @​tidy-dev in #​13030
• Remove auto-labels from issue templates by @​tidy-dev in #​12972
• Consolidate actor-mode signals into ApiActorsSupported by @​BagToad in #​13025
• Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by @​BagToad in #​13037

Dependencies

• chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @​dependabot[bot] in #​12963
• chore(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.3 by @​dependabot[bot] in #​12962
• chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 by @​dependabot[bot] in #​13031
• chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 by @​dependabot[bot] in #​13005
• chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by @​dependabot[bot] in #​13004
• chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @​dependabot[bot] in #​12951

New Contributors

• @​joshjohanning made their first contribution in #​13021
• @​realMelTuc made their first contribution in #​12725
• @​Lslightly made their first contribution in #​13033

Full Changelog: v2.88.1...v2.89.0

v2.88.1: GitHub CLI 2.88.1

Compare Source

Fix pr commands failing with read:project scope error

v2.88.0 introduced a regression where pr commands would fail with the error:

error: your authentication token is missing required scopes [read:project]
To request it, run:  gh auth refresh -s read:project

Previously, missing read:project scope was gracefully handled, and project data was silently skipped. A change inadvertently broke the error matching that enabled this graceful degradation. v2.88.1 reverts these changes so that pr commands work correctly without requiring the read:project scope.

What's Changed

• Migrate Windows code signing from client secret to OIDC by @​BagToad in #​12911
• Revert "refactor: deduplicate scope error handling between api/client.go and project queries" by @​williammartin in #​12914
• Revert "fix: clarify scope error while creating issues for projects" by @​williammartin in #​12915

Full Changelog: cli/cli@v2.88.0...v2.88.1

v2.88.0: GitHub CLI 2.88.0

Compare Source

Request Copilot Code Review from gh

gh pr create and gh pr edit now support Copilot Code Review as a reviewer. Request a review with --add-reviewer @​copilot, or select Copilot interactively from the searchable reviewer prompt.

Create a pull request and request review from Copilot:

gh pr create --reviewer @​copilot

Edit a pull request and request review from Copilot:

gh pr edit --add-reviewer @​copilot

Close issues as duplicates with gh issue close --duplicate-of

You can now close issues as duplicates and link to a duplicate issue directly from the CLI. The new --duplicate-of flag accepts an issue number or URL and marks the closed issue as a duplicate of the referenced one. You can also use --reason duplicate to set the close reason without linking a specific issue.

# Close as duplicate, linking to the original issue
gh issue close 123 --duplicate-of 456

# Close with duplicate reason only
gh issue close 123 --reason duplicate

JSON support for gh agent-task

gh agent-task list and gh agent-task view now support --json, --jq, and --template flags, consistent with other gh commands.

gh agent-task list --json id,name,state
gh agent-task view <id> --json state --jq '.state'

What's Changed

✨ Features

• gh pr create: login-based reviewer requests and search-based interactive selection by @​BagToad in #​12627
• gh pr view and gh issue view: show friendly display names for all actors by @​BagToad in #​12854
• gh issue close: add --duplicate-of flag and duplicate reason by @​tksohishi in #​12811
• gh pr diff: add --exclude flag to filter files from diff output by @​yuvrajangadsingh in #​12655
• gh pr view/list: add changeType field to files JSON output by @​yuvrajangadsingh in #​12657
• gh repo clone: add --no-upstream flag by @​4RH1T3CT0R7 in #​12686
• gh repo edit: add --squash-merge-commit-message flag by @​yuvrajangadsingh in #​12846
• gh browse: add --blame flag by @​masonmcelvain in #​11486
• gh agent-task list: add --json support by @​maxbeizer in #​12806
• gh agent-task view: add --json support by @​maxbeizer in #​12807
• gh copilot: set COPILOT_GH env var when launching Copilot CLI by @​devm33 in #​12821

🐛 Fixes

• Fix gh project item-edit error when editing Draft Issue with only one (--title/--body) flag by @​ManManavadaria in #​12787
• Fix extension install error message showing raw struct instead of owner/repo by @​Copilot in #​12836
• Fix incorrect integer conversion from int to uint16 in port forwarder by @​BagToad in #​12831
• Fix invalid ANSI SGR escape code in JSON and diff colorization by @​BagToad in #​12720
• Fix assignees databaseId always being 0 in --json output by @​srt32 in #​12783
• Fix error when --remote flag used with repo argument by @​majiayu000 in #​12375
• Fix redundant API call in gh issue view --comments by @​VishnuVV27 in #​12652
• Clarify scope error while creating issues for projects by @​elijahthis in #​12596
• Reject pull request-only search qualifiers in gh issue list by @​LouisLau-art in #​12623
• Prevent .git/config corruption on repeated issue develop --name invocation by @​gunadhya in #​12651
• Use pre-compiled regexp for matching Content-Type by @​itchyny in #​12781
• Isolate generated licenses per platform (os/arch) by @​babakks in #​12774

📚 Docs & Chores

• Add examples to gh issue close help text by @​BagToad in #​12830
• Customizable install prefix in Makefile by @​scarf005 in #​11714
• Deduplicate scope error handling between api/client.go and project queries by @​yuvrajangadsingh in #​12845
• Remove unnecessary StateReason and StateReasonDuplicate feature detection by @​BagToad in #​12838
• Update Go version requirement to 1.26+ by @​BagToad in #​12864
• Add monthly pitch surfacing workflow by @​tidy-dev in #​12894

Dependencies

• Bump Go from 1.25.7 to 1.26.1 by @​BagToad in #​12860
• chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 by @​dependabot[bot] in #​12886
• chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.2 by @​dependabot[bot] in #​12851
• chore(deps): bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible by @​dependabot[bot] in #​12842
• chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 by @​dependabot[bot] in #​12759
• chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​12760
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​12797
• chore(deps): bump actions/download-artifact from 7 to 8 by @​dependabot[bot] in #​12796
• chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @​dependabot[bot] in #​12795
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.11 to 1.4.13 by @​dependabot[bot] in #​12615

New Contributors

• @​srt32 made their first contribution in #​12783
• @​itchyny made their first contribution in #​12781
• @​VishnuVV27 made their first contribution in #​12652
• @​elijahthis made their first contribution in #​12596
• @​ManManavadaria made their first contribution in #​12787
• @​maxbeizer made their first contribution in #​12806
• @​LouisLau-art made their first contribution in #​12623
• @​4RH1T3CT0R7 made their first contribution in #​12686
• @​yuvrajangadsingh made their first contribution in #​12657
• @​masonmcelvain made their first contribution in #​11486
• @​scarf005 made their first contribution in #​11714
• @​tksohishi made their first contribution in #​12811
• @​tidy-dev made their first contribution in #​12894

Full Changelog: cli/cli@v2.87.3...v2.88.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.