chore(deps): update bump-dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.121 → 2.1.132				patch	2.1.138 (+3)
@google/gemini-cli	0.39.1 → 0.41.2				minor
go (source)	1.26.1 → 1.26.3				patch
node	135dc9a → 83bd970			final	digest
node	135dc9a → 83bd970			stage	digest
opencode-ai	1.14.28 → 1.14.40				patch	1.14.46 (+5)

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.132

Compare Source

• Added CLAUDE_CODE_SESSION_ID environment variable to the Bash tool subprocess environment, matching the session_id passed to hooks
• Added CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 env var to opt out of the fullscreen alternate-screen renderer and keep the conversation in the terminal's native scrollback
• Added a "Pasting…" footer hint while a Ctrl+V image paste is being read from the clipboard
• Fixed external SIGINT (e.g. IDE stop button, kill -INT) not running graceful shutdown — terminal modes are now restored and the --resume hint is printed instead of an abrupt exit
• Fixed an uncaught exception when the terminal is closed or SSH disconnects mid-session under the native build
• Fixed --resume failing with no low surrogate in string when a tool error truncation split an emoji; pre-corrupted sessions are sanitized on load
• Fixed --permission-mode flag being ignored when resuming a plan-mode session with -p --continue/--resume, and plan mode not being re-applied after ExitPlanMode within the same session
• Fixed fullscreen mode showing a blank screen after laptop sleep/wake or Ctrl+Z/fg until the next keystroke or stream output
• Fixed cursor landing mid-grapheme on Ctrl+E/A/K/U/arrow keys when an Indic conjunct or ZWJ emoji wraps across lines
• Fixed vim operators corrupting text containing decomposed (NFD) accented characters
• Fixed pasting text starting with / silently swallowing the input or triggering an unknown-command reply
• Fixed pasting dumping stray escape sequences into the prompt when focus events or mouse-tracking reports interleave with the bracketed paste
• Fixed mouse wheel scrolling being too fast in Cursor and VS Code 1.92–1.104 due to an upstream xterm.js bug
• Fixed scroll-wheel handling in JetBrains IDE 2025.2 terminals (spurious arrow keys, wrong-direction events, runaway acceleration)
• Fixed /usage Ctrl+S hanging when copying the stats screenshot to the clipboard on Linux/X11
• Fixed /terminal-setup showing a contradictory error in Windows Terminal — Shift+Enter is natively supported there
• Fixed /effort picker not reflecting the CLAUDE_CODE_EFFORT_LEVEL env var override
• Fixed /status showing the wrong default model for some users
• Fixed slash command autocomplete popup being capped at ~3–5 visible commands instead of scaling with terminal height
• Fixed statusline context_window token counts reflecting cumulative session totals instead of current context usage
• Fixed Alt+T (thinking toggle) not working on macOS terminals without "Option as Meta" enabled (iTerm2, Terminal.app defaults)
• Fixed dead keyboard input on Windows after re-opening a background session from claude agents
• Fixed unbounded memory growth (10GB+ RSS) when a stdio MCP server writes non-protocol data to stdout
• Fixed MCP servers that connect but fail tools/list silently showing 0 tools — they now retry once and show "connected · tools fetch failed" in /mcp
• Fixed unauthorized claude.ai MCP connectors showing as "failed" instead of "needs auth", and headless -p mode retrying non-transient 4xx connection failures
• Improved visual consistency in slash command dialogs and /login, /upgrade, /extra-usage dialog spacing
• Updated the /tui fullscreen startup banner to describe additional renderer benefits (lower memory usage, mouse support, auto-copy on select)
• Fixed Bedrock and Vertex 400 errors when ENABLE_PROMPT_CACHING_1H is set

v2.1.131

Compare Source

• Fixed VS Code extension failing to activate on Windows due to a hardcoded build path in the bundled SDK (createRequire polyfill bug)
• Fixed Mantle endpoint authentication failing with missing x-api-key header

