chore(deps): update docker

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.11.28 → 0.11.29
block/goose	minor	v1.41.0 → v1.43.0
rust-nightly	patch	nightly-2026-07-12 → nightly-2026-07-20

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.11.29

Compare Source

Released on 2026-07-15.

Python

• Use gzip-compressed artifacts for PyPy downloads (#​20265)

Enhancements

• Add JSON output to uv tree (#​19978)
• Add CUDA 13.2 as a supported PyTorch backend (#​20267)
• Prefer local artifacts over URLs when installing from pylock.toml (#​20393)
• Clarify diagnostics for unsatisfiable direct requirement ranges (#​20227)
• Include the selected project name in missing-extra errors (#​20358)

Preview features

• Preserve extras and dependency-group conflict context when selecting locked project tools (#​20078)
• Split OSV audit queries that exceed the service's 1,000-package limit (#​20398)
• Apply OSV fixed-version information only to the matching package and ecosystem (#​20399)
• Skip the virtualenv distutils monkeypatch on Python 3.10 and later (#​20222)
• Report invalid uv audit --service-url values instead of panicking (#​20374)
• Include preview settings in the published SchemaStore schema (#​20304)

Performance

• Reduce resolver work by widening selected versions across ranges without other known candidates (#​20115)
• Defer client and build setup for no-op uv sync operations (#​20364)
• Reuse workspace discovery during frozen syncs (#​20363)
• Reuse workspace discovery after resolving settings (#​20356)
• Reuse workspace discovery in uv tree, uv export, uv format, and uv audit (#​20359)
• Avoid cache and interpreter setup when reading a project version (#​20360)

Bug fixes

• Reject duplicate active package entries in pylock.toml (#​20391)
• Preserve direct-archive hashes in uv pip freeze output (#​20395)
• Explain conflicting root requirements instead of displaying an empty version range (#​20228)
• Prevent build-backend data paths from escaping the project or bypassing wheel exclusions (#​20397)
• Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks (#​20387)
• Redact credentials from failed Git fetch commands (#​20401)
• Fix exclusive post-release range ordering to match PEP 440 (#​20268)
• Canonicalize equivalent PEP 440 ranges during dependency resolution (#​20182)
• Honor Python version pins when initializing scripts (#​20404)
• Respect package-scoped source filtering for scripts (#​20389)
• Report existing environment incompatibilities when uv pip install --strict has nothing to install (#​20388)
• Continue scanning platlib when purelib is missing (#​20405)
• Handle versionless .egg-info files as legacy package metadata (#​20403)
• Make repeated locking idempotent for impossible cross-variable platform markers (#​20369)
• Report invalid cloud credential endpoint URLs instead of panicking (#​20372)
• Report invalid pylock.toml artifact URLs instead of panicking (#​20373)
• Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts (#​20375)
• Return an unsupported-operation error from unimplemented build-backend requirement hooks (#​20376)

Documentation

• Clarify --no-build behavior for editable requirements (#​20234)
• Document uv's threat model (#​20236)
• Reduce the number of badges in the README (#​11257)

block/goose (block/goose)

v1.43.0

Compare Source

✨ Features

• Reconnect desktop ACP sessions after sleep and connection loss #​10411
• Per-message usage stats UI (tokens, cost, TTFT, tok/s) #​10210
• Per-message usage/cost tracking with derived session totals #​10172
• Group chat sessions by project in nav panel #​10212
• Show project names in directory switcher dropdown #​10207
• OllamaCloudProvider with dynamic model discovery and context limits #​10264
• Delete support for custom apps from Apps UI #​10127
• --edit session flag to edit conversation before forking #​9799
• iFlytek Spark and Astron MaaS providers #​9837
• Fireworks AI declarative provider #​9990
• OpenRouter request parameters support #​9276
• OVHcloud Qwen3.6-27B model (262K context) #​10339
• GPT-5.6 family support #​10349
• GLM-5.2 support #​9967
• French, German, Italian, Portuguese, Indonesian, Malay, Vietnamese, and Traditional Chinese desktop locales #​10072
• Provider bindings MVP to goose-sdk with Python wheel publishing #​10208
• TLS support for ACP serve #​10088
• Streamable HTTP support in deeplink generator #​9954

