Evidence record / gemini-cli
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-10-gemini-cli-gemini-cli-v0-54-0-https-enforced-for-google-credential-auth-keychain
Gemini CLI v0.54.0 -- HTTPS enforced for Google credential auth, keychain tag validation.
Stable v0.54.0 (19 commits over v0.53.1) is the first release containing #28517 (commit e2a5375d10d59f2378db6fb8b973eeaef4cf26eb), which enforces HTTPS in GoogleCredentialsAuthProvider to prevent credentials being sent in cleartext, and #28523 (commit bef6119500b0238ad84f6396d2a6cabda9991554), which enforces explicit tag length and validation in the file keychain -- an authenticated-encryption hygiene fix on the at-rest credential store. It also carries #28469, rotating the session ID on model fallback so a fallback no longer reuses server-side state from the exhausted model.
Channel: tagged-release. Ancestry: gh api repos/google-gemini/gemini-cli/releases/tags/v0.54.0 -> prerelease:false, published_at 2026-08-06T01:35:59Z. git tag --contains e2a5375d1 -> v0.54.0 v0.54.4 v0.55.1 (v0.54.0 is the earliest stable). Same for bef611950. Confirmed neither is in v0.53.1 via git log v0.53.1..v0.54.0.
Operator consequence: Upgrade past v0.54.0 if you authenticate via GOOGLE_APPLICATION_CREDENTIALS or a service account, especially through a proxy or a non-TLS internal endpoint -- before this the provider would transmit over plain HTTP if pointed there. Neither issue has a published advisory, so version-scanning tools will not flag you; check your installed version directly.
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-gemini-cli-gemini-cli-v0-54-0-https-enforced-for-google-credential-auth-keychain
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact