@google/gemini-cli 0.60.0-preview.0 → 0.61.0-nightly.20260910.ged2ac40df

package/bundle/docs/changelogs/index.md

@@ -18,6 +18,18 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.59.0 - 2026-09-08
+
+- **MCP OAuth SSRF Mitigation:** Prevented Server-Side Request Forgery (SSRF)
+  during Model Context Protocol (MCP) OAuth metadata discovery and
+  authentication
+  ([#29081](https://github.com/google-gemini/gemini-cli/pull/29081) by
+  @josebalius).
+- **Fail-Closed Workspace Trust:** Enforced a secure, fail-closed workspace
+  trust policy and filtered available `mcpServers` when operating in restricted
+  mode ([#29099](https://github.com/google-gemini/gemini-cli/pull/29099) by
+  @luisfelipe-alt).
+
 ## Announcements: v0.58.0 - 2026-09-01
 
 - **Core Security & Path Handling:** Enforced consistent symlink evaluation in

package/bundle/docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.58.0
+# Latest stable release: v0.59.0
 
-Released: September 1, 2026
+Released: September 8, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,38 +11,28 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Sandbox Security Isolation:** Isolated Docker and container runtime sockets
-  and binaries in macOS Seatbelt to restrict unauthorized container execution
-  access.
-- **Ignore Path Symlink Evaluation:** Enforced consistent symlink evaluation in
-  ignore path handling to prevent path bypass.
-- **Policy Configuration & Safety:** Declared top-level safety checkers in write
-  policy configuration for comprehensive safety validation.
-- **History Rollback & Retry Nudge:** Optimized history rollback mechanics and
-  retry nudge flows for more robust conversational recovery.
-- **Agent-to-Agent Stability:** Resolved stale cancellation errors on new
-  message turns in the Agent-to-Agent server to improve turn recovery.
+- **SSRF Prevention in MCP OAuth:** Prevented Server-Side Request Forgery (SSRF)
+  in Model Context Protocol (MCP) OAuth metadata discovery and authentication to
+  secure remote integrations.
+- **Fail-Closed Workspace Trust:** Enforced a fail-closed workspace trust model
+  to ensure security by default when accessing untrusted workspaces.
+- **Restricted Mode MCP Filtering:** Filtered available Model Context Protocol
+  (MCP) servers under restricted execution modes to minimize potential attack
+  surfaces.
 
 ## What's Changed
 
-- Changelog for v0.57.0-preview.0 by @gemini-cli-robot in
-  [#28918](https://github.com/google-gemini/gemini-cli/pull/28918)
-- fix(core): ensure consistent symlink evaluation in ignore path handling by
-  @luisfelipe-alt in
-  [#28915](https://github.com/google-gemini/gemini-cli/pull/28915)
-- refactor(core): remove eslint-disable and type-asserts from
-  shellExecutionService by @DavidAPierce in
-  [#28862](https://github.com/google-gemini/gemini-cli/pull/28862)
-- fix(sandbox): isolate Docker and container runtime sockets and binaries in
-  macOS Seatbelt by @josebalius in
-  [#28935](https://github.com/google-gemini/gemini-cli/pull/28935)
-- fix(a2a-server): clear stale cancellation error on new message turns by
-  @amelidev in [#28940](https://github.com/google-gemini/gemini-cli/pull/28940)
-- fix(core): declare top-level safety checkers in write policy configuration by
-  @luisfelipe-alt in
-  [#28961](https://github.com/google-gemini/gemini-cli/pull/28961)
-- (FIX) history rollback and retry nudge optimizations by @DavidAPierce in
-  [#28934](https://github.com/google-gemini/gemini-cli/pull/28934)
+- Changelog for v0.58.0-preview.0 by @gemini-cli-robot in
+  [#29082](https://github.com/google-gemini/gemini-cli/pull/29082)
+- chore(release): bump version to 0.59.0-nightly.20260825.g812f7a2bc by
+  @gemini-cli-robot in
+  [#29083](https://github.com/google-gemini/gemini-cli/pull/29083)
+- fix(core): prevent SSRF in MCP OAuth metadata discovery and authentication by
+  @josebalius in
+  [#29081](https://github.com/google-gemini/gemini-cli/pull/29081)
+- fix(core): enforce fail-closed workspace trust and filter mcpServers in
+  restricted mode by @luisfelipe-alt in
+  [#29099](https://github.com/google-gemini/gemini-cli/pull/29099)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.57.0...v0.58.0
+https://github.com/google-gemini/gemini-cli/compare/v0.58.0...v0.59.0

package/bundle/docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.59.0-preview.0
+# Preview release: v0.60.0-preview.0
 