🐛 Bug Fixes

• Exclude MCP App tools from Code Mode callbacks #​10290
• Preserve reasoning_content for DeepSeek thinking mode on multi-turn tool calls #​10366
• Compaction disabled during approval #​10089
• Treat empty-string finish_reason as non-terminal in streaming #​10258
• Gemini OAuth onboarding failure #​10363
• Retry empty provider turns instead of stopping silently #​10360
• Guard llama.cpp backend init against SIGILL on x86_64 CPUs without FMA/AVX2 #​10105
• Sanitize responses function call names #​10344
• Pick session mode from the IDs the agent actually offers #​10320
• Desktop ACP shell PATH #​10336
• Dedupe duplicate signed thinking blocks to fix Anthropic 400 #​10083
• Resolve provider default model instead of leaking sentinel "current" #​10305
• Return effective context limit from /model-info #​10165
• Gate rcgen aws_lc_rs feature behind rustls-tls #​10116
• Recover malformed tool calls from GLM/Minimax models instead of rejecting them #​10230
• Restore cursor when configure exits #​10222
• Skip scheduled sessions for implicit resume #​10178
• Sync slash help with builtins #​10173
• Treat unicode punctuation as image path terminators #​10106
• Don't bleed provider-specific request_params into delegate() sessions #​9906
• Purge empty phantom sessions on startup #​9651
• Include structuredContent from MCP tool response #​10128
• Propagate agent cleanup errors on session delete #​10112
• Tolerate partial Responses output items #​10108
• Always use OpenAI-compatible "parameters" for Databricks tools #​10101
• Unescape shell-escaped image paths #​10098
• Send inference config (max_tokens, temperature) on Bedrock Converse #​9889
• Dedupe Nostr session deep link imports #​9918
• Don't retry deterministically-permanent 400s (thinking-block immutability) #​10005
• Use async reqwest client so OTLP export works in goose serve mode #​10100
• Reject non-object tool-call arguments instead of panicking #​9832
• Save /edit prompts to history #​10011
• Buffer thinking across stream chunks for DeepSeek/Kimi tool calls #​9704
• Surface actionable errors for truncated tool-call arguments #​9946
• Show optimistic toggle state when disabling an extension #​9882
• Resolve databricks_v2 pricing and surface cost in standard usage update #​9925
• Activate hermit on macOS so STDIO extensions resolve node #​9482
• Prompt timestamps are now timezone-explicit #​10209

🔧 Improvements

• Apply the default extension timeout to developer shell tool calls #​10348
• Disable thinking preservation for Groq #​10284
• Bound code-mode execution with timeout and cancellation #​10214
• Keep turn-context out of the Anthropic prefix cache #​10030
• Disable extended thinking for fast-model operations #​9815
• Switch the local inference provider MLX backend to use the safemlx crate #​10304
• OpenAI Responses API store param configurable #​10040
• Support streamed tool calls without indexes #​10023
• Fail closed on unverifiable update provenance #​10168
• Migrate diagnostics to JSON report #​9964
• Route MCP elicitations through tool streams #​9943
• ACP migration for desktop UI #​10081
• Relabel settings 'Session' tab to 'External Backend' #​10318
• Show manual-setup indicator for extensions without an install link #​10321

📚 Documentation

• Clarify session --edit context retention #​10257
• Name the message field in the hooks payload guide #​9913
• Custom agents guide #​9293
• Correct custom agents guide #​9947

v1.42.0

Compare Source

✨ Features

• OllamaCloudProvider with dynamic model discovery and context limits #​10264
• Per-message usage stats UI (tokens, cost, TTFT, tok/s) #​10210
• Per-message usage/cost tracking with derived session totals #​10172
• Group chat sessions by project in nav panel #​10212
• Show project names in directory switcher dropdown #​10207
• Provider bindings MVP to goose-sdk with Python wheel publishing #​10208
• AskAI bot hints for followups #​10291

🐛 Bug Fixes

• Resolve provider default model instead of leaking sentinel "current" #​10305
• Return effective context limit from /model-info #​10165
• Recover malformed tool calls from GLM/Minimax models instead of rejecting them #​10230
• Restore cursor when configure exits #​10222
• Sync slash help with builtins #​10173
• Treat unicode punctuation as image path terminators #​10106
• Don't bleed provider-specific request_params into delegate() sessions #​9906
• Purge empty phantom sessions on startup #​9651
• Include structuredContent from MCP tool response #​10128
• Gate rcgen aws_lc_rs feature behind rustls-tls #​10116

🔧 Improvements

• Increase /mcp-app-guest body limit for larger single-file MCP apps #​10324
• Relabel settings 'Session' tab to 'External Backend' #​10318
• Switch local inference provider MLX backend to use the safemlx crate #​10304
• Disable thinking preservation for Groq #​10284
• Bound code-mode execution with timeout and cancellation #​10214
• Skip scheduled sessions for implicit resume #​10178
• Fail closed on unverifiable update provenance #​10168
• Update Rust toolchain and raise recursion limit #​10303
• Drop unsupported gpt-5.3-codex from chatgpt_codex provider #​10271
• Move Google provider into goose-providers #​10216
• Move Snowflake provider #​10218
• Move Databricks providers into goose-providers crate #​10162
• Move declarative definitions #​10167

📚 Documentation

• Clarify session --edit context retention #​10257
• Simplified the issue templates #​10316
• Remove stale crates/goose-server and update docs #​10224

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.