chore(deps): update bump-dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.121 → 2.1.132				patch	2.1.138 (+3)
@google/gemini-cli	0.39.1 → 0.41.2				minor
go (source)	1.26.1 → 1.26.3				patch
node	135dc9a → 83bd970			final	digest
node	135dc9a → 83bd970			stage	digest
opencode-ai	1.14.28 → 1.14.40				patch	1.14.45 (+4)

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.132

Compare Source

• Added CLAUDE_CODE_SESSION_ID environment variable to the Bash tool subprocess environment, matching the session_id passed to hooks
• Added CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 env var to opt out of the fullscreen alternate-screen renderer and keep the conversation in the terminal's native scrollback
• Added a "Pasting…" footer hint while a Ctrl+V image paste is being read from the clipboard
• Fixed external SIGINT (e.g. IDE stop button, kill -INT) not running graceful shutdown — terminal modes are now restored and the --resume hint is printed instead of an abrupt exit
• Fixed an uncaught exception when the terminal is closed or SSH disconnects mid-session under the native build
• Fixed --resume failing with no low surrogate in string when a tool error truncation split an emoji; pre-corrupted sessions are sanitized on load
• Fixed --permission-mode flag being ignored when resuming a plan-mode session with -p --continue/--resume, and plan mode not being re-applied after ExitPlanMode within the same session
• Fixed fullscreen mode showing a blank screen after laptop sleep/wake or Ctrl+Z/fg until the next keystroke or stream output
• Fixed cursor landing mid-grapheme on Ctrl+E/A/K/U/arrow keys when an Indic conjunct or ZWJ emoji wraps across lines
• Fixed vim operators corrupting text containing decomposed (NFD) accented characters
• Fixed pasting text starting with / silently swallowing the input or triggering an unknown-command reply
• Fixed pasting dumping stray escape sequences into the prompt when focus events or mouse-tracking reports interleave with the bracketed paste
• Fixed mouse wheel scrolling being too fast in Cursor and VS Code 1.92–1.104 due to an upstream xterm.js bug
• Fixed scroll-wheel handling in JetBrains IDE 2025.2 terminals (spurious arrow keys, wrong-direction events, runaway acceleration)
• Fixed /usage Ctrl+S hanging when copying the stats screenshot to the clipboard on Linux/X11
• Fixed /terminal-setup showing a contradictory error in Windows Terminal — Shift+Enter is natively supported there
• Fixed /effort picker not reflecting the CLAUDE_CODE_EFFORT_LEVEL env var override
• Fixed /status showing the wrong default model for some users
• Fixed slash command autocomplete popup being capped at ~3–5 visible commands instead of scaling with terminal height
• Fixed statusline context_window token counts reflecting cumulative session totals instead of current context usage
• Fixed Alt+T (thinking toggle) not working on macOS terminals without "Option as Meta" enabled (iTerm2, Terminal.app defaults)
• Fixed dead keyboard input on Windows after re-opening a background session from claude agents
• Fixed unbounded memory growth (10GB+ RSS) when a stdio MCP server writes non-protocol data to stdout
• Fixed MCP servers that connect but fail tools/list silently showing 0 tools — they now retry once and show "connected · tools fetch failed" in /mcp
• Fixed unauthorized claude.ai MCP connectors showing as "failed" instead of "needs auth", and headless -p mode retrying non-transient 4xx connection failures
• Improved visual consistency in slash command dialogs and /login, /upgrade, /extra-usage dialog spacing
• Updated the /tui fullscreen startup banner to describe additional renderer benefits (lower memory usage, mouse support, auto-copy on select)
• Fixed Bedrock and Vertex 400 errors when ENABLE_PROMPT_CACHING_1H is set

v2.1.131

Compare Source

• Fixed VS Code extension failing to activate on Windows due to a hardcoded build path in the bundled SDK (createRequire polyfill bug)
• Fixed Mantle endpoint authentication failing with missing x-api-key header

