The GPG key used to verify GitHub CLI Debian and RedHat packages expired on Friday, September 6. If you have installed gh via our official package repositories, we ask that you update your keyring to the new key to continue verifying GitHub CLI releases.
Please refer to this documentation for instructions on how to do so with your respective package manager.
For reference, a note on this was also included in the CLI v2.56.0 release notes, published earlier this week.
We are excited to announce Copilot in the CLI is now generally available (GA) for all our Copilot Individual, Business, and Enterprise customers.
Copilot in the CLI allows users to access the power of GitHub Copilot to get command suggestions and explanations without leaving the terminal. Starting today, developers can also use GitHub Copilot to execute suggested commands based on feedback shared during the public beta.
GitHub Copilot in the CLI has also gained a couple of helper aliases for Bash, PowerShell, and Zsh. The new gh copilot alias command generates shell-specific configuration for ghcs and ghce aliases. These aliases use fewer keystrokes to jump into the gh copilot experience. Additionally, the new ghcs alias streamlines the process for executing commands suggested while making them available for later reuse!
If you were already using Public Beta:
gh extension upgrade gh-copilot.If you haven’t enabled Copilot in the CLI yet or coming from the GitHub Next technical preview
After receiving access to Copilot in the CLI, consult our guide on how to install the tool and get started.
We are dedicated to continuous improvement and innovation. Your feedback remains a crucial part of our development process, and we look forward to hearing more about your experiences with GitHub Copilot in the CLI. Please use our public repository to provide feedback or ideas on how to improve the product.
Introducing support for multiple GitHub accounts on a single host within the CLI! Log in with your work and personal accounts to manage your projects, wherever they're happening.
To add multiple accounts in the CLI, use the gh auth login command just as before. Now, instead of replacing your previous account, you will see the addition of a new account under gh auth status. This account will be marked as active, to indicate that gh will use it when communicating with GitHub. Run gh auth switch to change the active account, or gh auth logout to remove an account. Further details can be found in the v2.40.0 release notes.
Install or update the GitHub CLI today from your preferred source.
Learn your way around the command line with GitHub Copilot by your side!
We’re excited to announce the launch of a brand new GitHub CLI extension that’s now available as public beta — GitHub Copilot in the CLI.
GitHub Copilot in the CLI brings GitHub Copilot right to your terminal, where you can ask it to do things like explain how a command works or suggest a command for a task you want to perform. Learn more about the extension in our docs and provide us your feedback on our repo.
GitHub Actions Importer now supports migrations from Bitbucket, Bamboo Server, and Bamboo Data Center. Companies using those tools can plan, test, and automate the migration of pipelines to GitHub Actions more easily than ever before.
GitHub Actions Importer is available via the GitHub CLI or IssueOps. To get started, please visit our docs. For questions and feedback, check out the GitHub Actions Importer community.
Support for migrating Jenkins Scripted Pipelines to GitHub Actions is now available as a private beta! If you use Scripted Pipelines in your Jenkins instances, you can now automate the migration of your pipelines to GitHub Actions using GitHub Actions Importer.
To get started, please reach out to your GitHub account manager or contact our sales team! For questions and feedback about the private beta, please visit the GitHub Actions Importer community.
Bamboo Server and Data Center migrations to GitHub Actions are now in public beta! You can now plan, test, and automate the migration of your Bamboo pipelines to GitHub Actions easily and for free using GitHub Actions Importer.
For details on how to get started, check out our documentation. For questions and feedback about the public beta, please visit the GitHub Actions Importer community.
You can now customize your GitHub Actions Importer experience using feature flags. You can use the --enable-features and --disable-features options to select specific features to enable or disable for the duration of the command.
For details on how to get started, please check out our documentation. For questions and feedback, visit the GitHub Actions Importer community.
Caching dependencies and other commonly reused files enables developers to speed up their GitHub Actions workflows and make them more efficient.
We have now enabled Cache Management from the web interface to enable developers to get more transparency and control over their cache usage within their GitHub repositories.
Actions users who use actions/cache can now:
In addition to the Cache Management UX that we have now enabled, you could also use our Cache APIs or install the GitHub CLI extension for Actions cache to manage your caches from your terminal.
