## Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via `gh codespace jupyter`.

Users of `gh codespace jupyter` are advised to update gh to version v2.96.0 as soon as possible.

For more information see: https://github.com/cli/cli/security/advisories/GHSA-8cg3-r6g9-fpg2

## Download release assets without authentication

`gh release download` now works against public repositories without authentication, matching `gh extension install`. A token is still used when one is present:

```shell
# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli
```

## What's Changed

### ✨ Features

* Allow `gh release download` without authentication on public repositories by @BagToad in [#13723](https://github.com/cli/cli/pull/13723)
* Detect additional third-party coding agents by @BagToad in [#13722](https://github.com/cli/cli/pull/13722)
* Support `antigravity-cli` and `antigravity2.0` in `gh skill` by @BagToad in [#13784](https://github.com/cli/cli/pull/13784)

### 🐛 Fixes

* fix: show checks summary when all checks were cancelled by @s3onghyun in [#13679](https://github.com/cli/cli/pull/13679)
* fix(skills): install universal agent to `~/.agents/skills` by @toller892 in [#13681](https://github.com/cli/cli/pull/13681)
* fix(skills): honor `--dir` without agent prompt by @happysnaker in [#13766](https://github.com/cli/cli/pull/13766)
* Fix concurrent map writes in codespace port forwarding by @williammartin in [#13313](https://github.com/cli/cli/pull/13313)
* Use `int64` for GitHub database IDs by @williammartin in [#13403](https://github.com/cli/cli/pull/13403)

### 📚 Docs & Chores

* Pin reusable triage workflows to a commit SHA by @BagToad in [#13705](https://github.com/cli/cli/pull/13705)
* Add security disclosure guidance to `AGENTS.md` by @BagToad in [#13720](https://github.com/cli/cli/pull/13720)
* Clarify `--clone` boolean flag behaviour in `gh repo fork` help by @BagToad in [#13786](https://github.com/cli/cli/pull/13786)
* Fix flaky `TestHuhPrompterMultiSelectWithSearchPersistence` on slow architectures by @pdostal in [#13675](https://github.com/cli/cli/pull/13675)
* docs(search): add examples for multiple qualifiers by @happysnaker in [#13756](https://github.com/cli/cli/pull/13756)
* docs: fix broken anchor link in release-process-deep-dive by @patrickwehbe in [#13688](https://github.com/cli/cli/pull/13688)
* docs: fix broken install command and link/grammar errors by @patrickwehbe in [#13690](https://github.com/cli/cli/pull/13690)
* docs: fix duplicated word in primer README by @s3onghyun in [#13677](https://github.com/cli/cli/pull/13677)

### :dependabot: Dependencies

* chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @dependabot in [#13708](https://github.com/cli/cli/pull/13708)
* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in [#13703](https://github.com/cli/cli/pull/13703)
* chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot in [#13702](https://github.com/cli/cli/pull/13702)
* chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in [#13740](https://github.com/cli/cli/pull/13740)
* chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot in [#13754](https://github.com/cli/cli/pull/13754)
* chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot in [#13759](https://github.com/cli/cli/pull/13759)
* chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in [#13779](https://github.com/cli/cli/pull/13779)

## New Contributors
* @patrickwehbe made their first contribution in https://github.com/cli/cli/pull/13688
* @s3onghyun made their first contribution in https://github.com/cli/cli/pull/13679
* @toller892 made their first contribution in https://github.com/cli/cli/pull/13681
* @happysnaker made their first contribution in https://github.com/cli/cli/pull/13756

**Full Changelog**: https://github.com/cli/cli/compare/v2.95.0...v2.96.0

## Read repository files and directories with `gh repo read-file` and `gh repo read-dir`

Two new preview commands read repository contents without cloning:

```shell
# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli
```

Both commands default to the repository's default branch, accept `--ref` to target any branch, tag, or commit, and support `--json`, `--jq`, and `--template` for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

> [!NOTE]
> `gh repo read-file` and `gh repo read-dir` are in preview and subject to change without notice.

