SUSE alert openSUSE-SU-2026:0309-1 (gh)

From:
             
 
maintenance@opensuse.org
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:0309-1: important: Security update for gh
Date:
             
 
Sun, 30 Aug 2026 15:08:05 +0200
Message-ID:
             
 
<20260830130805.2C2EEFDD4@maintenance.suse.de>
Archive-link:
             
 
Article

   openSUSE Security Update: Security update for gh
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2026:0309-1
Rating:             important
References:         #1266618 
Cross-References:   CVE-2026-39821 CVE-2026-64652 CVE-2026-64653
                    CVE-2026-64654 CVE-2026-64655
CVSS scores:
                    CVE-2026-39821 (SUSE): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:
                    openSUSE Backports SLE-15-SP7
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   This update for gh fixes the following issues:

   - Update to version 2.98.0:
     * chore: fix extra whitespace
     * Default Codespaces port forwarding to loopback
     * Bump gh-aw-actions to v0.87.1 and recompile workflows
     * Fix issue triage action compatibility
     * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
     * chore: bump go to 1.26.7 (#14205)
     * chore(deps): bump the codeql-actions group across 1 directory with 3
       updates
     * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1
     * Revert "ci: add temporary step to verify Linux repo signing keys"
     * ci: add temporary step to verify Linux repo signing keys
     * Accept pre-release tags in deployment validation (#14193)
     * chore: sign APT repositories with both keys
     * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6
     * chore(deps): bump the aw-actions group with 2 updates
     * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
     * Bump Go to 1.26.6
     * Upgrade gh-aw workflows to v0.85.4
     * chore(deps): bump github.com/google/go-containerregistry
     * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
     * Address review: drop cleanup markers, document search-type in skill
     * Reconcile feature detection cleanup comment rules in AGENTS.md
     * Update AGENTS.md with cleanup comment guidance
     * Address review feedback
     * Add --search-type flag for semantic and hybrid issue search
     * Rename config mock constructors to match repo convention
     * Document when to use the config mock or the isolated config
     * Accept config content in NewIsolatedTestConfig
     * Clear auth environment variables in isolated test config
     * Isolate git config in tests that shell out to git
     * Rename config stub file to test.go
     * chore(deps): bump the aw-actions group with 2 updates
     * Add aw-actions group to dependabot configuration
     * Rename cli-code-reviewer skill to code-review (#14116)
     * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4
     * Reduce item-add test diff
     * Isolate item-add test mocks
     * Test item-add output through command path
     * Run lint workflow when the lint workflow changes
     * Bump golangci-lint in CI to v2.12.2
     * Clarify PR testing section expectations
     * chore(deps): bump the codeql-actions group across 1 directory with 3
       updates
     * chore(deps): bump azure/login from 3.0.0 to 3.0.1
     * chore(deps): bump actions/attest from 4.2.1 to 4.2.2
     * Use reflect.Pointer instead of deprecated reflect.Ptr
     * Add a scheduled tech debt burndown skill (#14095)
     * Restore automatic spam issue closure (#14088)
     * Give Dependabot triage a real reachability check (#14087)
     * Route release deletions through api.Client (#14077)
     * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0
     * chore(deps): bump github.com/google/go-containerregistry
     * Grant the gate the scopes its CI read needs
     * Keep pre-flight dedup out of the integrity proxy
     * Key direct/indirect off the // indirect comment
     * Gate triager confidence on required evidence
     * Gate Dependabot triage on deterministic pre-flight check
     * Set GH_EXTENSION=1 when gh invokes an extension
     * Tell agents to use the PR template in AGENTS.md
     * Merge pull request #14062 from cli/williammartin-wp-08-release-create
     * Route extension requests through api.Client (#14059)
     * Route autolink requests through api.Client (#14013)
     * chore(deps): bump the codeql-actions group across 1 directory with 3
       updates
     * fix(release create): trim spaces when parsing X-Oauth-Scopes
     * Match worktree rev-parse stub against absolute path on Windows
     * fix(pr/checkout): pass -- before worktree path so dash paths work
     * docs(pr/checkout): add worktree usage example to help text
     * docs(skills): mention pr checkout worktree support
     * chore(pr checkout): polish worktree related tests
     * Route gpg key requests through api.Client (#13997)
     * Use generated key in ssh-key acceptance test
     * Route ssh key requests through api.Client
     * Fix item-add output for non-TTY
     * test(pr/checkout): add acceptance tests for worktree checkout
     * chore(deps): bump actions/attest from 4.2.0 to 4.2.1
     * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0
     * Generate unique acceptance SSH keys
     * Route deploy key requests through api.Client
     * Collapse spam triage into the agentic issue-triage workflow (#14027)
     * Run Dependabot triage hourly
     * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5
     * Require explicit PR review ownership (#14028)
     * Slim down dependabot triage comments (#14019)
     * Wrap RESTWithNext errors as api.HTTPError
     * Bail out early on unusable --worktree paths
     * Clarify current-worktree rejection message
     * Return ok bool from revParseFacts to satisfy nilerr
     * Drop docs on self-explanatory worktree helpers
     * Trim redundant comments and clarify worktree field names
     * Resolve worktree target once instead of re-querying git
     * Fix worktree toplevel stub to match Windows absolute paths
     * Detect worktrees via git rev-parse and reject the current worktree
     * Address review: restore TODO, flatten detachCmds, guard worktree
       symlink
     * Cover detach-reuse, worktree fetch dir, and symlink path resolution
     * Harden worktree submodule prefixing and cover cmd.Dir stripping
     * Create branch when reusing a worktree with a new --branch name
     * Extract authenticatedCommand helper to dedupe -C handling
     * Preserve no-force safety when reusing a worktree for fork PRs
     * Simplify submodule worktree prefix to inline conditional
     * Run submodule commands inside the worktree for pr checkout
     * tidying..
     * Refine PR checkout worktree flag help
     * Add --worktree flag to gh pr checkout

   - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
     Punycode-encoded labels allows for validation bypass and privilege
     escalation (bsc#1266618).

   - Update to version 2.97.0, fixing four security issues (CVE-2026-64654,
     CVE-2026-64653, CVE-2026-64652, CVE-2026-64655):
     * CVE-2026-64654: terminal escape sequence injection in gist view, api,
       pr diff, release download --output -, codespace logs, skills preview
       and agent-task view/create
     * CVE-2026-64653: unescaped variable path components in request URLs
       could redirect gh to a different resource than intended
     * CVE-2026-64652: gh auth status could print part of the auth token in
       plaintext for token types with an underscore after the prefix
     * CVE-2026-64655: gh attestation verify built its --signer-repo/
       --signer-workflow matcher without escaping regex metacharacters,
        allowing a lookalike signer to pass verification
     * Add named field columns to gh project item-list and item-edit


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP7:

      zypper in -t patch openSUSE-2026-309=1



Package List:

   - openSUSE Backports SLE-15-SP7 (i586 s390x x86_64):

      gh-2.98.0-bp157.2.29.1
      gh-debuginfo-2.98.0-bp157.2.29.1

   - openSUSE Backports SLE-15-SP7 (aarch64 ppc64le):

      gh-2.98.0-bp157.2.27.1

   - openSUSE Backports SLE-15-SP7 (noarch):

      gh-bash-completion-2.98.0-bp157.2.27.1
      gh-bash-completion-2.98.0-bp157.2.29.1
      gh-fish-completion-2.98.0-bp157.2.27.1
      gh-fish-completion-2.98.0-bp157.2.29.1
      gh-zsh-completion-2.98.0-bp157.2.27.1
      gh-zsh-completion-2.98.0-bp157.2.29.1


References:

   https://www.suse.com/security/cve/CVE-2026-39821.html
   https://www.suse.com/security/cve/CVE-2026-64652.html
   https://www.suse.com/security/cve/CVE-2026-64653.html
   https://www.suse.com/security/cve/CVE-2026-64654.html
   https://www.suse.com/security/cve/CVE-2026-64655.html
   https://bugzilla.suse.com/1266618