v2.1.129

Compare Source

• Added --plugin-url <url> flag to fetch a plugin .zip archive from a URL for the current session
• Added CLAUDE_CODE_FORCE_SYNC_OUTPUT=1 env var to force-enable synchronized output on terminals that auto-detection misses (e.g. Emacs eat)
• Added CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE: when set on Homebrew or WinGet installations, Claude Code runs the upgrade command in the background and prompts to restart
• Plugin manifests: themes and monitors should now be declared under "experimental": { ... }. Top-level declarations still work but claude plugin validate will warn
• Gateway /v1/models discovery for the /model picker is now opt-in via CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 (was automatic in 2.1.126–2.1.128)
• Ctrl+R history picker now defaults to searching all prompts across all projects, matching pre-2.1.124 behavior. Press Ctrl+S to narrow to the current project or session
• Third-party deployments (Bedrock, Vertex, Foundry, or ANTHROPIC_BASE_URL gateway) no longer see spinner tips pointing at first-party Anthropic surfaces
• skillOverrides setting now works: off hides from model and /, user-invocable-only hides from model only, name-only collapses description
• The claude_code.pull_request.count OTel metric now counts PRs/MRs created via MCP tools, not just shell commands
• Policy refusal error messages now include the API Request ID for easier support debugging
• Fixed API errors with unrecognized 400 status codes showing raw JSON instead of the underlying error message
• Fixed /clear not resetting the terminal tab title after a conversation
• Fixed session title chip from /rename disappearing while a permission or other dialog is active
• Fixed agent panel below the prompt being hidden when subagents are running (regression in 2.1.122)
• Fixed external-editor handoff (Ctrl+G) blanking the conversation history above the prompt
• Fixed /context dumping its rendered ASCII visualization grid into the conversation, wasting ~1.6k tokens per call
• Fixed /agents Library list arrow-key navigation: the highlighted agent now stays visible when the list exceeds the viewport
• Fixed /branch success message not including the new branch's session id for /resume
• Fixed bold headers with keycap/ZWJ/skin-tone emoji losing trailing characters in fullscreen mode
• Fixed server-managed settings policy not applying for enterprise/team users whose stored OAuth credentials lacked the user:inference scope
• Fixed OAuth refresh race after wake-from-sleep that could log out all running sessions
• Fixed 1-hour prompt cache TTL being silently downgraded to 5 minutes
• Fixed cache-miss warning appearing spuriously after /clear or compaction when changing /effort or /model
• Fixed Bash(mkdir *), Bash(touch *) and similar allow rules not being honored for in-project paths
• Fixed deniedMcpServers patterns with a *:// scheme wildcard not matching mixed-case hostnames
• Fixed harmless WebSocket warning being logged as an error in --debug during voice mode
• [VSCode] Fixed /clear not clearing the conversation context and displayed transcript