-Released: September 1, 2026
+Released: September 8, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,24 +13,61 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **MCP Security Enhancements**: Prevented Server-Side Request Forgery (SSRF) in
-  Model Context Protocol (MCP) OAuth metadata discovery and authentication.
-- **Restricted Mode Strengthening**: Enforced fail-closed workspace trust and
-  implemented filtering for MCP servers when running in restricted mode.
+- **Workspace and Path Safety**: Enhanced path boundary checks, symlink
+  resolution, and mitigation of NTFS 8.3 short name (SFN) bypasses in command
+  safety and file discovery.
+- **Sandbox Isolation**: Isolated settings directories within sandbox containers
+  and temporary directories for macOS Seatbelt sandbox to restrict access.
+- **Extension Loader Hardening**: Hardened path resolution and boundary
+  validation in extension loader, with new consent prompts for runtime
+  environment changes.
+- **Network and OAuth Security**: Improved destination validation and connection
+  routing in web fetch utilities, and enforced RFC 9207 issuer identification in
+  the MCP OAuth flow.
+- **Tool Output Provenance**: Enforced envelope metadata provenance for
+  untrusted tool outputs to guarantee integrity.
 
 ## What's Changed
 
-- Changelog for v0.58.0-preview.0 by @gemini-cli-robot in
-  [#29082](https://github.com/google-gemini/gemini-cli/pull/29082)
-- chore(release): bump version to 0.59.0-nightly.20260825.g812f7a2bc by
+- fix(core): improve destination validation and connection routing in web fetch
+  utilities by @diegogodinezr in
+  [#29120](https://github.com/google-gemini/gemini-cli/pull/29120)
+- fix(core): enforce RFC 9207 issuer identification in MCP OAuth flow by
+  @jvargassanchez-dot in
+  [#29117](https://github.com/google-gemini/gemini-cli/pull/29117)
+- chore(release): bump version to 0.60.0-nightly.20260901.g0bd1d4397 by
   @gemini-cli-robot in
-  [#29083](https://github.com/google-gemini/gemini-cli/pull/29083)
-- fix(core): prevent SSRF in MCP OAuth metadata discovery and authentication by
-  @josebalius in
-  [#29081](https://github.com/google-gemini/gemini-cli/pull/29081)
-- fix(core): enforce fail-closed workspace trust and filter mcpServers in
-  restricted mode by @luisfelipe-alt in
-  [#29099](https://github.com/google-gemini/gemini-cli/pull/29099)
+  [#29162](https://github.com/google-gemini/gemini-cli/pull/29162)
+- Changelog for v0.58.0 by @gemini-cli-robot in
+  [#29161](https://github.com/google-gemini/gemini-cli/pull/29161)
+- fix(cli): isolate temporary directory for macOS Seatbelt sandbox by
+  @jvargassanchez-dot in
+  [#29171](https://github.com/google-gemini/gemini-cli/pull/29171)
+- feat(extensions): harden path resolution and boundary validation in extension
+  loader by @diegogodinezr in
+  [#29169](https://github.com/google-gemini/gemini-cli/pull/29169)
+- Changelog for v0.59.0-preview.0 by @gemini-cli-robot in
+  [#29159](https://github.com/google-gemini/gemini-cli/pull/29159)
+- fix(core): sanitize and remove hardcoded Google CrUX API key in
+  chrome-devtools-mcp by @amelidev in
+  [#29158](https://github.com/google-gemini/gemini-cli/pull/29158)
+- fix(extensions): prompt for consent on environment changes and sanitize
+  runtime-altering environment variables by @amelidev in
+  [#28863](https://github.com/google-gemini/gemini-cli/pull/28863)
+- fix(core): enhance workspace path boundary checks and symlink resolution in
+  command safety and file discovery by @jesussamuel-byte in
+  [#29170](https://github.com/google-gemini/gemini-cli/pull/29170)
+- fix(config): enforce strict permission and ownership checks on system-wide
+  configuration paths by @jesussamuel-byte in
+  [#29115](https://github.com/google-gemini/gemini-cli/pull/29115)
+- fix(core): mitigate NTFS 8.3 short name (SFN) path by @urielefrenvirtusa in
+  [#29116](https://github.com/google-gemini/gemini-cli/pull/29116)
+- fix(cli): isolate settings directory in sandbox containers by
+  @jvargassanchez-dot in
+  [#29216](https://github.com/google-gemini/gemini-cli/pull/29216)
+- fix(core): enforce envelope metadata provenance for untrusted tool outputs by
+  @luisfelipe-alt in
+  [#29215](https://github.com/google-gemini/gemini-cli/pull/29215)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.58.0-preview.0...v0.59.0-preview.0
+https://github.com/google-gemini/gemini-cli/compare/v0.59.0-preview.0...v0.60.0-preview.0

