Vibe Coding
goose 1.49.0 quietly fixes three fail-open behaviours in its tool path
Buried in the bug list of the 2026-09-03 release: goose now fails closed on invalid default GCP credentials (#11363) instead of proceeding, rejects cmd.exe commands containing newlines (#11537), and sanitizes hidden Unicode in Bedrock tools (#11121). It also bounds non-streaming JSON responses (#11109) and gives an honest compaction failure message rather than reporting success when no tool responses exist (#10500). Each of these is a case where the agent previously kept going with a broken precondition, which is the failure mode that costs you a whole unattended run.
Source
↳ Follow the thread