…ents

When a pinned SHA has multiple version tags (e.g. v1, v1.0, v1.0.1),
the version comment update logic used .find to pick the first tag whose
version string was a suffix of the comment. Because tags are sorted
ascending, this could pick a short version like "1" that is a substring
of the actual comment version "1.0.1". The subsequent gsub("1", "1.1")
then mangled the entire comment, e.g. "# v1.0.1" became "# v1.1.0.1.1".

Fix by selecting the longest (most specific) matching version string
instead of the first match. This ensures gsub replaces the correct
substring.

Fixes an issue observed in cli/cli#12918 where
the comment was incorrectly updated to "# v1.1.0.1.1" instead of
"# v1.1".

…ents

When a pinned SHA has multiple version tags (e.g. v1, v1.0, v1.0.1),
the version comment update logic used .find to pick the first tag whose
version string was a suffix of the comment. Because tags are sorted
ascending, this could pick a short version like "1" that is a substring
of the actual comment version "1.0.1". The subsequent gsub("1", "1.1")
then mangled the entire comment, e.g. "# v1.0.1" became "# v1.1.0.1.1".

Fix by selecting the longest (most specific) matching version string
instead of the first match. This ensures gsub replaces the correct
substring.

Fixes an issue observed in cli/cli#12918 where
the comment was incorrectly updated to "# v1.1.0.1.1" instead of
"# v1.1".

…ents (#14461)

When a pinned SHA has multiple version tags (e.g. v1, v1.0, v1.0.1),
the version comment update logic used .find to pick the first tag whose
version string was a suffix of the comment. Because tags are sorted
ascending, this could pick a short version like "1" that is a substring
of the actual comment version "1.0.1". The subsequent gsub("1", "1.1")
then mangled the entire comment, e.g. "# v1.0.1" became "# v1.1.0.1.1".

Fix by selecting the longest (most specific) matching version string
instead of the first match. This ensures gsub replaces the correct
substring.

Fixes an issue observed in cli/cli#12918 where
the comment was incorrectly updated to "# v1.1.0.1.1" instead of
"# v1.1".

This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.89.0` → `v2.90.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.90.0`](https://github.com/cli/cli/releases/tag/v2.90.0): GitHub CLI 2.90.0

[Compare Source](cli/cli@v2.89.0...v2.90.0)

#### Manage agent skills with `gh skill` (Public Preview)

[Agent skills](https://agentskills.io) are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new `gh skill` command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

```

# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run
```

Skills are automatically installed to the correct directory for your agent host. `gh skill` supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with `--agent` and `--scope` flags.

`gh skill publish` validates skills against the [Agent Skills specification](https://agentskills.io/specification) and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the [GitHub Blog](https://github.blog/changelog/2026-04-16-manage-agent-skills-with-github-cli/).

`gh skill` is launching in public preview and is subject to change without notice.

#### Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. `gh stack`), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for [github/gh-aw](https://github.com/github/gh-aw) and [github/gh-stack](https://github.com/github/gh-stack).

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the `gh extension install` command to run.

#### `gh extension install` no longer requires authentication

`gh extension install` previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

#### What's Changed

##### ✨ Features

- Add `gh skill` command group: install, preview, search, update, publish by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13165](cli/cli#13165)
- Suggest and install official extensions for unknown commands by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;13175](cli/cli#13175)
- `gh skill publish`: auto-push unpushed commits before publish by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13171](cli/cli#13171)
- Disable auth check for `gh extension install` by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;13176](cli/cli#13176)

##### 🐛 Fixes

- Fix infinite loop in `gh release list --limit 0` by [@&#8203;Bahtya](https://github.com/Bahtya) in [#&#8203;13097](cli/cli#13097)
- Ensure `api` and `auth` commands record agentic invocations by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;13046](cli/cli#13046)
- Disable auth check for local-only skill flags by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13173](cli/cli#13173)
- URL-encode parentPath in skills discovery API call by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13172](cli/cli#13172)
- Fix: use target directory remotes in skills publish by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13169](cli/cli#13169)
- Fix: preserve namespace in skills search deduplication by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13170](cli/cli#13170)

##### 📚 Docs & Chores

- docs: include PGP key fingerprints by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;13112](cli/cli#13112)
- docs: add sha/md5 checksums of keyring files by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;13150](cli/cli#13150)
- docs: fix SHA512 checksum for GPG key by [@&#8203;timsu92](https://github.com/timsu92) in [#&#8203;13157](cli/cli#13157)
- docs(skill): polish skill commandset docs by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;13183](cli/cli#13183)
- Document dependency CVE policy in SECURITY.md by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;13119](cli/cli#13119)
- Replace github.com/golang/snappy with klauspost/compress/snappy by [@&#8203;thaJeztah](https://github.com/thaJeztah) in [#&#8203;13048](cli/cli#13048)
- chore: bump to go1.26.2 by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;13116](cli/cli#13116)
- chore: delete experimental script/debian-devel by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;13127](cli/cli#13127)
- Suggest first party extensions by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;13182](cli/cli#13182)
- Add cli/skill-reviewers as CODEOWNERS for skills packages by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;13189](cli/cli#13189)
- Add [@&#8203;cli/code-reviewers](https://github.com/cli/code-reviewers) to all CODEOWNERS rules by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;13190](cli/cli#13190)
- Address post-merge review feedback for skills commands by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13185](cli/cli#13185)
- Fix skills-publish-dry-run acceptance test error message mismatch by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13187](cli/cli#13187)
- Skills: replace real git in publish tests with CommandStubber by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13188](cli/cli#13188)
- Remove redundant nil-client fallback in skills publish by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13168](cli/cli#13168)
- Publish: use shared discovery logic instead of requiring skills/ directory by [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) in [#&#8203;13167](cli/cli#13167)

#####  Dependencies

- chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13071](cli/cli#13071)
- chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13045](cli/cli#13045)
- chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13051](cli/cli#13051)
- chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13152](cli/cli#13152)
- chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13129](cli/cli#13129)
- chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13128](cli/cli#13128)
- chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13044](cli/cli#13044)
- chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12918](cli/cli#12918)
- chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13076](cli/cli#13076)
- chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;13065](cli/cli#13065)

#### New Contributors

- [@&#8203;thaJeztah](https://github.com/thaJeztah) made their first contribution in [#&#8203;13048](cli/cli#13048)
- [@&#8203;Bahtya](https://github.com/Bahtya) made their first contribution in [#&#8203;13097](cli/cli#13097)
- [@&#8203;timsu92](https://github.com/timsu92) made their first contribution in [#&#8203;13157](cli/cli#13157)
- [@&#8203;SamMorrowDrums](https://github.com/SamMorrowDrums) made their first contribution in [#&#8203;13173](cli/cli#13173)

**Full Changelog**: <cli/cli@v2.89.0...v2.90.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->