v2.1.129

Compare Source

• Added --plugin-url <url> flag to fetch a plugin .zip archive from a URL for the current session
• Added CLAUDE_CODE_FORCE_SYNC_OUTPUT=1 env var to force-enable synchronized output on terminals that auto-detection misses (e.g. Emacs eat)
• Added CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE: when set on Homebrew or WinGet installations, Claude Code runs the upgrade command in the background and prompts to restart
• Plugin manifests: themes and monitors should now be declared under "experimental": { ... }. Top-level declarations still work but claude plugin validate will warn
• Gateway /v1/models discovery for the /model picker is now opt-in via CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 (was automatic in 2.1.126–2.1.128)
• Ctrl+R history picker now defaults to searching all prompts across all projects, matching pre-2.1.124 behavior. Press Ctrl+S to narrow to the current project or session
• Third-party deployments (Bedrock, Vertex, Foundry, or ANTHROPIC_BASE_URL gateway) no longer see spinner tips pointing at first-party Anthropic surfaces
• skillOverrides setting now works: off hides from model and /, user-invocable-only hides from model only, name-only collapses description
• The claude_code.pull_request.count OTel metric now counts PRs/MRs created via MCP tools, not just shell commands
• Policy refusal error messages now include the API Request ID for easier support debugging
• Fixed API errors with unrecognized 400 status codes showing raw JSON instead of the underlying error message
• Fixed /clear not resetting the terminal tab title after a conversation
• Fixed session title chip from /rename disappearing while a permission or other dialog is active
• Fixed agent panel below the prompt being hidden when subagents are running (regression in 2.1.122)
• Fixed external-editor handoff (Ctrl+G) blanking the conversation history above the prompt
• Fixed /context dumping its rendered ASCII visualization grid into the conversation, wasting ~1.6k tokens per call
• Fixed /agents Library list arrow-key navigation: the highlighted agent now stays visible when the list exceeds the viewport
• Fixed /branch success message not including the new branch's session id for /resume
• Fixed bold headers with keycap/ZWJ/skin-tone emoji losing trailing characters in fullscreen mode
• Fixed server-managed settings policy not applying for enterprise/team users whose stored OAuth credentials lacked the user:inference scope
• Fixed OAuth refresh race after wake-from-sleep that could log out all running sessions
• Fixed 1-hour prompt cache TTL being silently downgraded to 5 minutes
• Fixed cache-miss warning appearing spuriously after /clear or compaction when changing /effort or /model
• Fixed Bash(mkdir *), Bash(touch *) and similar allow rules not being honored for in-project paths
• Fixed deniedMcpServers patterns with a *:// scheme wildcard not matching mixed-case hostnames
• Fixed harmless WebSocket warning being logged as an error in --debug during voice mode
• [VSCode] Fixed /clear not clearing the conversation context and displayed transcript

v2.1.128

Compare Source

• Bare /color (no args) now picks a random session color
• /mcp now shows the tool count for connected servers and flags servers that connected with 0 tools
• --plugin-dir now accepts .zip plugin archives in addition to directories
• --channels now works with console (API key) authentication — console orgs with managed settings must set channelsEnabled: true to enable
• Updated /model picker: collapsed duplicate Opus 4.7 entries, and current Opus now shows as "Opus" instead of "Opus 4.7"
• Subprocesses (Bash, hooks, MCP, LSP) no longer inherit OTEL_* environment variables, so OTEL-instrumented apps run via the Bash tool no longer pick up the CLI's own OTLP endpoint
• MCP: workspace is now a reserved server name — existing servers with that name will be skipped with a warning
• Reconnecting MCP servers no longer flood the conversation with full tool-name lists on every reconnect — re-announced tools are summarized by server prefix
• SDK hosts now receive a persistent localSettings suggestion for Bash permission prompts, so "Always allow" writes to .claude/settings.local.json
• EnterWorktree now creates the new branch from local HEAD as documented, instead of origin/<default-branch> — unpushed commits are no longer dropped
• Auto mode: when the classifier can't evaluate an action, the error now includes a hint (retry, /compact, or run with --debug)
• Fixed focus mode briefly dimming the previous response when submitting a new prompt
• Fixed stray "4;0;" desktop notification on every /exit in Kitty and other terminals that interpret OSC 9 as a notification
• Fixed Remote Control showing an empty "Opening your options…" message on rate limit instead of actionable upsell options
• Fixed drag-and-drop image upload hanging on "Pasting text…" when the image read fails
• Fixed crash loop when piping very large input (>10 MB) to claude -p via stdin
• Fixed long URLs not being individually clickable on every wrapped row in fullscreen mode
• Fixed /plugin Components panel showing "Marketplace 'inline' not found" for plugins loaded via --plugin-dir
• Fixed MCP tool results dropping images when the server returns both structured content and content blocks
• Fixed fenced code blocks inside list items carrying leading whitespace into the clipboard on copy-paste
• Fixed tab navigation in /config stranding focus — the tab header now stays focused so arrows and Esc keep working
• Fixed markdown link labels being lost on terminals without OSC 8 hyperlink support — links now render as label (url) instead of just the URL
• Fixed sessions on 1M-context models with a smaller autocompact window being falsely blocked with "Prompt is too long" before reaching the actual API limit
• Fixed parallel shell tool calls: a failing read-only command (grep, git diff, ls) no longer cancels sibling calls
• Fixed banner showing "with X effort" on models that don't support effort
• Fixed /fast on 3P providers fuzzy-matching to an unrelated skill instead of showing "not available"
• Fixed Bedrock default model resolving to global.* instead of the region-appropriate prefix
• Fixed vim mode: Space in NORMAL mode now moves the cursor right, matching standard vi/vim behavior
• Fixed terminal progress indicator (OSC 9;4) flickering off between tool calls — stays visible across the full turn
• Fixed /rename without args failing on resumed sessions whose last entry is a compact boundary
• Fixed stale "remote-control is active" status lines from prior sessions appearing after --resume/--continue
• Fixed stale installed_plugins.json entries pointing at deleted cache directories polluting PATH
• Fixed MCP stdio servers receiving corrupted arguments when CLAUDE_CODE_SHELL_PREFIX is set and an argument contains spaces or shell metacharacters
• Fixed sub-agent progress summaries missing the prompt cache (~3× cache_creation reduction)
• Fixed /plugin update never detecting new versions of npm-sourced plugins
• Fixed sub-agent summaries firing repeatedly while a sub-agent's transcript is static, capping worst-case token cost on idle sub-agents
• Headless --output-format stream-json: init.plugin_errors now includes --plugin-dir load failures in addition to dependency demotions

