chore(deps): update docker

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.11.14 → 0.11.16
block/goose	minor	v1.34.1 → v1.35.0
nushell/nushell	minor	0.112.2 → 0.113.0
rust-nightly	patch	nightly-2026-05-18 → nightly-2026-05-24

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.11.16

Compare Source

Released on 2026-05-21.

Enhancements

• Add support for direct archive dependencies in Git (#​10072)
• Adjust hint rendering (#​18090)

Preview features

• uv audit: specialize malformed OSV error (#​19515)
• Reject locked malware installations (#​18936)

Configuration

• Allow disabling reading the system config with UV_NO_SYSTEM_CONFIG (#​19476)

Bug fixes

• Allow environment variables that take a list to be empty (#​19503)
• Ensure that incompatible wheel hints do not leak secrets (#​19504)
• Reject unsafe entry points in uv-build (#​19495)
• Restrict delimiters in entry point parsing (#​19471)
• uv-netrc: fix multi-word no-space comment lines causing parse errors (#​19494)

Documentation

• Document and test relative exclude-newer support for uv pip (#​19475)

v0.11.15

Compare Source

Released on 2026-05-18.

Security

• Fix a TAR parser differential, see GHSA-3cv2-h65g-fgmm (#​19463)
• Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#​19464)

Enhancements

• Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#​18741)
• Add support for Azure request signing (#​19421)
• Apply stricter validation to all wheel filename segments (#​19364)
• Reject empty strings as an invalid package name (#​19435)
• Use structured errors for signing authentication failures (#​19422)

Preview

• uv audit: Add JSON output (#​19305)

Configuration

• Respect required-environments in uv pip compile (#​19378)

Performance

• Avoid parsing JSON manifest when local Python is available (#​19398)
• Avoid walking nested directories in linker conflict registration (#​19382)
• Optimize async wheel ZIP writing (#​19383)
• Fix dead "already trimmed" fast-path in Version::only_release_trimmed (#​19425)

Bug fixes

• Apply workspace-member [tool.uv.sources] credentials under uv sync --frozen (#​19423)
• Skip empty directories in uv build outputs (#​19437)
• Fix Git submodule handling when using relative paths (#​12156)
• Fix line number reporting in netrc parsing (#​19452)

Documentation

• Move Bazel auth helper setup into integration guide (#​19392)

block/goose (block/goose)

v1.35.0

Compare Source

✨ Features

• Hooks system for extensible pre/post tool execution #​9093
• PreToolUse denial hook support #​9304
• /goal command for agent self-evaluation before finishing #​9069
• goose review local code review command #​9114
• Diff viewer in TUI #​9260
• Slash commands (built-in, skill, recipe) in ACP server #​9238
• Unified thinking effort control across all providers #​9242
• Open-plugins generalization + skills #​9112
• Summon subagent instructions #​9325
• Proactive OAuth token refresh to avoid re-auth on every session #​8386
• goose://new-session deep link to open fresh chat #​9196
• GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri #​9209
• Paginated session list in ACP #​9199
• Pass session cwd param to ACP providers #​9229
• Opt-in to Vercel AI Gateway leaderboard #​9259
• Optional --parameters for scheduled recipes #​8741
• Quarterly scheduling option #​9076
• Recipe discovery/execution in ACP server #​8925
• Projects as backend sources with system prompt injection #​8739
• Worktree-aware directory switcher #​8450
• Chat history search in navigation panel #​8448
• Encrypted Nostr session sharing #​8922
• Nushell terminal and completion support #​8628
• Simplified Chinese (zh-CN) translation #​8765
• Strip chain-of-thought markers from custom provider output #​8635
• GOOSE_DISABLE_TOOL_CALL_SUMMARY to opt out of per-tool-call summaries #​8947
• Group consecutive tool calls into one summarized chain card #​8995
• Vercel AI Gateway provider #​9144
• GitHub Copilot /responses API #​9043
• Agents CRUD operations #​9084
• ACP streamable HTTP spec compliance #​9034
• GPT-5.5 added to known models #​9292
• Linux musl CLI builds #​9240
• Linux Vulkan support for local inference #​9038
• Windows CUDA release artifacts #​8750

