#security

A dark comparison-matrix style cover reading gh CLI 2.97.0: Terminal Injection Fix, badged GHSA-3m3g-3wcr-px46 fixed 2026-07-31, listing the seven affected commands: gh gist view (truncated files), gh api (non-JSON responses), gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view / create

gh CLI 2.97.0 Fixes Terminal Injection in 7 Commands

GitHub CLI (gh) 2.97.0 fixes a terminal escape-sequence injection bug (GHSA-3m3g-3wcr-px46) across gh api, gh pr diff, and 5 more commands. Update now.

Aug 19, 2026Read more →

A terminal-style cover showing gh --version reporting the vulnerable 2.95.0 release, a GHSA-8cg3-r6g9-fpg2 / CVE-2026-59831 warning for the gh codespace jupyter remote code execution bug, then brew upgrade gh updating to the patched 2.96.0 release

Dev Tools

Update gh CLI Now: Codespace Jupyter RCE Fixed

A malicious Codespace could use gh codespace jupyter to hand VS Code a vscode:// URL and run commands on your machine. Fixed in gh CLI v2.96.0.

Aug 19, 2026Read more →

A terminal window showing the gh CLI apt keyring check gpg --show-keys /etc/apt/keyrings/githubcli-archive-keyring.gpg, listing the old key fingerprint expiring 2026-09-05 and the new key fingerprint added 2026-04-07, followed by the wget command that fetches the updated keyring

Dev Tools

gh CLI's New PGP Signing Key for Linux Packages

GitHub rotated the PGP key signing gh CLI's Linux apt/dnf/yum packages on 2026-04-08. Update your keyring before the old key expires Sept 5, 2026.

Aug 19, 2026Read more →

A terminal window showing the actions/checkout v7 changelog entry blocking fork pull request checkouts in pull_request_target and workflow_run workflows

Dev Tools

actions/checkout v7 Blocks pull_request_target PRs

actions/checkout v7 refuses to fetch fork PR code in pull_request_target and workflow_run by default. Here's the fix if your workflow relied on it.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions changelog entry describing approval requirements for bot-created pull requests before workflows can run

Dev Tools

Approve Workflow Runs From github-actions[bot] PRs

Pull requests from github-actions[bot] can now trigger CI workflows, but only after a collaborator approves the run. Here's how the gate works.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions changelog entry describing read-only cache tokens for workflow events that can be triggered without write permissions

Dev Tools

GitHub Actions Cache Goes Read-Only on Untrusted Triggers

GitHub Actions now issues read-only cache tokens for untrusted triggers like pull_request_target, closing a cache-poisoning path. Here's what still writes.

Aug 13, 2026Read more →

A dark comparison-matrix style cover listing GitHub Actions' summer 2026 changes across three groups: security (checkout defaults, cache tokens, execution allow-lists), infrastructure (self-hosted runner floor, runner groups, layered images), and new syntax ($/ same-repo actions, parallel steps, agentic workflows)

Dev Tools

GitHub Actions' Summer 2026 Overhaul: Full Guide

GitHub shipped 10 Actions changes across June-July 2026: one breaking checkout default, a runner version cutoff, new security controls, and new syntax.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions workflow execution protections changelog entry describing an allow list for who can trigger workflows and which events are permitted

Dev Tools

Set Up GitHub Actions Workflow Execution Protections

Workflow execution protections let you allow-list who can trigger GitHub Actions workflows and which events are permitted, built on GitHub's rulesets.

Aug 13, 2026Read more →

A terminal window showing the connections['api_by_zapier'] binding syntax from Zapier's real migration guide for moving hardcoded secrets out of Function code

Data & Automation

Zapier Functions Secrets: Move to API by Zapier

Zapier Functions let you hardcode API keys in code. Code by Zapier doesn't. Move secrets to an API by Zapier connection before the September 1 shutdown.

Aug 13, 2026Read more →