fix(deps): update module github.com/cli/go-gh/v2 to v2.12.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cli/go-gh/v2	v2.11.0 -> v2.12.1

GitHub Vulnerability Alerts

CVE-2024-53859

Summary

A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace.

Details

go-gh sources authentication tokens from different environment variables depending on the host involved:

• GITHUB_TOKEN, GH_TOKEN for GitHub.com and ghe.com
• GITHUB_ENTERPRISE_TOKEN, GH_ENTERPRISE_TOKEN for GitHub Enterprise Server

Prior to 2.11.1, auth.TokenForHost could source a token from the GITHUB_TOKEN environment variable for a host other than GitHub.com or ghe.com when within a codespace.

In 2.11.1, auth.TokenForHost will only source a token from the GITHUB_TOKEN environment variable for GitHub.com or ghe.com hosts.

Impact

Successful exploitation could send authentication token to an unintended host.

Remediation and mitigation

1. Upgrade go-gh to 2.11.1
2. Advise extension users to regenerate authentication tokens:
   • Personal access tokens
   • GitHub CLI OAuth app
3. Advise extension users to review their personal security log and any relevant audit logs for actions associated with their account or enterprise

CVE-2025-48938

Summary

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

Details

The GitHub CLI and CLI extensions allow users to transition from their terminal for a variety of use cases through the Browser capability in github.com/cli/go-gh/v2/pkg/browser:

• Using the -w, --web flag, GitHub CLI users can view GitHub repositories, issues, pull requests, and more using their web browser
• Using the gh codespace command set, GitHub CLI users can transition to Visual Studio Code to work with GitHub Codespaces

This is done by using URLs provided through API responses from authenticated GitHub hosts when users execute gh commands.

Prior to 2.12.1, Browser.Browse() would attempt to open the provided URL using a variety of OS-specific approaches regardless of the scheme. An attacker-controlled GitHub Enterprise Server could modify API responses to use a specially tailored local executable path instead of HTTP URLs to resources. This could allow the attacker to execute arbitrary executables on the user's machine.

In 2.12.1, Browser.Browse() has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs:

1. URLs with http://, https://, vscode://, vscode-insiders:// protocols are supported
2. URLs with file:// protocol are unsupported
3. URLs matching files or directories on the filesystem are unsupported
4. URLs matching executables in the user's path are unsupported

URLs without protocols will be browsable if none of these other conditions apply.

As we have more information about use cases, maintainers can expand these capabilities for an improved user experience that allows configuring allowed URL schemes and/or prompt the user for an unexpected user case and confirming whether to continue.

Impact

Successful exploitation could cause users of the attacker-controlled GitHub Enterprise Server to execute arbitrary commands.

Remediation and Mitigation

1. Upgrade go-gh to 2.12.1

---

Release Notes

cli/go-gh (github.com/cli/go-gh/v2)

v2.12.1

Compare Source

Security

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

For more information, see GHSA-g9f5-x53j-h563

Full Changelog: cli/go-gh@v2.12.0...v2.12.1

v2.12.0

Compare Source

Introducing experimental support for rendering markdown with customizable, accessible colors

Users with low vision or color blindness rely upon the terminal's ability to change how colors appear, however this requires CLIs to use a limited set of colors:

The markdown rendered for GitHub CLI and extensions defaults to 8-bit colors that users cannot easily customize in this way.

Now, users can force rendered markdown to use customizable, accessible colors by doing one of the following:

1. Set GH_ACCESSIBLE_COLORS environment variable to a truthy value

   export GH_ACCESSIBLE_COLORS=1

2. Set accessible_colors configuration setting

   gh config set accessible_colors enabled

Experimental.accessible.markdown.colors.mp4

Users with a customcharmbracelet/glamour style will continue to have markdown rendered using it.

For more information, see #​186

Introducing new experimental github.com/cli/go-gh/v2/pkg/x package

cli/go-gh provides capabilities used by both the GitHub CLI and CLI extensions. Some of these packages are stable, however some like the new experimental markdown support are not.

The github.com/cli/go-gh/v2/pkg/x package has been created to contain experimental features that are subject to change without notice.

Introducing new string matcher functions for Go templates

The following string matcher functions from Masterminds/sprig have been incorporated for more robust Go template support in GitHub CLI and CLI extensions:

• contains
• hasPrefix
• hasSuffix
• regexMatch

For more information, see cli/cli#6370 and sprig documentation

What's Changed

✨ Features

• Integrate sprig library by @​iamazeem in #​184
• Introduce experimental accessible colors in markdown rendering by @​andyfeller in #​186

New Contributors

• @​iamazeem made their first contribution in #​184

Full Changelog: cli/go-gh@v2.11.2...v2.12.0

v2.11.2

Compare Source

What's Changed

• Bump golang.org/x/net to resolve Dependabot alerts by @​BagToad in #​176

New Contributors

• @​BagToad made their first contribution in #​176

Full Changelog: cli/go-gh@v2.11.1...v2.11.2

v2.11.1

Compare Source

Security

• A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace.

  For more information, see GHSA-55v3-xh23-96gh

Full Changelog: cli/go-gh@v2.11.0...v2.11.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.5 -> 1.23.0
github.com/mattn/go-runewidth	v0.0.15 -> v0.0.16
github.com/muesli/termenv	v0.15.2 -> v0.16.0
golang.org/x/net	v0.30.0 -> v0.36.0
golang.org/x/sys	v0.26.0 -> v0.31.0
golang.org/x/term	v0.25.0 -> v0.30.0

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.5 -> 1.23.0
github.com/mattn/go-runewidth	v0.0.15 -> v0.0.16
github.com/muesli/termenv	v0.15.2 -> v0.16.0
golang.org/x/net	v0.30.0 -> v0.36.0
golang.org/x/sys	v0.26.0 -> v0.31.0
golang.org/x/term	v0.25.0 -> v0.30.0