v2.1.128

Compare Source

• Bare /color (no args) now picks a random session color
• /mcp now shows the tool count for connected servers and flags servers that connected with 0 tools
• --plugin-dir now accepts .zip plugin archives in addition to directories
• --channels now works with console (API key) authentication — console orgs with managed settings must set channelsEnabled: true to enable
• Updated /model picker: collapsed duplicate Opus 4.7 entries, and current Opus now shows as "Opus" instead of "Opus 4.7"
• Subprocesses (Bash, hooks, MCP, LSP) no longer inherit OTEL_* environment variables, so OTEL-instrumented apps run via the Bash tool no longer pick up the CLI's own OTLP endpoint
• MCP: workspace is now a reserved server name — existing servers with that name will be skipped with a warning
• Reconnecting MCP servers no longer flood the conversation with full tool-name lists on every reconnect — re-announced tools are summarized by server prefix
• SDK hosts now receive a persistent localSettings suggestion for Bash permission prompts, so "Always allow" writes to .claude/settings.local.json
• EnterWorktree now creates the new branch from local HEAD as documented, instead of origin/<default-branch> — unpushed commits are no longer dropped
• Auto mode: when the classifier can't evaluate an action, the error now includes a hint (retry, /compact, or run with --debug)
• Fixed focus mode briefly dimming the previous response when submitting a new prompt
• Fixed stray "4;0;" desktop notification on every /exit in Kitty and other terminals that interpret OSC 9 as a notification
• Fixed Remote Control showing an empty "Opening your options…" message on rate limit instead of actionable upsell options
• Fixed drag-and-drop image upload hanging on "Pasting text…" when the image read fails
• Fixed crash loop when piping very large input (>10 MB) to claude -p via stdin
• Fixed long URLs not being individually clickable on every wrapped row in fullscreen mode
• Fixed /plugin Components panel showing "Marketplace 'inline' not found" for plugins loaded via --plugin-dir
• Fixed MCP tool results dropping images when the server returns both structured content and content blocks
• Fixed fenced code blocks inside list items carrying leading whitespace into the clipboard on copy-paste
• Fixed tab navigation in /config stranding focus — the tab header now stays focused so arrows and Esc keep working
• Fixed markdown link labels being lost on terminals without OSC 8 hyperlink support — links now render as label (url) instead of just the URL
• Fixed sessions on 1M-context models with a smaller autocompact window being falsely blocked with "Prompt is too long" before reaching the actual API limit
• Fixed parallel shell tool calls: a failing read-only command (grep, git diff, ls) no longer cancels sibling calls
• Fixed banner showing "with X effort" on models that don't support effort
• Fixed /fast on 3P providers fuzzy-matching to an unrelated skill instead of showing "not available"
• Fixed Bedrock default model resolving to global.* instead of the region-appropriate prefix
• Fixed vim mode: Space in NORMAL mode now moves the cursor right, matching standard vi/vim behavior
• Fixed terminal progress indicator (OSC 9;4) flickering off between tool calls — stays visible across the full turn
• Fixed /rename without args failing on resumed sessions whose last entry is a compact boundary
• Fixed stale "remote-control is active" status lines from prior sessions appearing after --resume/--continue
• Fixed stale installed_plugins.json entries pointing at deleted cache directories polluting PATH
• Fixed MCP stdio servers receiving corrupted arguments when CLAUDE_CODE_SHELL_PREFIX is set and an argument contains spaces or shell metacharacters
• Fixed sub-agent progress summaries missing the prompt cache (~3× cache_creation reduction)
• Fixed /plugin update never detecting new versions of npm-sourced plugins
• Fixed sub-agent summaries firing repeatedly while a sub-agent's transcript is static, capping worst-case token cost on idle sub-agents
• Headless --output-format stream-json: init.plugin_errors now includes --plugin-dir load failures in addition to dependency demotions

