Gemini CLI 0.60.0 keeps credentials out of sandboxes and removes a bundled API key

What changed

Docker and Podman sandboxes used to mount the host’s whole ~/.gemini folder, exposing OAuth tokens and credential stores inside the container; 0.60.0 mounts a temporary per-session copy with only non-sensitive settings and deletes it afterwards. The macOS Seatbelt sandbox now gets its own temporary directory, a hard-coded Google CrUX API key from a bundled dependency is removed, and the MCP OAuth flow now enforces RFC 9207 issuer checks.

Who it affects

Gemini CLI users who run in sandbox mode.

What to do

Upgrade to 0.60.0 or later, and check that sandboxed tools don’t depend on credential files from ~/.gemini.

Source: https://github.com/google-gemini/gemini-cli/releases/tag/v0.60.0