New Providers

• Atomic Chat #​9210
• Routstr #​9175
• FuturMix #​8840
• oMLX #​9177
• SaladCloud AI Gateway #​9253

🐛 Bug Fixes

• Databricks parallel tool image responses don't interleave tool results #​9241
• Stop killing goosed when a window closes #​9302
• Eliminate cross-window deep link contamination #​9273
• Check file fallback when keyring has no entry #​9279
• Activate custom provider after adding via configure #​9213
• Use current_exe() instead of PATH lookup when spawning goose #​9236
• Set TCP_USER_TIMEOUT on streamable HTTP clients #​9207
• Reduce excessive MISSING_TRANSLATION warnings for fallback locales #​9294
• Zero out cost for local providers (ollama, local) #​9219
• Persist accumulated cost in session DB to survive reload #​9191
• Prevent tool-use marker leakage in toolshim output #​8310
• Re-apply canonical limits when delegate overrides model #​9183
• Use plain '> ' prompt instead of goose emoji in CLI #​9305
• Flag for login shell PATH #​9313
• Enable VT processing on Windows Console Host #​9248
• Resolve Azure CLI on Windows by using az.cmd #​9215
• Handle non-interactive terminal in goose configure on Windows #​9214
• Emit trace_output as span attribute instead of event #​9255
• Flush OTLP traces reliably on exit with configurable timeout #​9228
• Telegram gateway error reporting and connection reliability #​9223
• ScheduleModal error message styling #​9278
• Align sidebar hamburger in macOS fullscreen #​9257
• Coalesce streaming Thinking deltas + list available tools on not-found #​9162
• Honor Retry-After on 429 responses #​9161
• Replace Venice custom provider with declarative config #​9234
• Use mkdir -p for self-test workspace initialization #​9247
• Preserve user-set session name for recipe-based chats #​9079
• Enforce exp independently of MAX_TOKEN_AGE_SECONDS in OIDC proxy #​8839
• Improve inline code contrast in light theme #​9058
• Omit max_tokens for OpenAI-compatible requests when unset #​9123
• Set correct mcp-app host capabilities #​9116
• Normalize nullable schemas for Vertex Gemini compatibility #​8930
• Isolate GitHub recipe temp paths #​8878
• Set X-Initiator header on GitHub Copilot requests #​8809
• Honor dynamic_models: false in declarative provider configs #​8795
• Cache trailing message for stable prefix across Bedrock agent turns #​8916
• Case-insensitive model name lookup for context_limit #​8906
• Return 400 instead of panicking on invalid CSP header value #​8810
• Coalesce streaming chunks under one message id in ACP #​8788
• Handle Bedrock ReasoningContent blocks gracefully #​8843
• Correct WSL2 OS detection by removing PWD-based Windows override #​8869
• Insert tool pair summaries at chronological position in conversation #​9087
• Enable SQLite foreign key enforcement in session pool #​9121
• Deleted chat session still appears in sidebar list #​8674
• Require extension_name on read_resource #​8989
• Queued message lost when clicking send now #​9074
• Keep model picker and session config in sync #​9048
• Read prompted file parameters in recipes #​8504
• Accept null tool_call arguments in OpenAI streaming chunks #​9035
• Synchronously reap ACP child to avoid SIGCHLD race #​9023
• Elicitation fixes #​8999
• SACP notifies clients of generated session names #​8983
• Unscheduling a recipe should not delete them #​8978
• Seed provider handoff history in ACP #​8941
• Respect goose2 interface density settings #​8953
• Make goose2 respect accent color #​8952
• Preserve replay message timestamps #​8942
• Avoid transform-rasterized dialog text in goose2 #​8937
• Keep renamed skills open in detail view #​8935
• Gemini OAuth onboarding failure #​8905
• Convert quoted numeric config values to numbers if needed #​8844
• Keep SSE reconnect loop alive on long disconnects #​8846
• Apply request_params to outgoing OpenAI API payload #​9151
• Gemini 3.x known_location Global routing and KNOWN_MODELS entries #​9142
• Refresh GCP metadata server token on expiration #​8929
• Report cumulative total_tokens in stream-json/json output #​8910
• Emit cumulative token usage in stream-json/json complete event #​8870
• Model picker stays usable during provider loading #​8900
• Handle ACP requests concurrently #​8781
• Reuse goose2 vite server on port conflict #​8722
• Exclude preprompt from session title generation #​8793
• Prevent login-shell PATH probe from suspending goose on startup #​8804

