Skip to content

Goose

v1.35.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’
This release patches 1 known CVE

Topics

acp ai ai-agents mcp

Summary

AI summary

Broad release touches πŸ› Bug Fixes, πŸ”§ Improvements, ✨ Features, and πŸ“š Documentation.

Changes in this release

Feature Medium

Adds hooks system for extensible pre/post tool execution.

Adds hooks system for extensible pre/post tool execution.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds `/goal` command for agent self‑evaluation before finishing.

Adds `/goal` command for agent self‑evaluation before finishing.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds `goose review` local code‑review command.

Adds `goose review` local code‑review command.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds diff viewer in TUI.

Adds diff viewer in TUI.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds slash commands (built‑in, skill, recipe) in ACP server.

Adds slash commands (built‑in, skill, recipe) in ACP server.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds proactive OAuth token refresh to avoid re‑auth on every session.

Adds proactive OAuth token refresh to avoid re‑auth on every session.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds `goose://new-session` deep link to open fresh chat.

Adds `goose://new-session` deep link to open fresh chat.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri.

Adds GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds paginated session list in ACP.

Adds paginated session list in ACP.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Medium

Adds optional `--parameters` for scheduled recipes.

Adds optional `--parameters` for scheduled recipes.

Source: llm_adapter@2026-05-25

Confidence: high

β€”
Feature Low

Introduces pre‑tool use denial hook support.

Introduces pre‑tool use denial hook support.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Implements unified thinking effort control across all providers.

Implements unified thinking effort control across all providers.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Generalizes open plugins and adds skill support.

Generalizes open plugins and adds skill support.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Provides summon subagent instructions feature.

Provides summon subagent instructions feature.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Introduces quarterly scheduling option for recipes.

Introduces quarterly scheduling option for recipes.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Enables recipe discovery and execution in ACP server.

Enables recipe discovery and execution in ACP server.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Allows projects to act as backend sources with system prompt injection.

Allows projects to act as backend sources with system prompt injection.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Adds worktree‑aware directory switcher.

Adds worktree‑aware directory switcher.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Implements chat history search in navigation panel.

Implements chat history search in navigation panel.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Supports encrypted Nostr session sharing.

Supports encrypted Nostr session sharing.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Adds NuShell terminal and completion support.

Adds NuShell terminal and completion support.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Provides Simplified Chinese (zh‑CN) translation.

Provides Simplified Chinese (zh‑CN) translation.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Strips chain‑of‑thought markers from custom provider output.

Strips chain‑of‑thought markers from custom provider output.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Adds GOOSE_DISABLE_TOOL_CALL_SUMMARY env var to opt out of per‑tool‑call summaries.

Adds GOOSE_DISABLE_TOOL_CALL_SUMMARY env var to opt out of per‑tool‑call summaries.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Groups consecutive tool calls into one summarized chain card.

Groups consecutive tool calls into one summarized chain card.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Integrates Vercel AI Gateway provider.

Integrates Vercel AI Gateway provider.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Adds GitHub Copilot /responses API support.

Adds GitHub Copilot /responses API support.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Implements agents CRUD operations.

Implements agents CRUD operations.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Feature Low

Makes ACP streamable HTTP spec compliant.

Makes ACP streamable HTTP spec compliant.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

β€”
Full changelog

✨ Features

  • Hooks system for extensible pre/post tool execution #9093
  • PreToolUse denial hook support #9304
  • /goal command for agent self-evaluation before finishing #9069
  • goose review local code review command #9114
  • Diff viewer in TUI #9260
  • Slash commands (built-in, skill, recipe) in ACP server #9238
  • Unified thinking effort control across all providers #9242
  • Open-plugins generalization + skills #9112
  • Summon subagent instructions #9325
  • Proactive OAuth token refresh to avoid re-auth on every session #8386
  • goose://new-session deep link to open fresh chat #9196
  • GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri #9209
  • Paginated session list in ACP #9199
  • Pass session cwd param to ACP providers #9229
  • Opt-in to Vercel AI Gateway leaderboard #9259
  • Optional --parameters for scheduled recipes #8741
  • Quarterly scheduling option #9076
  • Recipe discovery/execution in ACP server #8925
  • Projects as backend sources with system prompt injection #8739
  • Worktree-aware directory switcher #8450
  • Chat history search in navigation panel #8448
  • Encrypted Nostr session sharing #8922
  • Nushell terminal and completion support #8628
  • Simplified Chinese (zh-CN) translation #8765
  • Strip chain-of-thought markers from custom provider output #8635
  • GOOSE_DISABLE_TOOL_CALL_SUMMARY to opt out of per-tool-call summaries #8947
  • Group consecutive tool calls into one summarized chain card #8995
  • Vercel AI Gateway provider #9144
  • GitHub Copilot /responses API #9043
  • Agents CRUD operations #9084
  • ACP streamable HTTP spec compliance #9034
  • GPT-5.5 added to known models #9292
  • Linux musl CLI builds #9240
  • Linux Vulkan support for local inference #9038
  • Windows CUDA release artifacts #8750

