{"id":"openSUSE-SU-2026:21861-1","summary":"Security update for gh","details":"This update for gh fixes the following issues:\n\nChanges in gh:\n\nUpdate to version 2.100.0, fixing two deadlock issues in the vendored\ngolang.org/x/crypto/ssh library reachable via crafted SSH channel\nmessages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):\n  \n* Fix gh api telemetry disablement\n* Bump go-gh to v2.16.0\n* Expose per-host API host config\n* chore: bump toolchain to go1.26.8\n* chore: bump golang.org/x/crypto to 0.56.0\n* Record attachment invocation telemetry\n* Add webhook as an official extension\n* Merge pull request #14318 from cli/issue-triage-improvements\n* Refine GHES support wording\n* Use version-neutral GHES support link\n* Clarify supported GHES versions\n* Bump go-gh to v2.15.0\n* Remove redundant searcher comment\n* Remove unnecessary 204 on release edit\n* Remove redundant comment in gist create\n* Comment api command api_host usage\n* Comment missing api-client-rollout todo\n* Document when telemetry disabling is overzealous\n* Refactor AddAuthTokenHeader\n* Rename tokenGetter to config\n* build(deps): bump go-gh to rebased per-host api_host branch\n* refactor(attachments): send uploads through api.Client.DoRequest\n* test(internal/attachments): add new method required by interface\n* fix(api): compare request hostname without port when attaching auth token\n* test(acceptance): fix scriptfilter table field alignment\n* build(deps): bump go-gh to per-host api_host branch\n* chore(codeql): cover api.Client.Request in SafeURL path query\n* fix(auth/shared): route GetScopes path through safeurl\n* test(config): add coverage for APIHostForHost\n* test(config): cover deterministic api_host collision resolution\n* test(api): assert DoRequest preserves an explicit ContentLength\n* test(acceptance): cover selecting multiple scripts in one directory\n* refactor(api): use errors.AsType for HTTP error checks\n* fix(config): resolve api_host collisions deterministically\n* docs(api): clarify redirect method-rewriting in comments\n* Send release asset uploads and downloads through api.Client\n* Let callers set headers on a shared client request\n* Let a caller stop a request following redirects\n* Let a caller name the scopes an endpoint needs\n* Add a raw response request surface to api.Client\n* Send RenameRepo to a relative path\n* Make gh api honour api_host for relative paths\n* Send a host's token to its configured api_host\n* Add the api_host gateway harness\n* Let GH_ACCEPTANCE_SCRIPT name several scripts\n* Wait longer for the search index in the issues script\n* Add acceptance coverage for gist\n* Fix discussion acceptance test flags\n* Resolve aliases to their target when rendering full help on error\n* Print full help on command misuse for invoking agents\n\nUpdate to version 2.99.0:\n\n* Add repeatable --attach flag to upload local images/videos to\n  issues, pull requests, and comments (max 50 files per call)\n* Add worktree checkout support to gh issue develop --checkout\n  --worktree\n* Fix repo sync to avoid corrupting a linked worktree and to\n  explain when the target branch is checked out elsewhere\n* Fix pr merge --delete-branch to safely handle linked worktrees\n* Reject --comments combined with --json on view commands\n","modified":"2026-09-17T18:23:14.640672457Z","published":"2026-09-15T16:45:32Z","related":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"],"upstream":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1278604"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56854"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56855"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78662"}],"affected":[{"package":{"name":"gh","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/gh&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.100.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"gh-bash-completion":"2.100.0-bp160.1.1","gh-fish-completion":"2.100.0-bp160.1.1","gh-zsh-completion":"2.100.0-bp160.1.1","gh":"2.100.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21861-1.json"}}],"schema_version":"1.9.0"}