chore(deps): bump github.com/cli/cli/v2 from 2.96.0 to 2.97.0

[dependabot]

Bumps github.com/cli/cli/v2 from 2.96.0 to 2.97.0.

Release notes

Sourced from github.com/cli/cli/v2's releases.

GitHub CLI 2.97.0

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"
Show named fields as extra columns
gh project item-list 1 --owner "@​me" --field "Status" --field "Priority"

What's Changed

✨ Features

• Add name-based resolution to gh project item-edit by @​zwick in #13807
• Add named field columns to gh project item-list by @​zwick in #13823
• Add Grok skill host support by @​tommaso-moro in #13864
• Replace Windsurf with Devin in gh skill agents by @​tommaso-moro in #13987

🐛 Fixes

• Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @​malancas in #13624
• Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @​kofuk in #13787
• Fix skill picker label wrapping by @​tommaso-moro in #13967

📚 Docs & Chores

... (truncated)

Commits

• 55dbb4d Merge commit from fork
• 3f6a16a Merge commit from fork
• 0c2eea6 Merge commit from fork
• 2a1409f Merge commit from fork
• ba0b7d9 Add a code review agent skill (#14003)
• c6aa327 Merge pull request #14018 from cli/dependabot/github_actions/github/gh-aw-act...
• 45db9b2 chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4
• c2ad3b0 Fix skill picker label wrapping (#13967)
• 11a5ef8 Merge pull request #13985 from cli/williammartin-dependabot-triage-dry-run
• b1c84bb Merge pull request #14004 from cli/bagtoad/pr-template-anti-slop
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)