Gemini CLI's 2026-09-04 nightly carries four independent security fixes, including a hardcoded Google API key removed from chrome-devtools-mcp

GitHub·high signalXBlueskyLinkedInCopy link

The v0.60.0-nightly.20260904 build merges RFC 9207 issuer identification enforcement in the MCP OAuth flow (#29117), isolation of the temporary directory for the macOS Seatbelt sandbox (#29171), path resolution and boundary validation hardening in the extension loader (#29169), and the sanitization of a hardcoded Google CrUX API key out of chrome-devtools-mcp (#29158). Four security-shaped changes shipping in one nightly is unusual density for this repo. The extension-loader boundary fix matters most for anyone installing third-party Gemini CLI extensions.