v2.1.126

• The /model picker now lists models from your gateway's /v1/models endpoint when ANTHROPIC_BASE_URL points at an Anthropic-compatible gateway
• • Added claude project purge [path] to delete all Claude Code state for a project (transcripts, tasks, file history, config entry) — supports --dry-run, -y/--yes, -i/--interactive, and --all
• --dangerously-skip-permissions now bypasses prompts for writes to .claude/, .git/, .vscode/, shell config files, and other previously-protected paths (catastrophic removal commands still prompt as a safety net)
• claude auth login now accepts the OAuth code pasted into the terminal when the browser callback can't reach localhost (WSL2, SSH, containers)
• claude_code.skill_activated OpenTelemetry event now fires for user-typed slash commands and carries a new invocation_trigger attribute ("user-slash", "claude-proactive", or "nested-skill")
• Auto mode: the spinner now turns red when a permission check stalls, instead of looking like the tool is running
• Host-managed deployments (CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST) no longer auto-disable analytics on Bedrock/Vertex/Foundry
• Windows: PowerShell 7 installed via the Microsoft Store, MSI without PATH, or .NET global tool is now detected
• Windows: when the PowerShell tool is enabled, Claude now treats PowerShell as the primary shell instead of defaulting to Bash
• Read tool: removed the per-file malware-assessment reminder that could cause spurious refusals and "this is not malware" commentary on legacy models
• Security: Fixed allowManagedDomainsOnly / allowManagedReadPathsOnly being ignored when a higher-priority managed-settings source lacked a sandbox block
• Fixed pasting an image larger than 2000px breaking the session — images are now downscaled on paste, and oversized images in history are automatically removed and the request retried
• Fixed showing the login screen for "OAuth not allowed for organization" errors — now shows guidance to contact your admin
• Fixed OAuth login failing with timeout on slow or proxied connections, in IPv6-only devcontainers, and when the browser callback can't reach localhost
• Fixed a rare race where a concurrent credential write could clear a valid OAuth refresh token
• Fixed API retry countdown sticking at "0s" instead of counting down between attempts
• Fixed "Stream idle timeout" error after waking Mac from sleep mid-request
• Fixed background and remote sessions falsely aborting with "Stream idle timeout" during long model thinking pauses
• Fixed a hang where the assistant could finish thinking but show no output after a run of empty turns
• Fixed overly fast trackpad scrolling in Cursor and VS Code 1.92–1.104 integrated terminals
• Fixed claude.ai MCP connectors being suppressed by manual servers stuck in needs-auth state
• Fixed Japanese/Korean/Chinese text rendering as garbled characters on Windows in no-flicker mode
• Fixed Ctrl+L clearing the prompt input — it now only forces a screen redraw, matching readline behavior
• Fixed deferred tools (WebSearch, WebFetch, etc.) not being available to skills with context: fork and other subagents on their first turn
• Fixed plan-mode tools being unavailable in interactive sessions launched with --channels
• Fixed /plugin Uninstall reporting "Enabled" instead of "Uninstalled"
• Bounded total size of file-modified reminders when a linter touches many files at once
• Fixed /remote-control retries appearing stuck on "connecting…" — each retry now shows its result
• Fixed Remote Control failure notification not showing the error reason for initial connection failures
• Windows: clipboard writes no longer expose copied content in process command-line arguments visible to EDR/SIEM telemetry; also fixes >22KB selections not reaching the clipboard
• PowerShell tool: bare -- (e.g. git diff -- file) is no longer mis-flagged as the --% stop-parsing token
• Fixed Agent SDK hang when the model emits a malformed tool name in a parallel tool call batch