🔧 Improvements

• Surface resolved Databricks model metadata #​9206
• Include request URL in provider error messages #​9232
• Structured per-provider config block, non-destructive provider switching #​8977
• Optional api_key configuration for declarative openai-engine providers #​9202
• Remove popular chat topics from new chat screen #​9307
• Remove vendored Windows binaries #​9318
• Linux desktop Vulkan packages #​9323
• Better parsing of pasted HTML as markdown #​9190
• Prompt injection mitigation: updated pattern-based detection #​9198
• Consolidate logging setup into shared helper #​8817
• Localize hardcoded strings in provider settings UI #​8931
• Move settings into app shell #​9047
• Location column in CLI skills table #​8785
• Preserve thinking content for providers that require it #​8857
• Dynamically refresh skill instructions each turn #​9217
• Build non-vulkan Linux variants using ubuntu 22.04 #​9211
• Show tool name in approval prompt #​9216
• Remove Filesystem MCP extension from catalog #​9225
• Mount ACP in goosed server for iterative migration #​9097
• Frontend extension session state and tool routes #​8464
• TUI spacing/layout improvements #​9243
• Polish sidebar and context panel #​9059
• Polish inline code snippet styling #​9011
• Refresh onboarding when provider catalog loads #​9051
• Replace lazy_static with std::sync::LazyLock #​8815
• Introduce DEFAULT_PROVIDER_TIMEOUT_SECS constant #​8816
• Provider-first onboarding #​9039
• Redesign Skills library #​8868
• Redesign Extensions page #​8940
• Improvements to LM Studio declarative provider #​8973
• Mergeable configs + cleanup #​8378
• MCP Apps: hydrate and replay app payloads in Goose2 #​8632
• MCP Apps: translate ACP host capabilities into MCP initialization #​8623
• Render MCP apps inline in goose2 #​8877
• Plugin installation and auto-updating #​8949 #​9061
• Skills in chat composer #​8881
• Custom providers support in goose2 UI & ACP #​8924
• Make ollama host configurable in goose2 #​8912
• Support Google model inventory refresh #​8913
• Update provider row after saving credentials #​8914
• Parallelize provider resolution and eagerly init SQLite pool #​8899
• Deduplicate _goose/providers/list RPC call at startup #​8873
• Refactor local inference around backends #​9137
• Native arm64 runners for Linux artifact builds #​9075
• Update canonical model registry #​9331
• Update patterns for pattern-based command injection #​8546

📚 Documentation

• Documentation reorganization #​9310
• Hooks guide #​9288
• Hooks feature blog post #​9227
• Guide for connecting goose Desktop to a remote goosed server #​9275
• Document summon extension requirement for delegate and load tools #​9231
• Updated tunnel remote access documentation #​9077
• Orchestrating with goose blog post #​9104
• Goose with Peekaboo blog post #​8884
• Built-in Local Inference blog post #​8808
• MiniMax and Office QA benchmark findings blog post #​8984
• Fix internal documentation anchors #​9094

nushell/nushell (nushell/nushell)

v0.113.0

Compare Source

This is the 0.113.0 release of Nushell. You can learn more about this release here: https://www.nushell.sh/blog/2026-05-23-nushell_v0_113_0.html

For convenience, we are providing full builds for Windows, Linux, and macOS. Be sure you have the requirements to enable all capabilities: https://www.nushell.sh/book/installation.html#dependencies

This release was made possible by PR contributions from @​132ikl, @​andrewgazelka, @​app/dependabot, @​ayax79, @​Bahex, @​blindFS, @​casedami, @​colinmparker, @​cptpiepmatz, @​develop7, @​fdncred, @​freepicheep, @​galuszkak, @​Juhan280, @​kaathewisegit, @​kiil, @​kx0101, @​m4siri, @​Matthieu-LAURENT39, @​Metbcy, @​Mrfiregem, @​nome, @​OneProgGit, @​orbisai0security, @​pyz4, @​quyentonndbs, @​SunayKulkarni, @​Tyarel8, @​vip892766gma, @​vvvu, @​WindSoilder, @​ymcx

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.