chore(mise): update tool aqua:cli/cli (2.99.0 → 2.100.0)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua:cli/cli	tools	minor	2.99.0 → 2.100.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cli/cli (aqua:cli/cli)

v2.100.0: GitHub CLI 2.100.0

Compare Source

Experimental: Route GitHub API traffic through a custom host

Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration:

# Route API traffic for github.com through a gateway
gh config set api_host gh-gateway.example.com --host github.com

# Read the configured API host
gh config get api_host --host github.com

The original host remains in use for authentication, Git remotes, and browser URLs.

[!NOTE]
api_host is experimental and is not a security boundary. Requests may still reach the original host.

What's Changed

✨ Features

• Honor per-host api_host routing across GitHub API requests by @​williammartin in #​14104
• Expose api_host through gh config get and gh config set by @​williammartin in #​14332
• Add webhook as an official extension by @​williammartin in #​14326
• Print full command help after command misuse when gh is invoked by a coding agent by @​niik in #​14198

🐛 Fixes

• fix(api): disable telemetry for unauthenticated GHES requests using absolute hostnames by @​williammartin in #​14337

📚 Docs & Chores

• Fix discussion acceptance test flags by @​williammartin in #​14321
• Clarify supported GHES versions by @​williammartin in #​14324
• Improve automated issue triage analysis by @​sergiou87 in #​14318
• Record attachment counts in telemetry by @​BagToad in #​14327

Dependencies

• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @​babakks in #​14331
• chore(deps): bump Go toolchain from 1.26.7 to 1.26.8 by @​babakks in #​14330
• chore(deps): bump github.com/cli/go-gh/v2 from 2.15.0 to 2.16.0 by @​williammartin in #​14338

Full Changelog: cli/cli@v2.99.0...v2.100.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: aqua:cli/cli (GitHub CLI gh, github.com/cli/cli)
• Version: 2.99.0 → 2.100.0
• Type: minor

Release Changes

Source: cli/cli v2.100.0 release notes (linked in PR body)

• Experimental per-host api_host config to route GitHub API traffic through a gateway (gh config set/get api_host --host <host>)
• webhook promoted to an official extension
• gh now prints full command help after misuse when invoked by a coding agent
• Fix: telemetry disabled for unauthenticated GHES requests using absolute hostnames
• Dependency bumps: golang.org/x/crypto 0.55.0 → 0.56.0, github.com/cli/go-gh/v2 2.15.0 → 2.16.0, Go toolchain 1.26.7 → 1.26.8

Breaking Changes

None affecting our usage. This is a feature release; no removed commands or flags. The only pinned reference is .mise.toml:2; no app Dockerfile or docker-bake.hcl installs gh (verified: grep -r 'cli/cli|gh_' apps/ .github/ Taskfile.yaml → only .mise.toml).

Code Changes Required

None. The diff is a single-line version bump in .mise.toml. Commands this repo relies on (gh release download in Taskfile.yaml:25-29 and .github/actions/app-tests/setup.sh, gh workflow run in Taskfile.yaml:71, gh auth status in Taskfile.yaml:76) are unchanged in this release.

Security Impact

No security fixes in the release notes. The golang.org/x/crypto bump is routine maintenance. Note: the new api_host option is explicitly documented upstream as experimental and "not a security boundary" — it is opt-in and inert unless explicitly configured, so no threat-surface change for this repo. CI jobs use the GitHub-hosted runner's gh, not the mise-installed one, so workflows are unaffected either way.

Recommendation

Safe to merge — dev-tooling-only minor bump (mise-managed local gh), no container image affected, no breaking changes, no usage overlap with changed behavior.