v2.1.126

• The /model picker now lists models from your gateway's /v1/models endpoint when ANTHROPIC_BASE_URL points at an Anthropic-compatible gateway
• • Added claude project purge [path] to delete all Claude Code state for a project (transcripts, tasks, file history, config entry) — supports --dry-run, -y/--yes, -i/--interactive, and --all
• --dangerously-skip-permissions now bypasses prompts for writes to .claude/, .git/, .vscode/, shell config files, and other previously-protected paths (catastrophic removal commands still prompt as a safety net)
• claude auth login now accepts the OAuth code pasted into the terminal when the browser callback can't reach localhost (WSL2, SSH, containers)
• claude_code.skill_activated OpenTelemetry event now fires for user-typed slash commands and carries a new invocation_trigger attribute ("user-slash", "claude-proactive", or "nested-skill")
• Auto mode: the spinner now turns red when a permission check stalls, instead of looking like the tool is running
• Host-managed deployments (CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST) no longer auto-disable analytics on Bedrock/Vertex/Foundry
• Windows: PowerShell 7 installed via the Microsoft Store, MSI without PATH, or .NET global tool is now detected
• Windows: when the PowerShell tool is enabled, Claude now treats PowerShell as the primary shell instead of defaulting to Bash
• Read tool: removed the per-file malware-assessment reminder that could cause spurious refusals and "this is not malware" commentary on legacy models
• Security: Fixed allowManagedDomainsOnly / allowManagedReadPathsOnly being ignored when a higher-priority managed-settings source lacked a sandbox block
• Fixed pasting an image larger than 2000px breaking the session — images are now downscaled on paste, and oversized images in history are automatically removed and the request retried
• Fixed showing the login screen for "OAuth not allowed for organization" errors — now shows guidance to contact your admin
• Fixed OAuth login failing with timeout on slow or proxied connections, in IPv6-only devcontainers, and when the browser callback can't reach localhost
• Fixed a rare race where a concurrent credential write could clear a valid OAuth refresh token
• Fixed API retry countdown sticking at "0s" instead of counting down between attempts
• Fixed "Stream idle timeout" error after waking Mac from sleep mid-request
• Fixed background and remote sessions falsely aborting with "Stream idle timeout" during long model thinking pauses
• Fixed a hang where the assistant could finish thinking but show no output after a run of empty turns
• Fixed overly fast trackpad scrolling in Cursor and VS Code 1.92–1.104 integrated terminals
• Fixed claude.ai MCP connectors being suppressed by manual servers stuck in needs-auth state
• Fixed Japanese/Korean/Chinese text rendering as garbled characters on Windows in no-flicker mode
• Fixed Ctrl+L clearing the prompt input — it now only forces a screen redraw, matching readline behavior
• Fixed deferred tools (WebSearch, WebFetch, etc.) not being available to skills with context: fork and other subagents on their first turn
• Fixed plan-mode tools being unavailable in interactive sessions launched with --channels
• Fixed /plugin Uninstall reporting "Enabled" instead of "Uninstalled"
• Bounded total size of file-modified reminders when a linter touches many files at once
• Fixed /remote-control retries appearing stuck on "connecting…" — each retry now shows its result
• Fixed Remote Control failure notification not showing the error reason for initial connection failures
• Windows: clipboard writes no longer expose copied content in process command-line arguments visible to EDR/SIEM telemetry; also fixes >22KB selections not reaching the clipboard
• PowerShell tool: bare -- (e.g. git diff -- file) is no longer mis-flagged as the --% stop-parsing token
• Fixed Agent SDK hang when the model emits a malformed tool name in a parallel tool call batch

v2.1.123

Compare Source

• Fixed OAuth authentication failing with a 401 retry loop when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is set

v2.1.122

Compare Source

• Added ANTHROPIC_BEDROCK_SERVICE_TIER environment variable to select a Bedrock service tier (default, flex, or priority), sent as the X-Amzn-Bedrock-Service-Tier header
• Pasting a PR URL into the /resume search box now finds the session that created that PR (GitHub, GitHub Enterprise, GitLab, and Bitbucket)
• /mcp now shows claude.ai connectors hidden by a manually-added server with the same URL, with a hint to remove the duplicate
• Clarified the /mcp message shown when an MCP server is still unauthorized after the browser sign-in flow
• OpenTelemetry: numeric attributes on api_request/api_error log events are now emitted as numbers, not strings
• OpenTelemetry: added claude_code.at_mention log event for @-mention resolution
• Fixed /branch producing forks that fail with "tool_use ids were found without tool_result blocks" when the source session contained entries from rewound timelines
• Fixed /model not showing the Effort option for Bedrock application inference profile ARNs, and those ARNs not receiving output_config.effort
• Fixed Vertex AI / Bedrock returning invalid_request_error: output_config: Extra inputs are not permitted on session-title generation and other structured-output queries
• Fixed Vertex AI count_tokens endpoint returning 400 errors for users behind proxy gateways
• Fixed spinnerTipsOverride.excludeDefault not suppressing the time-based spinner tips
• Fixed ToolSearch missing MCP tools that connected after session start in nonblocking mode
• Fixed !exit / !quit in bash mode terminating the CLI instead of running as a shell command
• Fixed images sent to newer models being resized to 2576px per side instead of the correct 2000px maximum
• Fixed remote control session idle status redrawing twice per second, which could flood tmux -CC control pipes and pause the terminal
• Fixed assistant messages appearing blank in some sessions due to a stale view preference
• Fixed a malformed hooks entry in settings.json no longer invalidating the entire file
• Voice mode: keybindings bound to Caps Lock now show an error since terminals don't deliver Caps Lock as a key event

google-gemini/gemini-cli (@​google/gemini-cli)

v0.41.2

Compare Source

What's Changed

• fix(patch): cherry-pick 02995ba to release/v0.41.1-pr-26568 to patch version v0.41.1 and create version 0.41.2 by @​gemini-cli-robot in #​26589

