build(deps): bump github.com/cli/cli/v2 from 2.20.2 to 2.62.0

[dependabot]

Bumps github.com/cli/cli/v2 from 2.20.2 to 2.62.0.

Release notes

Sourced from github.com/cli/cli/v2's releases.

GitHub CLI 2.62.0

What's Changed

• Update monotonic verification logic and testing by @​malancas in cli/cli#9856
• Check extension for latest version when executed by @​andyfeller in cli/cli#9866
• Shorten extension release checking from 3s to 1s by @​andyfeller in cli/cli#9914
• Mention GitHub CLI team on discussion issues by @​andyfeller in cli/cli#9920

Full Changelog: cli/cli@v2.61.0...v2.62.0

Security

• A security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the gh codespace ssh or gh codespace logs commands.

  For more information, see GHSA-p2h2-3vg9-4p87

GitHub CLI notifies users about latest extension upgrades

Similar to the notification of latest gh releases, the v2.62.0 version of GitHub CLI will notify users about latest extension upgrades when the extension is used:

$ gh ado2gh
...
A new release of ado2gh is available: 1.7.0 → 1.8.0
To upgrade, run: gh extension upgrade ado2gh --force
https://github.com/github/gh-ado2gh

Why does this matter?

This removes a common pain point of extension authors as they have had to reverse engineer and implement a similar mechanism within their extensions directly.

With this quality of life improvement, there are 2 big benefits:

1. Extension authors will hopefully see increased adoption of newer releases while having lower bar to maintaining their extensions.
2. GitHub CLI users will have greater awareness of new features, bug fixes, and security fixes to the extensions used.

What do you need to do?

Extension authors should review their extensions and consider removing any custom logic previously implemented to notify users of new releases.

GitHub CLI 2.61.0

Ensure users understand consequences before making repository visibility changes

In v2.61.0, gh repo edit command has been enhanced to inform users about consequences of changing visibility and ensure users are intentional before making irreversible changes:

1. Interactive gh repo edit visibility change requires confirmation when changing from public, private, or internal
2. Non-interactive gh repo edit --visibility change requires new --accept-visibility-change-consequences flag to confirm
3. New content to inform users of consequences
   • Incorporate GitHub Docs content into help usage and interactive gh repo edit experience

... (truncated)

Commits

• cd3f2ad Merge pull request #9920 from cli/andyfeller/github-cli-676-improved-visibility
• e64742c Merge commit from fork
• d4262f8 Mention GitHub CLI team on discussion issues
• 8990b1c Merge pull request #9914 from cli/andyfeller/cli-cli-8183-timeout
• b8ef951 Shorten extension release checking from 3s to 1s
• a02f845 Update internal/codespaces/rpc/invoker.go
• 9b9e654 Merge pull request #9866 from andyfeller/andyfeller/cli-cli-8183
• 3ec657d Enhance extension upgrade tests for URL
• 6d4c74b Merge pull request #9856 from malancas/verify-attestation-monotonic-tests
• 54c0739 Delete .github/workflows/licenses.yml
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.