Gemini CLI v0.49.0-nightly.20260625.gd845bc5d4

## 变更内容 * 修复(CLI)：在技能安装过程中防止路径遍历漏洞…… 由 @ompatel-aiml 在 https://github.com/google-gemini/gemini-cli/pull/27767 中提交 * 修复：待处理工具与信任覆盖由 @jvargassanchez-dot 在 https://github.com/google-gemini/gemini-cli/pull/27854 中提交 * CI：对计划的夜间发布使用内部环境 (#27865) 由 @rmedranollamas 在 https://github.com/google-gemini/gemini-cli/pull/27939 中提交 * 特性(核心)：在认证库更新后支持 GDC 离线服务身份由 @sidhantgoyal-droid 在 https://github.com/google-gemini/gemini-cli/pull/27956 中提交 * 修复(CLI)：处理 tmux 误报后台检测由 @amelidev 在 https://github.com/google-gemini/gemini-cli/pull/27572 中提交 * 添加静态评估源分析器由 @ved015 在 https://github.com/google-gemini/gemini-cli/pull/27631 中提交 * 修复(配置)：将 coreTools 设置迁移至 tools.core 由 @galz10 在 https://github.com/google-gemini/gemini-cli/pull/27947 中提交 * 修复(核心工具)：解决 at-reference 文件的防御性路径解析由 @luisfelipe-alt 在 https://github.com/google-gemini/gemini-cli/pull/27943 中提交 * 回滚 "修复(核心工具)：解决 at-reference 文件的防御性路径解析" 由 @galz10 在 https://github.com/google-gemini/gemini-cli/pull/27992 中提交 * 杂项(发布)：将版本提升至 0.49.0-nightly.20260617.g4d3dcdce1 由 @gemini-cli-robot 在 https://github.com/google-gemini/gemini-cli/pull/28003 中提交 * v0.48.0-preview.0 的变更日志由 @gemini-cli-robot 在 https://github.com/google-gemini/gemini-cli/pull/27999 中提交 * 修复(CI)：为夜间发布中的包变量提供回退值由 @galz10 在 https://github.com/google-gemini/gemini-cli/pull/28016 中提交 * 杂项(依赖)：锁定依赖并强制 14 天更新冷却期由 @galz10 在 https://github.com/google-gemini/gemini-cli/pull/27948 中提交 * 修复(CI)：在 npmrc 的注册表 URL 后添加尾部斜杠由 @rmedranollamas 在 https://github.com/google-gemini/gemini-cli/pull/28038 中提交 * 特性：添加 eval:inventory CLI 命令及报告逻辑由 @ved015 在 https://github.com/google-gemini/gemini-cli/pull/28009 中提交 * 修复：解决工作区发布失败及调度器事件循环饥饿问题由 @rmedranollamas 在 https://github.com/google-gemini/gemini-cli/pull/28063 中提交 * 修复(CI)：在夜间发布中使用 wombat dressing room 回退以防止 ENEEDAUTH 错误由 @rmedranollamas 在 https://github.com/google-gemini/gemini-cli/pull/28104 中提交 * 为评估清单添加 JSON 输出由 @ved015 在 https://github.com/google-gemini/gemini-cli/pull/28058 中提交 * 修复/验证发布时 npm ci 忽略脚本由 @rmedranollamas 在 https://github.com/google-gemini/gemini-cli/pull/28116 中提交 * 修复(CI)：在发布验证中防止工作区二进制文件冲突由 @galz10 在 https://github.com/google-gemini/gemini-cli/pull/28132 中提交 * 特性/工具注册表发现由 @ved015 在 https://github.com/google-gemini/gemini-cli/pull/28113 中提交 ## 新贡献者 * @sidhantgoyal-droid 在 https://github.com/google-gemini/gemini-cli/pull/27956 中首次贡献 * @amelidev 在 https://github.com/google-gemini/gemini-cli/pull/27572 中首次贡献 **完整变更日志**: https://github.com/google-gemini/gemini-cli/compare/v0.48.0-nightly.20260613.g9e5599c32...v0.49.0-nightly.20260625.gd845bc5d4

## What's Changed * fix(cli): prevent path traversal vulnerabilities during skill install… by @ompatel-aiml in https://github.com/google-gemini/gemini-cli/pull/27767 * Fix/pending tools and trust overrides by @jvargassanchez-dot in https://github.com/google-gemini/gemini-cli/pull/27854 * ci: use internal environment for scheduled nightly releases (#27865) by @rmedranollamas in https://github.com/google-gemini/gemini-cli/pull/27939 * feat(core): Support GDC air-gapped Service Identity after auth library update by @sidhantgoyal-droid in https://github.com/google-gemini/gemini-cli/pull/27956 * fix(cli): handle tmux false positive background detection by @amelidev in https://github.com/google-gemini/gemini-cli/pull/27572 * Add static eval source analyzer by @ved015 in https://github.com/google-gemini/gemini-cli/pull/27631 * fix(config): migrate coreTools setting to tools.core by @galz10 in https://github.com/google-gemini/gemini-cli/pull/27947 * fix(core-tools): resolve defensive path resolution for at-reference files by @luisfelipe-alt in https://github.com/google-gemini/gemini-cli/pull/27943 * Revert "fix(core-tools): resolve defensive path resolution for at-reference files" by @galz10 in https://github.com/google-gemini/gemini-cli/pull/27992 * chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 by @gemini-cli-robot in https://github.com/google-gemini/gemini-cli/pull/28003 * Changelog for v0.48.0-preview.0 by @gemini-cli-robot in https://github.com/google-gemini/gemini-cli/pull/27999 * fix(ci): provide fallbacks for package variables in nightly release by @galz10 in https://github.com/google-gemini/gemini-cli/pull/28016 * chore(deps): pin dependencies and enforce 14-day update cooldown by @galz10 in https://github.com/google-gemini/gemini-cli/pull/27948 * fix(ci): append trailing slash to registry url in npmrc by @rmedranollamas in https://github.com/google-gemini/gemini-cli/pull/28038 * feat: add eval:inventory CLI command and reporting logic by @ved015 in https://github.com/google-gemini/gemini-cli/pull/28009 * fix: resolve workspace publish failures and scheduler event loop starvation by @rmedranollamas in https://github.com/google-gemini/gemini-cli/pull/28063 * fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH by @rmedranollamas in https://github.com/google-gemini/gemini-cli/pull/28104 * Add JSON output for eval inventory by @ved015 in https://github.com/google-gemini/gemini-cli/pull/28058 * fix/verify release npm ci ignore scripts by @rmedranollamas in https://github.com/google-gemini/gemini-cli/pull/28116 * fix(ci): prevent workspace binary shadowing in release verification by @galz10 in https://github.com/google-gemini/gemini-cli/pull/28132 * Feat/tool registry discovery by @ved015 in https://github.com/google-gemini/gemini-cli/pull/28113 ## New Contributors * @sidhantgoyal-droid made their first contribution in https://github.com/google-gemini/gemini-cli/pull/27956 * @amelidev made their first contribution in https://github.com/google-gemini/gemini-cli/pull/27572 **Full Changelog**: https://github.com/google-gemini/gemini-cli/compare/v0.48.0-nightly.20260613.g9e5599c32...v0.49.0-nightly.20260625.gd845bc5d4

Gemini CLI v0.49.0-nightly.20260625.gd845bc5d4 预发布