New Providers

πŸ› Bug Fixes

  • Databricks parallel tool image responses don't interleave tool results #9241
  • Stop killing goosed when a window closes #9302
  • Eliminate cross-window deep link contamination #9273
  • Check file fallback when keyring has no entry #9279
  • Activate custom provider after adding via configure #9213
  • Use current_exe() instead of PATH lookup when spawning goose #9236
  • Set TCP_USER_TIMEOUT on streamable HTTP clients #9207
  • Reduce excessive MISSING_TRANSLATION warnings for fallback locales #9294
  • Zero out cost for local providers (ollama, local) #9219
  • Persist accumulated cost in session DB to survive reload #9191
  • Prevent tool-use marker leakage in toolshim output #8310
  • Re-apply canonical limits when delegate overrides model #9183
  • Use plain '> ' prompt instead of goose emoji in CLI #9305
  • Flag for login shell PATH #9313
  • Enable VT processing on Windows Console Host #9248
  • Resolve Azure CLI on Windows by using az.cmd #9215
  • Handle non-interactive terminal in goose configure on Windows #9214
  • Emit trace_output as span attribute instead of event #9255
  • Flush OTLP traces reliably on exit with configurable timeout #9228
  • Telegram gateway error reporting and connection reliability #9223
  • ScheduleModal error message styling #9278
  • Align sidebar hamburger in macOS fullscreen #9257
  • Coalesce streaming Thinking deltas + list available tools on not-found #9162
  • Honor Retry-After on 429 responses #9161
  • Replace Venice custom provider with declarative config #9234
  • Use mkdir -p for self-test workspace initialization #9247
  • Preserve user-set session name for recipe-based chats #9079
  • Enforce exp independently of MAX_TOKEN_AGE_SECONDS in OIDC proxy #8839
  • Improve inline code contrast in light theme #9058
  • Omit max_tokens for OpenAI-compatible requests when unset #9123
  • Set correct mcp-app host capabilities #9116
  • Normalize nullable schemas for Vertex Gemini compatibility #8930
  • Isolate GitHub recipe temp paths #8878
  • Set X-Initiator header on GitHub Copilot requests #8809
  • Honor dynamic_models: false in declarative provider configs #8795
  • Cache trailing message for stable prefix across Bedrock agent turns #8916
  • Case-insensitive model name lookup for context_limit #8906
  • Return 400 instead of panicking on invalid CSP header value #8810
  • Coalesce streaming chunks under one message id in ACP #8788
  • Handle Bedrock ReasoningContent blocks gracefully #8843
  • Correct WSL2 OS detection by removing PWD-based Windows override #8869
  • Insert tool pair summaries at chronological position in conversation #9087
  • Enable SQLite foreign key enforcement in session pool #9121
  • Deleted chat session still appears in sidebar list #8674
  • Require extension_name on read_resource #8989
  • Queued message lost when clicking send now #9074
  • Keep model picker and session config in sync #9048
  • Read prompted file parameters in recipes #8504
  • Accept null tool_call arguments in OpenAI streaming chunks #9035
  • Synchronously reap ACP child to avoid SIGCHLD race #9023
  • Elicitation fixes #8999
  • SACP notifies clients of generated session names #8983
  • Unscheduling a recipe should not delete them #8978
  • Seed provider handoff history in ACP #8941
  • Respect goose2 interface density settings #8953
  • Make goose2 respect accent color #8952
  • Preserve replay message timestamps #8942
  • Avoid transform-rasterized dialog text in goose2 #8937
  • Keep renamed skills open in detail view #8935
  • Gemini OAuth onboarding failure #8905
  • Convert quoted numeric config values to numbers if needed #8844
  • Keep SSE reconnect loop alive on long disconnects #8846
  • Apply request_params to outgoing OpenAI API payload #9151
  • Gemini 3.x known_location Global routing and KNOWN_MODELS entries #9142
  • Refresh GCP metadata server token on expiration #8929
  • Report cumulative total_tokens in stream-json/json output #8910
  • Emit cumulative token usage in stream-json/json complete event #8870
  • Model picker stays usable during provider loading #8900
  • Handle ACP requests concurrently #8781
  • Reuse goose2 vite server on port conflict #8722
  • Exclude preprompt from session title generation #8793
  • Prevent login-shell PATH probe from suspending goose on startup #8804