Full Changelog: google-gemini/gemini-cli@v0.41.1...v0.41.2

v0.41.1

Compare Source

What's Changed

• fix(patch): cherry-pick 3627f47 to release/v0.41.0-pr-26542 to patch version v0.41.0 and create version 0.41.1 by @​gemini-cli-robot in #​26545

Full Changelog: google-gemini/gemini-cli@v0.41.0...v0.41.1

v0.41.0

Compare Source

What's Changed

• chore(release): bump version to 0.41.0-nightly.20260423.gaa05b4583 by @​gemini-cli-robot in #​25847
• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873
• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477
• Update policy so transient errors are not marked terminal by @​DavidAPierce in #​26066
• Implement bot that performs time-series metric analysis and suggests repo management improvements by @​gundermanc in #​25945
• fix(core): handle non-string model flags in resolution by @​Adib234 in #​26069
• fix(ux): added error message for ENOTDIR by @​devr0306 in #​26128
• Changelog for v0.40.0-preview.3 by @​gemini-cli-robot in #​25904
• fix(cli): prevent ACP stdout pollution from SessionEnd hooks by @​cocosheng-g in #​26125
• feat(cli): support boolean and number casting for env vars in settings.json by @​cocosheng-g in #​26118
• fix(cli): preserve Request headers in DevTools activity logger by @​Adib234 in #​26078
• fix(patch): cherry-pick 2194da2 to release/v0.41.0-preview.0-pr-26153 to patch version v0.41.0-preview.0 and create version 0.41.0-preview.1 by @​gemini-cli-robot in #​26269
• fix(patch): cherry-pick 1d72a12 to release/v0.41.0-preview.1-pr-26479 to patch version v0.41.0-preview.1 and create version 0.41.0-preview.2 by @​gemini-cli-robot in #​26508
• fix(patch): cherry-pick 7cc19c2 to release/v0.41.0-preview.2-pr-26507 to patch version v0.41.0-preview.2 and create version 0.41.0-preview.3 by @​gemini-cli-robot in #​26530

New Contributors

• @​hsm207 made their first contribution in #​20108
• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.40.1...v0.41.0

v0.41.0-preview.3

Compare Source

What's Changed

• fix(patch): cherry-pick 7cc19c2 to release/v0.41.0-preview.2-pr-26507 to patch version v0.41.0-preview.2 and create version 0.41.0-preview.3 by @​gemini-cli-robot in #​26530

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.2...v0.41.0-preview.3

v0.41.0-preview.2

Compare Source

What's Changed

• fix(patch): cherry-pick 1d72a12 to release/v0.41.0-preview.1-pr-26479 to patch version v0.41.0-preview.1 and create version 0.41.0-preview.2 by @​gemini-cli-robot in #​26508

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.1...v0.41.0-preview.2

v0.41.0-preview.1

Compare Source

What's Changed

• fix(patch): cherry-pick 2194da2 to release/v0.41.0-preview.0-pr-26153 to patch version v0.41.0-preview.0 and create version 0.41.0-preview.1 by @​gemini-cli-robot in #​26269

