Hello,
Please find attached a patch updating devel/github-cli from 2.101.0 to
2.102.0.
This is primarily a security update. Upstream fixes four vulnerabilities
and recommends updating to 2.102.0 as soon as possible:
https://github.com/cli/cli/releases/tag/v2.102.0
https://github.com/cli/cli/compare/v2.101.0...v2.102.0
The issues include unsafe handling of symbolic links when writing
downloaded files, two attestation verification weaknesses, and option
injection through interactive skill search results.
For the port, I updated MODGO_VERSION to v2.102.0 and regenerated
modules.inc and distinfo. The dependency changes are limited to
bubbletea 2.0.10 and klauspost/compress 1.20.1.
Given the security fixes, I would appreciate it if this update could be
considered before OpenBSD 8.0 is released.
Thank you.
Best regards,
David.
Index: devel/github-cli/Makefile
===================================================================
RCS file: /cvs/ports/devel/github-cli/Makefile,v
diff -u -p -u -p -r1.82 Makefile
--- devel/github-cli/Makefile 21 Sep 2026 22:58:28 -0000 1.82
+++ devel/github-cli/Makefile 30 Sep 2026 13:55:42 -0000
@@ -1,6 +1,6 @@
COMMENT = command-line access to github pull requests, issues and more
-V = 2.101.0
+V = 2.102.0
MODGO_MODNAME = github.com/cli/cli/v${V:R:R}
MODGO_VERSION = v${V}
Index: devel/github-cli/distinfo
===================================================================
RCS file: /cvs/ports/devel/github-cli/distinfo,v
diff -u -p -u -p -r1.73 distinfo
--- devel/github-cli/distinfo 21 Sep 2026 22:58:28 -0000 1.73
+++ devel/github-cli/distinfo 30 Sep 2026 13:55:42 -0000
@@ -1,5 +1,5 @@
SHA256 (bsdmp-survey-vv2.3.8.tar.gz) = fPcSUSZ4Kkovs52dRmmAtg+lX8R/EDkhLaLMZJCphMU=
-SHA256 (cli-v2.101.0.zip) = SLs5klYDMaHMpiu5/IT/75+4b1K7A0YikzdUo/9sM60=
+SHA256 (cli-v2.102.0.zip) = IoKDxfAnwGfxMo4/UihYiSbc+qZg/gtgX1pvUFrFnK4=
SHA256 (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.mod) = p5DeefOWpGgRzfiXR7IMnJJZnIfIuiXfICeZ+ODldMk=
SHA256 (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.zip) = KW2htHeMHqh5EXGvsVathbPZsI2eiI1Wh66jJt2/wyo=
SHA256 (go_modules/cel.dev/expr/@v/v0.25.1.mod) = Z0UnUNV+zK4mM7F05mRotyYy7edErdtN4sCybd04qOE=
@@ -8,10 +8,10 @@ SHA256 (go_modules/cel.dev/expr/@v/v0.25
SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.0.0.mod) = fer7gLMyfm9LIuG/S9s8aSv5mTDHMsS/6ApaZsYNaCk=
SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.2.1.mod) = qzZu1icdy66GueleeDbw6GCPtgmwFsJ6bBT5w0A4qi0=
SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.2.1.zip) = ZCks3JZeTN2B+ue5sm93ztF5MhqwFPSaRCtHiQeLACQ=
+SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.mod) = T95wwv5L3vlEyonR+oREf5ygpnc3ksYRi6JW4o7zttk=
+SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.zip) = pvPj7Jl7Wb2g772ROc8+Xm7A9WHmsX+uMeNXkbqGnWQ=
SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.2.mod) = VIJQr7oHkxyBdbB3y4ywaLy2scmaZ3o3J5q3p6rJWIE=
SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.8.mod) = dRBJwCbv1oF75kPfKov8TdRZBI6tgabbn5dI5SC/1ZU=
-SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.mod) = dRBJwCbv1oF75kPfKov8TdRZBI6tgabbn5dI5SC/1ZU=
-SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.zip) = UBryKsWiINONYwUhnBf9ybGcDhtrBTBbwKGHjSHLuf8=
SHA256 (go_modules/charm.land/huh/v2/@v/v2.0.3.mod) = xZruS0ERraCE7smIQkEdnxCr1uAcpAgvRg73HMiBT0M=
SHA256 (go_modules/charm.land/huh/v2/@v/v2.0.3.zip) = NrZ4gS/ALUjs0dnqwjLu8Hq85EJbn90T7KG19P6r7IM=
SHA256 (go_modules/charm.land/lipgloss/v2/@v/v2.0.1.mod) = QsYUvDZv0g7TRSNV+8ydEBU/tBpxNSkrsO0X9DG4//8=
@@ -692,8 +692,8 @@ SHA256 (go_modules/github.com/keybase/go
SHA256 (go_modules/github.com/keybase/go-keychain/@v/v0.0.1.zip) = lRSmjaCNOdYKR2QL7wSeRMgpqrXbvd0D0nLpJSA5pcc=
SHA256 (go_modules/github.com/klauspost/compress/@v/v1.18.1.mod) = YlytjEr1C/rbG8hlpLHdju2q7EAS6E+38XJRUQ/ojWU=
SHA256 (go_modules/github.com/klauspost/compress/@v/v1.19.2.mod) = DWbWBp2eL7h1xbRk0VssgCMs/ImR5viDNs5GHKgQ4M8=
-SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.0.mod) = DU6Q2ZrLwZ7qVwbnOQ+MklsmsfWGE4W7TxMh1FSh1Iw=
-SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.0.zip) = oEZU0EmjyvM7y2DuRe/YzOyruT64vogEXtAAOw7LV3M=
+SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.1.mod) = DU6Q2ZrLwZ7qVwbnOQ+MklsmsfWGE4W7TxMh1FSh1Iw=
+SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.1.zip) = 7ttY1+SmVmn5opBTZkbL/kGIESNoQktWqMdc/a2yfeo=
SHA256 (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.mod) = eDUaQK92F5X2bGSneooGn40VKaALsyo4HqRIFCY6iRA=
SHA256 (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.zip) = isUI6Tsi3KGnMaOkySG1fF7R2up7Nimiz4XDt1MN2oQ=
SHA256 (go_modules/github.com/kr/pretty/@v/v0.3.1.mod) = hPPkCAOx69SoAuVXlLmZffCxc8SAnoVy/5BC7FWMobw=
@@ -1311,7 +1311,7 @@ SHA256 (go_modules/sigs.k8s.io/yaml/@v/v
SHA256 (go_modules/software.sslmate.com/src/go-pkcs12/@v/v0.4.0.mod) = +/Vbaah9WjkQgv2brl5MdYEEH+Cbi7k7D+Fs3f6FzpU=
SHA256 (go_modules/software.sslmate.com/src/go-pkcs12/@v/v0.4.0.zip) = VQGaOR5TAqUbpi6YkJ4AYiS4EgeGbakL6vWC7A3uA28=
SIZE (bsdmp-survey-vv2.3.8.tar.gz) = 125803
-SIZE (cli-v2.101.0.zip) = 16062085
+SIZE (cli-v2.102.0.zip) = 16148922
SIZE (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.mod) = 89
SIZE (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.zip) = 8712
SIZE (go_modules/cel.dev/expr/@v/v0.25.1.mod) = 96
@@ -1320,10 +1320,10 @@ SIZE (go_modules/cel.dev/expr/@v/v0.25.2
SIZE (go_modules/charm.land/bubbles/v2/@v/v2.0.0.mod) = 1275
SIZE (go_modules/charm.land/bubbles/v2/@v/v2.2.1.mod) = 1225
SIZE (go_modules/charm.land/bubbles/v2/@v/v2.2.1.zip) = 159166
+SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.mod) = 1006
+SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.zip) = 87902
SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.2.mod) = 1079
SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.8.mod) = 1006
-SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.mod) = 1006
-SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.zip) = 85761
SIZE (go_modules/charm.land/huh/v2/@v/v2.0.3.mod) = 1466
SIZE (go_modules/charm.land/huh/v2/@v/v2.0.3.zip) = 78759
SIZE (go_modules/charm.land/lipgloss/v2/@v/v2.0.1.mod) = 1046
@@ -2004,8 +2004,8 @@ SIZE (go_modules/github.com/keybase/go-k
SIZE (go_modules/github.com/keybase/go-keychain/@v/v0.0.1.zip) = 2381161
SIZE (go_modules/github.com/klauspost/compress/@v/v1.18.1.mod) = 137
SIZE (go_modules/github.com/klauspost/compress/@v/v1.19.2.mod) = 201
-SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.0.mod) = 201
-SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.0.zip) = 40063352
+SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.1.mod) = 201
+SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.1.zip) = 40331560
SIZE (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.mod) = 34
SIZE (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.zip) = 127679
SIZE (go_modules/github.com/kr/pretty/@v/v0.3.1.mod) = 117
Index: devel/github-cli/modules.inc
===================================================================
RCS file: /cvs/ports/devel/github-cli/modules.inc,v
diff -u -p -u -p -r1.64 modules.inc
--- devel/github-cli/modules.inc 21 Sep 2026 22:58:28 -0000 1.64
+++ devel/github-cli/modules.inc 30 Sep 2026 13:55:42 -0000
@@ -2,7 +2,7 @@ MODGO_MODULES = \
bitbucket.org/creachadair/shell v0.0.8 \
cel.dev/expr v0.25.2 \
charm.land/bubbles/v2 v2.2.1 \
- charm.land/bubbletea/v2 v2.0.9 \
+ charm.land/bubbletea/v2 v2.0.10 \
charm.land/huh/v2 v2.0.3 \
charm.land/lipgloss/v2 v2.0.6 \
cloud.google.com/go v0.123.0 \
@@ -264,7 +264,7 @@ MODGO_MODULES = \
github.com/jonboulle/clockwork v0.5.0 \
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 \
github.com/keybase/go-keychain v0.0.1 \
- github.com/klauspost/compress v1.20.0 \
+ github.com/klauspost/compress v1.20.1 \
github.com/klauspost/pgzip v1.2.6 \
github.com/kr/pretty v0.3.1 \
github.com/kr/text v0.2.0 \