v2.1.123

Compare Source

• Fixed OAuth authentication failing with a 401 retry loop when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is set

v2.1.122

Compare Source

• Added ANTHROPIC_BEDROCK_SERVICE_TIER environment variable to select a Bedrock service tier (default, flex, or priority), sent as the X-Amzn-Bedrock-Service-Tier header
• Pasting a PR URL into the /resume search box now finds the session that created that PR (GitHub, GitHub Enterprise, GitLab, and Bitbucket)
• /mcp now shows claude.ai connectors hidden by a manually-added server with the same URL, with a hint to remove the duplicate
• Clarified the /mcp message shown when an MCP server is still unauthorized after the browser sign-in flow
• OpenTelemetry: numeric attributes on api_request/api_error log events are now emitted as numbers, not strings
• OpenTelemetry: added claude_code.at_mention log event for @-mention resolution
• Fixed /branch producing forks that fail with "tool_use ids were found without tool_result blocks" when the source session contained entries from rewound timelines
• Fixed /model not showing the Effort option for Bedrock application inference profile ARNs, and those ARNs not receiving output_config.effort
• Fixed Vertex AI / Bedrock returning invalid_request_error: output_config: Extra inputs are not permitted on session-title generation and other structured-output queries
• Fixed Vertex AI count_tokens endpoint returning 400 errors for users behind proxy gateways
• Fixed spinnerTipsOverride.excludeDefault not suppressing the time-based spinner tips
• Fixed ToolSearch missing MCP tools that connected after session start in nonblocking mode
• Fixed !exit / !quit in bash mode terminating the CLI instead of running as a shell command
• Fixed images sent to newer models being resized to 2576px per side instead of the correct 2000px maximum
• Fixed remote control session idle status redrawing twice per second, which could flood tmux -CC control pipes and pause the terminal
• Fixed assistant messages appearing blank in some sessions due to a stale view preference
• Fixed a malformed hooks entry in settings.json no longer invalidating the entire file
• Voice mode: keybindings bound to Caps Lock now show an error since terminals don't deliver Caps Lock as a key event

google-gemini/gemini-cli (@​google/gemini-cli)

v0.41.2

Compare Source

What's Changed

• fix(patch): cherry-pick 02995ba to release/v0.41.1-pr-26568 to patch version v0.41.1 and create version 0.41.2 by @​gemini-cli-robot in #​26589

Full Changelog: google-gemini/gemini-cli@v0.41.1...v0.41.2

v0.41.1

Compare Source

What's Changed

• fix(patch): cherry-pick 3627f47 to release/v0.41.0-pr-26542 to patch version v0.41.0 and create version 0.41.1 by @​gemini-cli-robot in #​26545

Full Changelog: google-gemini/gemini-cli@v0.41.0...v0.41.1

v0.41.0

Compare Source

What's Changed

• chore(release): bump version to 0.41.0-nightly.20260423.gaa05b4583 by @​gemini-cli-robot in #​25847
• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873
• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477
• Update policy so transient errors are not marked terminal by @​DavidAPierce in #​26066
• Implement bot that performs time-series metric analysis and suggests repo management improvements by @​gundermanc in #​25945
• fix(core): handle non-string model flags in resolution by @​Adib234 in #​26069
• fix(ux): added error message for ENOTDIR by @​devr0306 in #​26128
• Changelog for v0.40.0-preview.3 by @​gemini-cli-robot in #​25904
• fix(cli): prevent ACP stdout pollution from SessionEnd hooks by @​cocosheng-g in #​26125
• feat(cli): support boolean and number casting for env vars in settings.json by @​cocosheng-g in #​26118
• fix(cli): preserve Request headers in DevTools activity logger by @​Adib234 in #​26078
• fix(patch): cherry-pick 2194da2 to release/v0.41.0-preview.0-pr-26153 to patch version v0.41.0-preview.0 and create version 0.41.0-preview.1 by @​gemini-cli-robot in #​26269
• fix(patch): cherry-pick 1d72a12 to release/v0.41.0-preview.1-pr-26479 to patch version v0.41.0-preview.1 and create version 0.41.0-preview.2 by @​gemini-cli-robot in #​26508
• fix(patch): cherry-pick 7cc19c2 to release/v0.41.0-preview.2-pr-26507 to patch version v0.41.0-preview.2 and create version 0.41.0-preview.3 by @​gemini-cli-robot in #​26530

