Gemini CLI — July 2026 Releases

5 releases in July 2026.

What's new in Gemini CLI, July 2026

Gemini CLI tightens security and sandboxing, fixes agent loops and tool-response errors

Gemini CLI's July 2026 releases focused mainly on security hardening and reliability. Five releases shipped, from v0.50.0 to v0.53.1.

On the security side, v0.51.0 added a case-insensitive sensitive path blocklist, fixed a symbolic link directory escape in the memory import processor, and made ~/.gitconfig read-only in the macOS sandbox. v0.53.0 enforced workspace trust and task isolation in the a2a-server to prevent RCE, and aligned macOS permissive Seatbelt profiles with a deny-default model. v0.53.0 also mitigated infinite ReAct loops and prompt injection loops, and grouped cancelled tool responses to avoid 400 Bad Request errors.

Other changes: v0.50.0 added tool registry discovery, v0.52.0 stopped LLM correction on JSON and IPYNB files in writefile and replace, and v0.53.0 added an eval coverage report command. Much of the remaining work was internal caretaker triage and egress services. v0.53.1 was a single cherry-picked patch fix.

  • a2a-server now enforces workspace trust and task isolation to prevent RCE (v0.53.0)
  • Mitigation for infinite ReAct loops and prompt injection loops (v0.53.0)
  • Cancelled tool responses are grouped to prevent 400 Bad Request errors (v0.53.0)
  • Sensitive path blocklist is case-insensitive, and ~/.gitconfig is read-only in the macOS sandbox (v0.51.0)
  • Symbolic link directory escape fixed in the memory import processor (v0.51.0)
  • writefile and replace skip LLM correction for JSON and IPYNB files (v0.52.0)

Upgrading from v0.49.0? See every change through v0.53.1.

Gemini CLI full changelog