GitHub CLI 2.93.0

Released: 2026-05-27

Release notes

BUGFIX

Authentication and API checks get more accurate

This batch fixes a handful of accuracy issues around authentication and API checks. Secrets (sensitive values like API keys) used to be scoped only to a user or a repository; now an agent (an automated bot, for example) can also use secrets under an application identity. Looking up a PR (pull request) by number used to take a "number-only" shortcut that skipped API validation, which could return inaccurate results; that shortcut is gone, so every lookup is validated now. Hitting a 401 (unauthorized) error used to just print an unhelpful error; now it prints "run gh auth refresh" to tell you exactly what to do. When gh copilot fails to run, it now hints you to run the copilot command directly to troubleshoot, instead of just showing an error. It's like an ATM that no longer just flashes an error code when a withdrawal fails, but tells you directly what to do next.

FEATURE

Supply-chain security tightens up; releases get locked

This batch strengthens supply-chain security (making sure the software you download hasn't been tampered with). gh release verify (the command that checks a release's integrity) now derives the right digest algorithm (the hashing method used to verify content hasn't changed) from the length of the ref (version tag), making verification more accurate. The CLI's own build pipeline switched its verification action from actions/attest-build-provenance to actions/attest (another official GitHub-hosted attestation action). In the project's own GitHub Actions (automation scripts), first-party actions (ones GitHub itself maintains) are now pinned by SHA (a fixed version hash), so they can't silently change content if the upstream action gets updated. Docs also now note that starting with v2.93.0, GitHub Releases become immutable (locked after publishing — no more edits). It's like sealing a shipment before it leaves the factory and using an inspector who only checks a fixed batch number, so the goods can't be swapped mid-transit.

BUGFIX

Install docs and a small Windows glitch fixed

This batch is installation-docs and small polish fixes. The official install command docs were updated; some Linux distros (the dnf family) had an unnecessary --repo gh-cli in their install commands, which is now removed; on Windows, running certain commands used to flash a tzutil console window in the background — that flicker is fixed; and a duplicated word plus a grammar typo in the docs were also corrected. The rest is extended PR-screening process work, telemetry (usage-reporting statistics) adjustments, and dependency version bumps that don't affect day-to-day use. It's like proofreading a manual to remove extra filler words and typos in one pass — everything just reads cleaner now.

Original changelog

Original changelogAuthentication and API checks get more accurate
Allow agents as application for secrets by @tenjaa in https://github.com/cli/cli/pull/13421
fix(pr): remove numberFieldOnly optimization that skips API validation by @williammartin in https://github.com/cli/cli/pull/13327
Print `gh auth refresh` for 401 returns by @333fred in https://github.com/cli/cli/pull/13068
fix(copilot): hint to run copilot directly when exec fails by @babakks in https://github.com/cli/cli/pull/13393
Original changelogSupply-chain security tightens up; releases get locked
Derive digest algorithm from ref length in release verify commands by @bdehamer in https://github.com/cli/cli/pull/13430
Switch from actions/attest-build-provenance to actions/attest by @scop in https://github.com/cli/cli/pull/13325
Remove dependency on persistent token by @williammartin in https://github.com/cli/cli/pull/13474
SHA pin first-party GitHub Actions by @williammartin in https://github.com/cli/cli/pull/13491
docs: note immutable releases starting v2.93.0 by @BagToad in https://github.com/cli/cli/pull/13518
fix CI attestation integration tests after rename by @BagToad in https://github.com/cli/cli/pull/13536
Original changelogInstall docs and a small Windows glitch fixed
Add missing //go:build integration tag to verify_integration_test.go by @pdostal in https://github.com/cli/cli/pull/13303
Fix flaky accessible prompter Password test timeout by @pdostal in https://github.com/cli/cli/pull/13304
Enable extended PR screening for external PRs by @tidy-dev in https://github.com/cli/cli/pull/13312
Grammar fixes by @scop in https://github.com/cli/cli/pull/13326
Bump `gh copilot` telemetry sampling to 100% by @williammartin in https://github.com/cli/cli/pull/13362
Record accessibility feature state in telemetry by @williammartin in https://github.com/cli/cli/pull/13363
Poll TTY echo mode instead of sleeping in password tests by @pdostal in https://github.com/cli/cli/pull/13305
Fix skills acceptance tests by @williammartin in https://github.com/cli/cli/pull/13365
Bump Go toolchain to 1.26.3 by @Copilot in https://github.com/cli/cli/pull/13367
Trigger triage check-requirements on ready_for_review by @BagToad in https://github.com/cli/cli/pull/13383
Update installation commands for GitHub CLI by @sassdawe in https://github.com/cli/cli/pull/13126
Update CODEOWNERS for skills directory ownership by @williammartin in https://github.com/cli/cli/pull/13416
fix(telemetry): prevent tzutil console flash on Windows by @adehad in https://github.com/cli/cli/pull/13353
Fix bump-go.sh to tolerate missing toolchain directive by @Copilot in https://github.com/cli/cli/pull/12581
docs: drop --repo gh-cli from dnf install lines by @c-tonneslan in https://github.com/cli/cli/pull/13444
Remove third-party license debris by @williammartin in https://github.com/cli/cli/pull/13470
Remove discussion workflow by @williammartin in https://github.com/cli/cli/pull/13476
Stop bumping homebrew on release by @williammartin in https://github.com/cli/cli/pull/13479
build: update golang.org/x/crypto by @tommaso-moro in https://github.com/cli/cli/pull/13486
Add 3 day dependabot cooldown period by @williammartin in https://github.com/cli/cli/pull/13488
Run govulncheck daily instead of weekly by @williammartin in https://github.com/cli/cli/pull/13487
Link to Accessibility category for community discussions instead of ACR by @mxie in https://github.com/cli/cli/pull/13481
docs: fix duplicated "of" in release-process-deep-dive by @vip892766gma in https://github.com/cli/cli/pull/13425
chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @BagToad in https://github.com/cli/cli/pull/13510
chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13297
chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13328
chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13381
chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13396
chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13346
chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13397
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13420
chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13436
chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13461
chore(deps): bump github/codeql-action from 4 to 4.35.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13489
chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13462
chore(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13457
@pdostal made their first contribution in https://github.com/cli/cli/pull/13303
@333fred made their first contribution in https://github.com/cli/cli/pull/13068
@scop made their first contribution in https://github.com/cli/cli/pull/13326
@sassdawe made their first contribution in https://github.com/cli/cli/pull/13126
@adehad made their first contribution in https://github.com/cli/cli/pull/13353
@c-tonneslan made their first contribution in https://github.com/cli/cli/pull/13444
@tenjaa made their first contribution in https://github.com/cli/cli/pull/13421
@mxie made their first contribution in https://github.com/cli/cli/pull/13481
@vip892766gma made their first contribution in https://github.com/cli/cli/pull/13425