New Contributors

• @​hsm207 made their first contribution in #​20108
• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.40.1...v0.41.0

v0.41.0-preview.3

Compare Source

What's Changed

• fix(patch): cherry-pick 7cc19c2 to release/v0.41.0-preview.2-pr-26507 to patch version v0.41.0-preview.2 and create version 0.41.0-preview.3 by @​gemini-cli-robot in #​26530

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.2...v0.41.0-preview.3

v0.41.0-preview.2

Compare Source

What's Changed

• fix(patch): cherry-pick 1d72a12 to release/v0.41.0-preview.1-pr-26479 to patch version v0.41.0-preview.1 and create version 0.41.0-preview.2 by @​gemini-cli-robot in #​26508

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.1...v0.41.0-preview.2

v0.41.0-preview.1

Compare Source

What's Changed

• fix(patch): cherry-pick 2194da2 to release/v0.41.0-preview.0-pr-26153 to patch version v0.41.0-preview.0 and create version 0.41.0-preview.1 by @​gemini-cli-robot in #​26269

Full Changelog: google-gemini/gemini-cli@v0.41.0-preview.0...v0.41.0-preview.1

v0.41.0-preview.0

Compare Source

What's Changed

• chore(release): bump version to 0.41.0-nightly.20260423.gaa05b4583 by @​gemini-cli-robot in #​25847
• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873
• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477
• Update policy so transient errors are not marked terminal by @​DavidAPierce in #​26066
• Implement bot that performs time-series metric analysis and suggests repo management improvements by @​gundermanc in #​25945
• fix(core): handle non-string model flags in resolution by @​Adib234 in #​26069
• fix(ux): added error message for ENOTDIR by @​devr0306 in #​26128
• Changelog for v0.40.0-preview.3 by @​gemini-cli-robot in #​25904
• fix(cli): prevent ACP stdout pollution from SessionEnd hooks by @​cocosheng-g in #​26125
• feat(cli): support boolean and number casting for env vars in settings.json by @​cocosheng-g in #​26118
• fix(cli): preserve Request headers in DevTools activity logger by @​Adib234 in #​26078

New Contributors

• @​hsm207 made their first contribution in #​20108
• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.40.0-preview.5...v0.41.0-preview.0

v0.41.0-nightly.20260428.gc17400b83

Compare Source

What's Changed

• fix(cli): add missing response key to custom theme text schema by @​gaurav0107 in #​25822
• fix(cli): provide manual update command when automatic update fails by @​cocosheng-g in #​26052
• test(cli): add unit tests for restore ACP command (#​23402) by @​cocosheng-g in #​26053
• fix(ui): better error messages for ECONNRESET and ETIMEDOUT by @​devr0306 in #​26059
• feat(core): wire up the new ContextManager and AgentChatHistory by @​joshualitt in #​25409
• fix(cli): ensure sandbox proxy cleanup and remove handler leaks by @​ehedlund in #​26065
• fix(cli): correct alternate buffer warning logic for JetBrains by @​Adib234 in #​26067
• fix(cli): make MCP ping optional in list command and use configured timeout by @​cocosheng-g in #​26068
• fix(core): better error message for failed cloudshell-gca auth by @​devr0306 in #​26079
• feat(cli): provide manual session UUID via command line arg by @​cocosheng-g in #​26060
• Changelog for v0.40.0-preview.2 by @​gemini-cli-robot in #​25846
• (docs) update sandboxing documentation by @​g-samroberts in #​25930
• fix(core): enforce parallel task tracker updates by @​anj-s in #​24477