πŸ”§ Improvements

  • Surface resolved Databricks model metadata #9206
  • Include request URL in provider error messages #9232
  • Structured per-provider config block, non-destructive provider switching #8977
  • Optional api_key configuration for declarative openai-engine providers #9202
  • Remove popular chat topics from new chat screen #9307
  • Remove vendored Windows binaries #9318
  • Linux desktop Vulkan packages #9323
  • Better parsing of pasted HTML as markdown #9190
  • Prompt injection mitigation: updated pattern-based detection #9198
  • Consolidate logging setup into shared helper #8817
  • Localize hardcoded strings in provider settings UI #8931
  • Move settings into app shell #9047
  • Location column in CLI skills table #8785
  • Preserve thinking content for providers that require it #8857
  • Dynamically refresh skill instructions each turn #9217
  • Build non-vulkan Linux variants using ubuntu 22.04 #9211
  • Show tool name in approval prompt #9216
  • Remove Filesystem MCP extension from catalog #9225
  • Mount ACP in goosed server for iterative migration #9097
  • Frontend extension session state and tool routes #8464
  • TUI spacing/layout improvements #9243
  • Polish sidebar and context panel #9059
  • Polish inline code snippet styling #9011
  • Refresh onboarding when provider catalog loads #9051
  • Replace lazy_static with std::sync::LazyLock #8815
  • Introduce DEFAULT_PROVIDER_TIMEOUT_SECS constant #8816
  • Provider-first onboarding #9039
  • Redesign Skills library #8868
  • Redesign Extensions page #8940
  • Improvements to LM Studio declarative provider #8973
  • Mergeable configs + cleanup #8378
  • MCP Apps: hydrate and replay app payloads in Goose2 #8632
  • MCP Apps: translate ACP host capabilities into MCP initialization #8623
  • Render MCP apps inline in goose2 #8877
  • Plugin installation and auto-updating #8949 #9061
  • Skills in chat composer #8881
  • Custom providers support in goose2 UI & ACP #8924
  • Make ollama host configurable in goose2 #8912
  • Support Google model inventory refresh #8913
  • Update provider row after saving credentials #8914
  • Parallelize provider resolution and eagerly init SQLite pool #8899
  • Deduplicate _goose/providers/list RPC call at startup #8873
  • Refactor local inference around backends #9137
  • Native arm64 runners for Linux artifact builds #9075
  • Update canonical model registry #9331
  • Update patterns for pattern-based command injection #8546

πŸ“š Documentation

  • Documentation reorganization #9310
  • Hooks guide #9288
  • Hooks feature blog post #9227
  • Guide for connecting goose Desktop to a remote goosed server #9275
  • Document summon extension requirement for delegate and load tools #9231
  • Updated tunnel remote access documentation #9077
  • Orchestrating with goose blog post #9104
  • Goose with Peekaboo blog post #8884
  • Built-in Local Inference blog post #8808
  • MiniMax and Office QA benchmark findings blog post #8984
  • Fix internal documentation anchors #9094

Security Fixes

  • OTP cooldowns now session‑scoped – closes abuse vector where users changed phone/email mid‑flow to reset OTP cooldowns

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Goose

Get notified when new releases ship.

Sign up free

About Goose

an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM

All releases β†’

Beta — feedback welcome: [email protected]