What cli/cli shipped
Written by FoxPlug from the repository's own releases; not affiliated with GitHub CLI. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cli/cli; GitHub CLI did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- The extension browser now runs on Bubble Tea, keeping catalog navigation, filtering, README previews and browser opening. Pull request #14578
- Startup no longer spawns git once per installed extension when registering extension commands. Pull request #14620
- The bump Go script now leaves go fix, go test, golangci-lint and govulncheck to CI instead of running them before pushing. Pull request #14631
- Added ACCESSIBILITY.md as a community health file. Pull request #14583
- Linux install docs now recommend nix-shell -p gh for temporary use and declarative configuration for NixOS instead of nix-env. Pull request #14592
Why it matters
Startup work reduces per-invocation overhead for anyone with several extensions installed, since git no longer runs for each one. The extension browser moves onto the terminal framework already used elsewhere in the project, and the Go bump script stops duplicating checks that CI already performs.
Changelog entry
- Replace the extension browser's tview and tcell interface with Bubble Tea. Pull request #14578
- Avoid spawning git for each extension at startup. Pull request #14620
- Leave validation checks to CI in the bump-go script. Pull request #14631
- Add ACCESSIBILITY.md. Pull request #14583
- Recommend nix-shell and declarative configuration in the Nix and NixOS install docs. Pull request #14592
This week: extension browse now uses Bubble Tea, startup stops spawning git for each extension, bump-go leaves checks to CI, ACCESSIBILITY.md added, and Nix install docs updated.
This week in the project: the extension browser was rebuilt on Bubble Tea, preserving catalog navigation, filtering and README previews. Startup no longer spawns git for every installed extension while registering commands. The Go bump script now leaves go fix, go test, golangci-lint and govulncheck to CI. ACCESSIBILITY.md was added as a community health file. The Linux install docs now recommend nix-shell -p gh for temporary use and declarative NixOS configuration instead of nix-env.
Week of September 21, 2026
What shipped
- GitHub App user tokens (ghu_) can now be used with the --attach flag for file uploads in supported scenarios. Pull request #14516
- README now mentions 'gh CLI' in the introduction to improve searchability for users looking for the project. Pull request #14517
- Security policy updated to prioritize HackerOne for vulnerability reports over private GitHub Security Advisories. Pull request #14497
- Pull request template guidance clarified to help reviewers by keeping descriptions focused on repository changes. Pull request #14509
- CLI recording rendering improved to handle font selection separately from command execution and capture. Pull request #14507
Why it matters
This week adds support for additional GitHub App token types in file attachments and improves project discoverability. The updates also strengthen security reporting processes and refine contribution guidelines to make reviews more efficient.
Changelog entry
- Allow ghu_ GitHub App user tokens to be used with the --attach flag for supported actors Pull request #14516
- Add 'gh CLI' to README introduction for improved search visibility Pull request #14517
- Prioritize HackerOne for vulnerability reports in security policy Pull request #14497
- Clarify pull request template guidance for reviewer-facing descriptions Pull request #14509
- Improve CLI recording rendering by separating font selection from execution Pull request #14507
GitHub CLI now accepts GitHub App user tokens (ghu_) for file attachments and improved discoverability in search results. Security reporting prioritized through HackerOne.
This week's updates to GitHub CLI improve token support for file attachments, making GitHub App user tokens (ghu_) available for upload scenarios. We've also strengthened our security reporting process by prioritizing HackerOne, updated the README for better discoverability, and refined contribution guidance to help reviewers evaluate changes more effectively.