## What's Changed

### ✨ Features

* feat: add `repo read-file` and `repo read-dir` by @babakks in https://github.com/cli/cli/pull/13580
* feat(skills): list available skills when install runs non-interactively by @SamMorrowDrums in https://github.com/cli/cli/pull/13548
* Support custom CLAUDE_CONFIG_DIR in install by @tommaso-moro in https://github.com/cli/cli/pull/13523

### 🐛 Fixes

* fix(skills): stage updates in a temp dir and swap in-place by @SamMorrowDrums in https://github.com/cli/cli/pull/13449

### 📚 Docs & Chores

* Make filtering by bot authors more discoverable by @BagToad in https://github.com/cli/cli/pull/13642
* docs(discussion): polish help docs by @babakks in https://github.com/cli/cli/pull/13632
* Bump Go in devcontainer by @spenserblack in https://github.com/cli/cli/pull/13674

### :dependabot: Dependencies

* chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13640
* chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13663
* chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13661
* chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13619
* chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13662
* chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13641


**Full Changelog**: https://github.com/cli/cli/compare/v2.94.0...v2.95.0

## Issue types, sub-issues, and relationships in `gh issue`

<img width="2784" height="1494" alt="issue-view-monas-cafe-with-frame" src="https://github.com/user-attachments/assets/fd2c6a89-0ac2-472d-a1df-b4e6124f270b" />


This release brings GitHub's advanced issue features to `gh issue create`, `edit`, `view`, and `list`. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

```shell
# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300
```

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

## Manage discussions with `gh discussion`

<img width="2784" height="1179" alt="discussion-view-monas-cafe-with-frame" src="https://github.com/user-attachments/assets/c625fe16-b625-4b24-b8b1-80e0c5336b8c" />


This release introduces the `discussion` command set for working with GitHub Discussions in `gh`:

```shell
# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>
```

Run `gh discussion --help` for more information.

> [!NOTE]
> The `discussion` command set is in preview and is subject to change without notice.

## Equip your agents with new `gh` features

Teach your agents how to leverage new GitHub CLI features on release day by installing the `gh` skill:

```shell
# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh
```

## What's Changed

### ✨ Features

* Add `gh discussion` command set (`list`, `view`, `create`, `edit`) as a preview by @babakks and @maxbeizer in [#13541](https://github.com/cli/cli/pull/13541)
* Add `gh discussion comment` to comment on and reply to discussions by @babakks in [#13620](https://github.com/cli/cli/pull/13620)
* Add Issues 2.0 support: issue types, sub-issues, and relationships by @BagToad in [#13057](https://github.com/cli/cli/pull/13057)
* Add `gh skill list` to inventory installed agent skills by @tommaso-moro in [#13418](https://github.com/cli/cli/pull/13418)
* Add `--all` flag to `gh skill install` to install every skill in a repository by @tommaso-moro in [#13471](https://github.com/cli/cli/pull/13471)
* Skip skills without metadata when running `gh skill update --all` by @tommaso-moro in [#13469](https://github.com/cli/cli/pull/13469)
* Alias `gh extension uninstall` to `gh extension remove` by @BagToad in [#13599](https://github.com/cli/cli/pull/13599)
* Auto-install official extensions in CI by @BagToad in [#13581](https://github.com/cli/cli/pull/13581)

### 🐛 Fixes

* fix(skill): support skill discovery in nested directories by @tommaso-moro in [#13459](https://github.com/cli/cli/pull/13459)

### 📚 Docs & Chores

* Bump Go to 1.26.4 by @github-actions[bot] in [#13578](https://github.com/cli/cli/pull/13578)
* Clean up deferred issue update helper by @BagToad in [#13584](https://github.com/cli/cli/pull/13584)
* Add terminal-mockup canvas extension for marketing screenshots by @BagToad in [#13612](https://github.com/cli/cli/pull/13612)
* Add `gh discussion` and Issues 2.0 reference to the `gh` skill, plus a README note by @BagToad in [#13631](https://github.com/cli/cli/pull/13631)

### :dependabot: Dependencies

* chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot in [#13521](https://github.com/cli/cli/pull/13521)
* chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10 by @dependabot in [#13520](https://github.com/cli/cli/pull/13520)
* chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @dependabot in [#13572](https://github.com/cli/cli/pull/13572)
* chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7 by @dependabot in [#13595](https://github.com/cli/cli/pull/13595)
* chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot  in [#13596](https://github.com/cli/cli/pull/13596)
* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot in [#13597](https://github.com/cli/cli/pull/13597)


**Full Changelog**: https://github.com/cli/cli/compare/v2.93.0...v2.94.0