This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.66.1` -> `v2.67.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.67.0`](https://github.com/cli/cli/releases/tag/v2.67.0): GitHub CLI 2.67.0

[Compare Source](cli/cli@v2.66.1...v2.67.0)

#### `gh pr checkout` now supports interactively selecting a pull request

Similar to commands like `gh workflow run` which prompts for a workflow to run, now `gh pr checkout` will prompt for a pull request to checkout. The list is currently limited to the most recent 10 pull requests in the repository.

https://github.com/user-attachments/assets/0b2e3761-7318-4573-8a23-ae6f1a44b018

Big thank you to [@&#8203;nilvng](https://github.com/nilvng) for implementing this 🙌

#### Contributing guidelines updated

We've updated our [`CONTRIBUTING.md`](https://github.com/cli/cli/blob/trunk/.github/CONTRIBUTING.md) guidelines to give more clarity around old `help wanted` issues.

*TLDR*:

-   Please directly mention `@cli/code-reviewers` when an issue you want to work on does not have clear Acceptance Criteria
-   Please only open pull requests for issues with *both*  the help wanted label and clear Acceptance Criteria
-   Please avoid expanding pull request scope to include changes that are not described in the connected issue's Acceptance Criteria

Note: Acceptance Criteria is posted as an issue comment by a core maintainer.

See cli/cli#10381 and cli/cli#10395 for more information.

❓ Have feedback on anything? We'd love to hear from you in a discussion post ❤️

#### What's Changed

##### ✨ Features

-   feat: let user select pr to checkout by [@&#8203;nilvng](https://github.com/nilvng) in cli/cli#9868
-   feat: Add support for deleting autolink references by [@&#8203;hoffm](https://github.com/hoffm) in cli/cli#10362
-   \[gh extensions install] Improve help text and error message by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10333
-   Error when `gh repo rename` is used with a new repo name that contains an owner by [@&#8203;timrogers](https://github.com/timrogers) in cli/cli#10364
-   Attestation bundle fetch improvements by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10233
-   \[gh project item-list] Add `iterationId` field in ProjectV2ItemFieldIterationValue by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10329

##### 🐛 Fixes

-   \[gh api] Fix mutual exclusion messages of `--slurp` flag by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10332
-   Exit with error if no matching predicate type exists by [@&#8203;kommendorkapten](https://github.com/kommendorkapten) in cli/cli#10421
-   Do not try to parse bodies for HEAD requests by [@&#8203;jsoref](https://github.com/jsoref) in cli/cli#10388
-   \[gh project item-edit] Fix number type by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10374
-   \[gh workflow run] Improve error handling for `--ref` flag by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10328
-   \[gh config] Escape pipe symbol in Long desc for website manual by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10371

##### 📚 Docs & Chores

-   Fix logic error in contributing docs by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10395
-   Docs: Clarify guidelines for `help wanted` issues and pull requests by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10381
-   \[gh pr status] Mention `gh pr checks` in the `Long` section by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10389
-   \[docs/releasing.md] Add basic info for homebrew update flow by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10344
-   \[gh issue/pr list] Improve help text by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10335
-   Remove v1 project 'add to board' automation from prauto workflow by [@&#8203;hoffm](https://github.com/hoffm) in cli/cli#10331
-   Note: the following pair of MRs was reverted and never made into a release
    -   \[gh repo edit] Allow setting commit message defaults by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10363
    -   Revert "\[gh repo edit] Allow setting commit message defaults" by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10372

#####  Dependencies

-   Bump google.golang.org/protobuf from 1.36.4 to 1.36.5 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10379

**Full Changelog**: cli/cli@v2.66.1...v2.67.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNjUuMSIsInVwZGF0ZWRJblZlciI6IjM5LjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->

…esolved 1/1) (#145)

* fix(eval): correct harness config schema + default to no language filter

First-run findings against the real multi_swe_bench 1.1.2 + the actual Go
dataset:

- HarnessConfig was wrong: it emitted a bogus `mode` key (marshmallow
  rejects unknown fields) and omitted required CliArgs fields. Rewrite to
  the exact 19-field schema (workdir, patch_files, dataset_files,
  force_build, output_dir, specifics, skips, repo_dir, need_clone,
  global_env, clear_env, stop_on_error, max_workers,
  max_workers_build_image, max_workers_run_instance, fix_patch_run_cmd,
  log_dir, log_level, log_to_console, human_mode), with conservative
  defaults (serial workers, harness clones into repo_dir, no abort on a
  single instance error).
- The dataset ships pre-split per language (go/<repo>_dataset.jsonl) with
  no per-record `language` field, so the old default `--lang go` filtered
  everything out. Default to "" (no filter).

The tolerant dataset accessors needed no change: base.sha (nested) and the
resolved_issues problem-statement fallback both read the real records
correctly, confirmed via `mswe-eval inspect`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(eval): drive octo via REPL (single-turn skips the tool loop); log outside repo

Two more first-run findings, validated end-to-end against cli/cli#10388:

- A single-turn `octo chat "msg"` does ONE model round-trip and does NOT
  run the agentic tool-execution loop (that lives only in REPL mode), so
  the model would announce edits but never make them → empty patches.
  Drive octo through REPL instead: pipe the prompt on stdin, EOF ends the
  session. Added runStdin for this. Confirmed octo then actually explores
  (git/grep/read_file), edits, and runs `go build` to verify.

- The octo transcript was written to <repo>/.mswe-octo.log, so `git add -A`
  swept the 2645-line log into the fix_patch (123 KB). Write it under
  workdir/logs/ instead. The resulting patch is now just the source change.

Result on cli/cli#10388: octo produced a focused, correct-looking 5-line
fix to pkg/cmd/api/api.go (skip parseErrorResponse on HEAD requests, which
have no body) — exactly the reported bug. Whether it passes the hidden
tests is for the judge step (blocked on macOS by a harness case-collision;
needs a Linux container — tracked separately).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(eval): judge in a Linux container (--docker); validated resolved 1/1

The Multi-SWE-bench judge can't run natively on macOS/Windows (the harness
package can't be imported on a case-insensitive filesystem — colliding
Qiskit/qiskit modules). Add a `--docker` mode (auto-enabled off Linux) that
runs the harness in a small Linux image (octo-mswe-judge, auto-built from an
embedded Dockerfile) and drives the HOST Docker daemon via the mounted
/var/run/docker.sock to build + test each instance.

macOS-specific path/permission gotchas handled along the way:
- /tmp→/private/tmp symlink + same-path bind mounts: resolve symlinks for the
  config contents, config path, and mounts so host and container agree.
- Docker Desktop shares /Users but not /private/tmp: use a home-based workdir.
- git "dubious ownership" on host-owned clones (root in container vs uid 501
  on the host): `git config --system --add safe.directory '*'` in the image.
- the harness validates repo_dir exists up front: create it before invoking.

Validated end-to-end against multi_swe_bench 1.1.2 + the real Go data: octo's
5-line fix to cli/cli#10388 (skip parseErrorResponse on HEAD requests) scored
**resolved 1/1** under the hidden tests. The full generate → judge pipeline
works. dev-docs/mswe-eval.md updated with the --docker workflow, the
home-workdir requirement, and the validated result.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>