chore(mise): update tool aqua:cli/cli (2.98.0 → 2.99.0)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aqua:cli/cli	tools	minor	2.98.0 → 2.99.0	2.100.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cli/cli (aqua:cli/cli)

v2.99.0: GitHub CLI 2.99.0

Compare Source

What's Changed

• Curate the error when the sync target is checked out in another worktree by @​williammartin in #​14076
• Adapt spinner output for invoking agents by @​niik in #​14191
• Guard pr merge --delete-branch against worktree conflicts by @​tidy-dev in #​14007
• Add worktree checkout to gh issue develop by @​sergiou87 in #​14136
• Fix Copilot declined-install warning newline by @​BagToad in #​14222
• --attach stack 1/8: Report what kind of token is active by @​BagToad in #​14177
• --attach stack 2/8: Describe and validate a file gh can attach by @​BagToad in #​14178
• --attach stack 3/8: Rewrite markdown references to uploaded assets by @​BagToad in #​14179
• --attach stack 4/8: Upload an asset to GitHub by @​BagToad in #​14180
• --attach stack 5/8: Add the flag and upload behind it by @​BagToad in #​14181
• --attach stack 6/8: Add the flag to gh pr comment and gh issue comment by @​BagToad in #​14182
• --attach stack 7/8: Add the flag to gh pr create and gh pr edit by @​BagToad in #​14183
• --attach stack 8/8: Add the flag to gh issue create and gh issue edit by @​BagToad in #​14184
• --attach stack: review feedback round by @​BagToad in #​14200
• Make commands own attachment flag policy by @​BagToad in #​14255
• Document attachment support in gh skill by @​BagToad in #​14261
• Address final attachment review feedback by @​BagToad in #​14262
• Reject non-empty worktree targets before branch creation by @​tidy-dev in #​14244
• Prevent repo sync from corrupting linked worktrees by @​sergiou87 in #​14060
• docs(gh-skill): document gh issue develop --checkout --worktree by @​babakks in #​14265
• Reject --comments with --json by @​BagToad in #​14215
• chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @​dependabot[bot] in #​14247
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 by @​dependabot[bot] in #​14248
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @​dependabot[bot] in #​14250
• chore(deps): bump charm.land/bubbles/v2 from 2.1.1 to 2.2.0 by @​dependabot[bot] in #​14249
• Clarify PR testing guidance by @​williammartin in #​14272
• Apply suspected spam labels directly by @​williammartin in #​14271
• Bump agentic-workflows to 0.87.5 by @​williammartin in #​14273
• Do not allow dependabot to bump aw by @​williammartin in #​14274
• Modernize Go code with go fix by @​BagToad in #​14278
• chore(deps): bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 by @​dependabot[bot] in #​14275
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.1 to 0.5.2 by @​dependabot[bot] in #​14258
• chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @​dependabot[bot] in #​14267
• Limit attachment batches to 50 files by @​BagToad in #​14289
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @​dependabot[bot] in #​14299
• chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​14301
• chore(deps): bump the codeql-actions group with 3 updates by @​dependabot[bot] in #​14300
• fix(skills): install Codex user skills to ~/.agents/skills by @​scarletkc in #​14154
• Support PI_CODING_AGENT_DIR for skills by @​tommaso-moro in #​14260

New Contributors

• @​scarletkc made their first contribution in #​14154

Full Changelog: cli/cli@v2.98.0...v2.99.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: aqua:cli/cli (GitHub CLI, mise-managed dev tool)
• Version: 2.98.0 → 2.99.0
• Type: minor

Release Changes

Source: cli/cli v2.99.0

Features:

• New repeatable --attach flag on gh issue/pr create/edit/comment for uploading images/videos (gh.io/gh-attach)
• gh issue develop --checkout --worktree support
• Text-only spinner output when gh is invoked by a coding agent

Fixes:

• Worktree safety: gh repo sync no longer corrupts linked worktrees and explains cross-worktree checkouts; gh pr merge --delete-branch guarded against worktree conflicts; gh issue develop rejects non-empty worktree targets
• gh view now rejects --comments combined with --json (behavioral tightening)
• Copilot declined-install warning newline; Codex user skills install path; attachment batches limited to 50 files

Chores: internal dependency bumps (grpc 1.83.2, bubbletea/bubbles, go-containerregistry 0.22.0, sigstore protobuf-specs 0.5.2, codeql-actions, azure/login 3.0.2).

Breaking Changes

None affecting our usage. Verified against this repo:

• grep --comments across the repo → no matches, so the --comments + --json rejection cannot affect any script
• Repo usage of gh is limited to gh release download, gh pr view/review/comment/merge, gh workflow run, gh auth status (Taskfile.yaml, .github/actions/app-tests/setup.sh, .github/prompts/*) — none are affected by the changes above

Code Changes Required

None. Single-line change to .mise.toml.

Security Impact

No security fixes in this release (no CVEs referenced). Dev-tooling only:

• .mise.toml is the only reference to cli/cli (grep cli/cli|2\.98\.0 → .mise.toml:2 only)
• CI does not use mise (grep mise in .github/ → no matches); workflows use the runner-preinstalled gh
• No container image under apps/ installs or ships gh; Dockerfiles, docker-bake.hcl, and tests.yaml are untouched
• Multi-arch: not applicable (no image change)

Recommendation

Safe to merge — minor bump of a mise-managed local development tool; only .mise.toml changes, no container images are affected, and no gh invocation pattern used by this repo changes behavior in 2.99.0.