Learn more about dependency caching to speed up your Actions workflows.
For questions or to share your feedback, visit the GitHub Actions community.
Today's Changelog brings you roadmap markers and command line support for Projects!
Keep track of upcoming dates in your roadmap by visualizing the due dates of your milestones, iteration durations and breaks, and additional date fields as vertical markers. Configure these from the Markers menu to display them on the view.
Interact with projects, items, and fields from your favorite terminal with the GitHub CLI projects extension.
To install the extension in gh:
$ gh extension install github/gh-projectsUsage:
$ gh projects -h
Work with GitHub Projects. Note that the token you are using must have 'project' scope, which is not set by default. You can verify your token scope by running 'gh auth status' and add the project scope by running 'gh auth refresh -s project'.
Usage:
projects [command]
Available Commands:
close Close a project
copy Copy a project
create Create a project
delete Delete a project
edit Edit a project
field-create Create a field in a project
field-delete Delete a field in a project
field-list List the fields in a project
help Help about any command
item-add Add a pull request or an issue to a project
item-archive Archive an item in a project
item-create Create a draft issue item in a project
item-delete Delete an item from a project
item-edit Edit a draft issue in a project
item-list List the items in a project
list List the projects for a user or organization
view View a project
Flags:
-h, --help help for projects
Use "projects [command] --help" for more information about a command.Share your feedback in the repository.
Learn more about extensions (and how to build your own!) in this GitHub blog.
/ in the name couldn't be duplicated (Enterprise users only)See how to use GitHub for project planning with GitHub Issues, check out what's on the roadmap, and learn more in the docs.
GitHub Actions Importer is now generally available to all GitHub users. You can now easily plan, forecast, and automate migrations from Azure DevOps, CircleCI, GitLab, Jenkins, and Travis CI to GitHub Actions. GitHub Actions Importer is a free extension of the official GitHub CLI and provides you with the confidence to migrate your CI/CD pipelines to continue delivering software efficiently.
For details on how to get started, please check out our documentation. For questions and feedback, visit the GitHub Actions Importer community.
GitHub Security was recently notified about a caching issue affecting npm. This bug had been present since 2016 and sporadically caused npm maintainers to be re-invited upon removal from packages or organizations. Our Security team investigated potential instances of the issue and believe this bug only occurred if a user was removed, followed shortly by the addition of a different member. This bug affected npm-cli version 6 and above, and was fixed in version 7+.
Out of an abundance of caution, we are recommending all npm users review the maintainers of their projects and organizations for any discrepancies that may be a result of this bug and remove any unexpected members. Please feel free to reach out to us with any additional questions or concerns through the following contact form: https://www.npmjs.com/support.
The npm CLI v9 is now generally available! As of today, running npm i -g npm will install the latest version (v9.1.1). Details on the major breaking changes, features and bug fixes of v9 can be found in our last changelog post.
A huge shout out to all of the contributors who helped make this release possible and who continue to make npm awesome.
Learn more about v9.1.1 in the release notes. You can also find references to previous releases in the project's CHANGELOG.md.
The npm CLI team has been working hard over the past few months and are happy to announce the release of the next major version – v9.0.0
You can start using npm v9.0.0 today by running:
$ npm i -g npm@9Our goal with this major release was to standardize appropriate defaults and clean up legacy configurations where possible. We believe the changes made lay the ground-work for future improvements to the default npm experience long-term. Notably, Docker users should find this release to to be beneficial as we simplifie file permissions (ref. #5703 & #5704).