New Contributors

• @​gaurav0107 made their first contribution in #​25822

Full Changelog: google-gemini/gemini-cli@v0.41.0-nightly.20260427.g42587de73...v0.41.0-nightly.20260428.gc17400b83

v0.41.0-nightly.20260427.g42587de73

Compare Source

What's Changed

• fix(core): only show list suggestion if the partial input is empty by @​cynthialong0-0 in #​25821
• feat(cli): secure .env loading and enforce workspace trust in headless mode by @​ehedlund in #​25814
• fix: fatal hard-crash on loop detection via unhandled AbortError by @​hsm207 in #​20108
• update package-lock.json by @​ehedlund in #​25876
• feat(core): enhance shell command validation and add core tools allowlist by @​galz10 in #​25720
• fix(ui): corrected background color check in user message components by @​devr0306 in #​25880
• perf(core): fix slow boot by fetching experiments and quota asynchronously by @​spencer426 in #​25758
• feat(core,cli): add support for Gemma 4 models (experimental) by @​Abhijit-2592 in #​25604
• update FatalUntrustedWorkspaceError message to include doc link by @​ehedlund in #​25874
• docs: add Gemini CLI course link to README by @​JayadityaGit in #​25925
• feat(repo): add gemini-cli-bot metrics and workflows by @​gundermanc in #​25888
• fix(cli): allow output redirection for cli commands by @​spencer426 in #​25894
• fix(core): fail closed in YOLO mode when shell parsing fails for restricted rules by @​ehedlund in #​25935
• fix(cli-ui): revert backspace handling to fix Windows regression by @​scidomino in #​25941
• feat(voice): implement real-time voice mode with cloud and local backends by @​Abhijit-2592 in #​24174
• Changelog for v0.39.0 by @​gemini-cli-robot in #​25848
• feat(memory): persist auto-memory scratchpad for skill extraction by @​SandyTao520 in #​25873

New Contributors

• @​hsm207 made their first contribution in #​20108

Full Changelog: google-gemini/gemini-cli@v0.41.0-nightly.20260423.gd1c91f526...v0.41.0-nightly.20260427.g42587de73

v0.41.0-nightly.20260423.gd1c91f526

Compare Source

What's Changed

• fix(core): prevent YOLO mode from being downgraded by @​galz10 in #​25341
• feat: bundle ripgrep binaries into SEA for offline support by @​scidomino in #​25342
• Changelog for v0.39.0-preview.0 by @​gemini-cli-robot in #​25417
• feat(test): add large conversation scenario for performance test by @​cynthialong0-0 in #​25331
• improve(core): require recurrence evidence before extracting skills by @​SandyTao520 in #​25147
• test(evals): add subagent delegation evaluation tests by @​anj-s in #​24619
• feat: add github colorblind themes by @​Z1xus in #​15504
• fix(core): honor GOOGLE_GEMINI_BASE_URL and GOOGLE_VERTEX_BASE_URL by @​chrisjcthomas in #​25357
• fix(cli): clean up slash command IDE listeners by @​jasonmatthewsuhari in #​24397
• Changelog for v0.38.0 by @​gemini-cli-robot in #​25470
• fix(evals): update eval tests for invoke_agent telemetry and project-scoped memory by @​SandyTao520 in #​25502
• Changelog for v0.38.1 by @​gemini-cli-robot in #​25476
• feat(core): integrate skill-creator into skill extraction agent by @​SandyTao520 in #​25421
• feat(cli): provide default post-submit prompt for skill command by @​ruomengz in #​25327
• feat(core): add tools to list and read MCP resources by @​ruomengz in #​25395
• fix(evals): add typecheck coverage for evals, integration-tests, and memory-tests by @​SandyTao520 in #​25480
• Use OSC 777 for terminal notifications by @​jackyliuxx in #​25300
• fix(extensions): fix bundling for examples by @​abhipatel12 in #​25542
• fix(cli): reset plan session state on /clear by @​jasonmatthewsuhari in #​25515
• feat(core): add .mdx support to get-internal-docs tool by @​g-samroberts in #​25090
• docs(policy): mention that workspace policies are broken by @​6112 in #​24367
• fix(core): allow explicit write permissions to override governance file protections in sandboxes by @​galz10 in #​25338
• feat(sandbox): resolve custom seatbelt profiles from $HOME/.gemini first by @​mvanhorn in #​25427
• Reduce blank lines. by @​gundermanc in #​25563
• fix(ui): revert preview theme on dialog unmount by @​JayadityaGit in #​22542
• fix(core): fix ShellExecutionConfig spread and add ProjectRegistry save backoff by @​mahimashanware in #​25382
• feat(core): Disable topic updates for subagents by @​gundermanc in #​25567
• feat(core): enable topic update narration by default and promote to general by [@&

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Dockerfile

Post-upgrade command './scripts/update-go-shas.sh' has not been added to the allowed list in allowedCommands

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.