Bump keyring operation timeout from 3s to 60s - #13787
Merged
Merged
Conversation
The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react. Fixes cli#11005
Contributor
|
Thanks for your pull request! While it doesn't meet all of our standard requirements, it appears to be a small, focused contribution and has been routed to the team for review. Note: We still encourage linking to an issue with the |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR increases the timeout used by the internal keyring wrapper so gh waits longer for OS keyring unlock prompts (password/biometric confirmation) instead of failing quickly.
Changes:
- Bumped keyring
Set,Get, andDeleteoperation timeouts from 3s to 60s.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Contributor
Author
BagToad
enabled auto-merge
July 16, 2026 14:34
pabrahamsson
pushed a commit
to pabrahamsson/containers
that referenced
this pull request
Aug 3, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@​dependabot](https://github.com/dependabot) in [#​13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@​dependabot](https://github.com/dependabot) in [#​13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@​dependabot](https://github.com/dependabot) in [#​13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@​dependabot](https://github.com/dependabot) in [#​13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot) in [#​13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@​dependabot](https://github.com/dependabot) in [#​13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@​dependabot](https://github.com/dependabot) in [#​13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@​dependabot](https://github.com/dependabot) in [#​13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@​dependabot](https://github.com/dependabot) in [#​13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@​dependabot](https://github.com/dependabot) in [#​13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@​dependabot](https://github.com/dependabot) in [#​13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@​dependabot](https://github.com/dependabot) in [#​13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@​dependabot](https://github.com/dependabot) in [#​13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@​dependabot](https://github.com/dependabot) in [#​13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@​dependabot](https://github.com/dependabot) in [#​13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@​dependabot](https://github.com/dependabot) in [#​13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in [#​13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@​dependabot](https://github.com/dependabot) in [#​13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@​dependabot](https://github.com/dependabot) in [#​13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot) in [#​13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@​dependabot](https://github.com/dependabot) in [#​13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@​dependabot](https://github.com/dependabot) in [#​13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@​dependabot](https://github.com/dependabot) in [#​13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@​dependabot](https://github.com/dependabot) in [#​13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@​dependabot](https://github.com/dependabot) in [#​13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@​dependabot](https://github.com/dependabot) in [#​13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot) in [#​13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@​dependabot](https://github.com/dependabot) in [#​14018](cli/cli#14018) #### New Contributors - [@​lukewar](https://github.com/lukewar) made their first contribution in [#​13777](cli/cli#13777) - [@​niik](https://github.com/niik) made their first contribution in [#​13780](cli/cli#13780) - [@​kofuk](https://github.com/kofuk) made their first contribution in [#​13787](cli/cli#13787) - [@​zwick](https://github.com/zwick) made their first contribution in [#​13807](cli/cli#13807) - [@​kobihikri](https://github.com/kobihikri) made their first contribution in [#​13886](cli/cli#13886) - [@​pstoeckle](https://github.com/pstoeckle) made their first contribution in [#​13940](cli/cli#13940) - [@​Solaris-star](https://github.com/Solaris-star) made their first contribution in [#​13927](cli/cli#13927) - [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#​13900](cli/cli#13900) - [@​alondahari](https://github.com/alondahari) made their first contribution in [#​13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28
1 task
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 11, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@​me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react.
Fixes #11005
Manually built the binary and confirmed the new 60s timeout takes effect as expected.