package/bundle/{gemini-4L7IGTB3.js → gemini-JE6ATRM2.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   startCommand,
   startServer
-} from "./chunk-Z3ZCNEN5.js";
+} from "./chunk-UBRBPMXX.js";
 import {
   BuiltinCommandLoader,
   CommandService,
@@ -46,11 +46,11 @@ import {
   updateExtension,
   validateAuthMethod,
   validateContextFilePath
-} from "./chunk-ZX526LXA.js";
+} from "./chunk-XGFMBHG3.js";
 import {
   exitCli,
   require_source
-} from "./chunk-FZ5V6AOR.js";
+} from "./chunk-KNYCFGTX.js";
 import {
   appEvents
 } from "./chunk-5PS3AYFU.js";
@@ -88,11 +88,11 @@ import {
   resolveGemmaConfig,
   saveModelChange,
   stripAnsi
-} from "./chunk-RY7G2LHR.js";
+} from "./chunk-Q5JCV3BH.js";
 import {
   RELAUNCH_EXIT_CODE
-} from "./chunk-ZOCA7DR7.js";
-import "./chunk-SZWITNYT.js";
+} from "./chunk-QZJZIVUG.js";
+import "./chunk-2QZM4LJN.js";
 import {
   cleanupCheckpoints,
   registerCleanup,
@@ -101,7 +101,7 @@ import {
   runExitCleanup,
   runSyncCleanup,
   setupSignalHandlers
-} from "./chunk-AS5HUHJQ.js";
+} from "./chunk-GTUUXLUY.js";
 import {
   ASK_USER_TOOL_NAME,
   ApprovalMode,
@@ -255,7 +255,7 @@ import {
   updatePolicy,
   writeToStderr,
   writeToStdout
-} from "./chunk-6JC2DFFV.js";
+} from "./chunk-MXKFKSG4.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
@@ -7855,7 +7855,7 @@ async function loadSandboxConfig(settings, argv) {
   }
   const command2 = getSandboxCommand(sandboxValue);
   const packageJson = await getPackageJson(__dirname3);
-  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.60.0-preview.0" ?? customImage ?? packageJson?.config?.sandboxImageUri;
+  const image = process.env["GEMINI_SANDBOX_IMAGE"] ?? "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.61.0-nightly.20260910.ged2ac40df" ?? customImage ?? packageJson?.config?.sandboxImageUri;
   const isNative = command2 === "windows-native" || command2 === "sandbox-exec" || command2 === "lxc";
   return command2 && (image || isNative) ? { enabled: true, allowedPaths, networkAccess, command: command2, image } : void 0;
 }
@@ -11196,7 +11196,7 @@ async function runNonInteractive({
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-IFCLCSNA.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-MM4VAG36.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -11706,7 +11706,7 @@ async function runNonInteractive2(params) {
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-IFCLCSNA.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-MM4VAG36.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -16916,7 +16916,7 @@ async function resolveSessionId(resumeArg, sessionIdArg, sessionFileArg) {
   }
 }
 async function startInteractiveUI(config, settings, startupWarnings, workspaceRoot = process.cwd(), resumedSessionData, initializationResult) {
-  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-JODN5SQN.js");
+  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-CDZPTKWD.js");
   await doStartUI(
     config,
     settings,
@@ -17125,7 +17125,7 @@ ${finalArgs[promptIndex + 1]}`;
     await config.storage.initialize();
     adminControlsListner.setConfig(config);
     if (config.isInteractive() && settings.merged.general.devtools) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-IFCLCSNA.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-MM4VAG36.js");
       setupInitialActivityLogger(config);
     }
     registerTelemetryConfig(config);
@@ -17184,7 +17184,7 @@ ${finalArgs[promptIndex + 1]}`;
     const initAppHandle = startupProfiler.start("initialize_app");
     const initializationResult = await initializeApp(config, settings);
     initAppHandle?.end();
-    import("./liteRtServerManager-2BNWXU4Z.js").then(({ LiteRtServerManager }) => {
+    import("./liteRtServerManager-CIEEHOLV.js").then(({ LiteRtServerManager }) => {
       const mergedGemma = settings.merged.experimental?.gemmaModelRouter;
       if (!mergedGemma) return;
       const userGemma = settings.forScope("User" /* User */).settings.experimental?.gemmaModelRouter;