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.0...v0.41.0-preview.1

v0.41.0-preview.0

Compare Source

What's Changed

• chore(release): bump version to 0.41.0-nightly.20260423.gaa05b4583 by @​gemini-cli-robot in #​25847
• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873
• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477
• Update policy so transient errors are not marked terminal by @​DavidAPierce in #​26066
• Implement bot that performs time-series metric analysis and suggests repo management improvements by @​gundermanc in #​25945
• fix(core): handle non-string model flags in resolution by @​Adib234 in #​26069
• fix(ux): added error message for ENOTDIR by @​devr0306 in #​26128
• Changelog for v0.40.0-preview.3 by @​gemini-cli-robot in #​25904
• fix(cli): prevent ACP stdout pollution from SessionEnd hooks by @​cocosheng-g in #​26125
• feat(cli): support boolean and number casting for env vars in settings.json by @​cocosheng-g in #​26118
• fix(cli): preserve Request headers in DevTools activity logger by @​Adib234 in #​26078

New Contributors

• @​hsm207 made their first contribution in #​20108
• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.40.0-preview.5...v0.41.0-preview.0

v0.41.0-nightly.20260428.gc17400b83

Compare Source

What's Changed

• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477

New Contributors

• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.41.0-nightly.20260427.g42587de73...v0.41.0-nightly.20260428.gc17400b83

v0.41.0-nightly.20260427.g42587de73

Compare Source

What's Changed

• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873

New Contributors

• @​hsm207 made their first contribution in #​20108

Full Changelog: google-gemini/gemini-cli@v0.41.0-nightly.20260423.gd1c91f526...v0.41.0-nightly.20260427.g42587de73

v0.41.0-nightly.20260423.gd1c91f526

Compare Source

What's Changed

• fix(core): prevent YOLO mode from being downgraded by @​galz10 in #​25341
• feat: bundle ripgrep binaries into SEA for offline support by @​scidomino in #​25342
• Changelog for v0.39.0-preview.0 by @​gemini-cli-robot in #​25417
• feat(test): add large conversation scenario for performance test by @​cynthialong0-0 in #​25331
• improve(core): require recurrence evidence before extracting skills by @​SandyTao520 in #​25147
• test(evals): add subagent delegation evaluation tests by @​anj-s in #​24619
• feat: add github colorblind themes by @​Z1xus in #​15504
• fix(core): honor GOOGLE_GEMINI_BASE_URL and GOOGLE_VERTEX_BASE_URL by @​chrisjcthomas in #​25357
• fix(cli): clean up slash command IDE listeners by @​jasonmatthewsuhari in #​24397
• Changelog for v0.38.0 by @​gemini-cli-robot in #​25470
• fix(evals): update eval tests for invoke_agent telemetry and project-scoped memory by @​SandyTao520 in #​25502
• Changelog for v0.38.1 by @​gemini-cli-robot in #​25476
• feat(core): integrate skill-creator into skill extraction agent by @​SandyTao520 in #​25421
• feat(cli): provide default post-submit prompt for skill command by @​ruomengz in #​25327
• feat(core): add tools to list and read MCP resources by @​ruomengz in #​25395
• fix(evals): add typecheck coverage for evals, integration-tests, and memory-tests by @​SandyTao520 in #​25480
• Use OSC 777 for terminal notifications by @​jackyliuxx in #​25300
• fix(extensions): fix bundling for examples by @​abhipatel12 in #​25542
• fix(cli): reset plan session state on /clear by @​jasonmatthewsuhari in #​25515
• feat(core): add .mdx support to get-internal-docs tool by @​g-samroberts in #​25090
• docs(policy): mention that workspace policies are broken by @​6112 in #​24367
• fix(core): allow explicit write permissions to override governance file protections in sandboxes by @​galz10 in #​25338
• feat(sandbox): resolve custom seatbelt profiles from $HOME/.gemini first by @​mvanhorn in #​25427
• Reduce blank lines. by @​gundermanc in #​25563
• fix(ui): revert preview theme on dialog unmount by @​JayadityaGit in #​22542
• fix(core): fix ShellExecutionConfig spread and add ProjectRegistry save backoff by @​mahimashanware in #​25382
• feat(core): Disable topic updates for subagents by @​gundermanc in #​25567
• feat(core): enable topic update narration by default and promote to general by [@&

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Dockerfile

Post-upgrade command './scripts/update-go-shas.sh' has not been added to the allowed list in allowedCommands