Although we have published v9.0.0, we are not immediately setting this release to latest in the npm registry or considering this “Generally Available.” Our team has been coordinating with the Node.js Release WG on a phased approach to making v9 the next major version of the CLI available to the widest audience; this means ensuring v9 can be safely backported to as many Node.js LTS versions as possible. With that in mind, we’ve put together a phased roll-out plan outlined below:
npm@9.0.0 was released & set to the next-9 dist-tag (previously used for pre-releases)v9.x, addressing any feedback or unexpected issues arising from the breaking changes (outlined below)npm@9.x is considered "non-breaking" for Node.js LTS we will codify a set of exit criteria in collaboration with the Release WGnpm@9.x will be set to the latest dist-tag (becoming the latest, maintained version of npm)npm@9.x in nodejs/node's main branch (exposing experimental/nightly users to this latest version)npm@9.x in node@19node@19 backport)
npm@9.x in node@18node have been updated to: ^14.17.0 || ^16.13.0 || >=18.0.0npm will no longer attempt to modify ownership of files it createslogin, adduser, and auth-type changes
sso, saml & legacy have been consolidated into "legacy"auth-type defaults to "web"login and adduser are now separate commands that send different data tonpm pack now follows a strict order of operations when applying ignore rules. If a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.HEAD instead of master as the default reftiming and loglevel changes
timing has been removed as a value for --loglevel--timing will show timing information regardless of--loglevel, except when --silent--timing file changes:
--timing flag, npm now writes timing data to alogs-dir option and<CACHE>/_logs/ dir, instead of directly inside the<ID>-timing.json file, with the<ID> portion being the same as the debug log.metadata, timers, and unfinishedTimers instead of everything beingnpm now outputs some json errors on stdout. Previously npm would output all json formatted errors on stderr, making it difficult to parse as the stderr stream usually has logs already written to it.--install-strategy
--global-style, --global now sets --install-strategy=shallow--legacy-bundling, now sets --install-strategy=nestednpm config set will no longer accept deprecated or invalid config optionsinstall-links config defaults to "true"node-version config has been removednpm-version config has been removednpm access subcommands have been renamednpm birthday has been removednpm set-script has been removednpm bin has been removed (use npx or npm exec to execute binaries)a09e19d #5696 new npm config fix command (@nlf)3445da0 npm timings are now written alongside debug log files (@lukekarrys)6ee5b32 query: now displays queryContext in results (@nlf)314311c #5550 separated login/adduser (@wraithgar)de2d33f add --install-strategy=hoisted|nested|shallow (#5709) (@fritzy)For more information about this release, check out the GitHub release notes.
npm query is a new top-level command as of npm v8.16.0 which accepts a Dependency Selector (as defined in the Dependency Selector Syntax Specification) & returns a filtered JSON Array/NodeList of dependencies from your project. We believe this capability has been a missing piece of the package management ecosystem; With its introduction we hope to unlock the potential for developers to self-serve in asking new, complex questions about their dependencies, their relationships & associative metadata.
For many JavaScript developers, the Dependency Selector Syntax will look very familiar as it is actually an adapted form of CSS. We leveraged this existing, known language & its operators to make disparate package information broadly accessible.
If I wanted to list all of my dependencies (similar to npm list --all) I can run:
npm query "*"If I wanted to find every version of react & lodash in my project I can run:
npm query "#react, #lodash"If I wanted to find all react versions not-defined as a peer dependency I can run:
npm query "#react:not(.peer)"If I wanted to find all the dependencies in my project that used an MIT license I'd change that query to be:
npm query "[license=MIT]"If I wanted to find all the git dependencies in my project I can run:
npm query ":type(git)"If I wanted to find out which of my transitive dependencies used a postinstall script I could run:
npm query ":attr(scripts, [postinstall]):not(:root > *)"We know many developers in the ecosystem will also want to leverage this new syntax themselves, so we've built it right into the programmatic brain of the CLI. Under the hood, we’ve added a new .querySelectorAll() method to the existing Node Class we use in the @npmcli/arborist library. Tooling authors can now load up & query their dependencies just like we do.
// index.js
const Arborist = require('@npmcli/arborist')
const arb = new Arborist({})
arb.loadActual((tree) => {
// query all workspaces
const results = await tree.querySelectorAll('.workspace')
console.log(results)
})You can learn more about the syntax & usage in our documentation here: https://docs.npmjs.org/cli/v8/using-npm/dependency-selectors
Looking ahead we’ve got work planned to add new pseudo states & selectors based on registry metadata that should unlock another host of capabilities aimed at auditing (examples include: :outdated :deprecated :vulnerable :cve() & :cwe()). As documented in the original RFC proposal we will also consider supporting a query flag or reading from stdin to existing commands.