chore(deps): update docker

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.12.17 → 0.12.19
block/goose	minor	v1.51.0 → v1.52.0
nextest-rs/nextest	patch	0.9.145 → 0.9.146
nushell/nushell	minor	0.115.1 → 0.116.0
rust-nightly	patch	nightly-2026-09-20 → nightly-2026-09-27

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.19

Compare Source

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#​21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#​21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#​21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#​21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#​21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#​21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#​21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#​21891)
• Preserve always-false python_version markers when parsing their serialized form (#​21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#​21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#​21950)

v0.12.18

Compare Source

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#​21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#​21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#​21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#​21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#​21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#​21835, #​21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#​21860, #​21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#​21843)
• Reject archive entries that normalize to absolute Windows paths (#​21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#​21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#​21853)
• Avoid rebuilding a Windows relative path into an absolute form (#​21923)

block/goose (block/goose)

v1.52.0

Compare Source

✨ Features

• Live voice conversations in the desktop app #​12093
• Decisions provider crate with OpenRouter and Jev implementations #​12418
• Z.AI Coding Plan provider with streaming tool calls #​12205
• Recipe parameter limits enforcement (max 32 params, 200 select options, 128 KiB) #​12259
• OpenAI provider custom base URL support in SDK #​11967
• Support for Opus 5.5, GPT-6-sol, and GPT-6-luna models #​12447

🐛 Bug Fixes

• Cancel elicitation on incomplete CLI input #​11403
• Protect custom provider configuration files #​11438
• Prevent duplicate schedules from overwriting recipes #​12434
• Classify many-image dimension limit errors as context length-exceeded #​12208
• Set strict:false on chat-completions tools #​12272
• Show CoreWeave in bundled provider metadata #​12149
• Allow 60 seconds for provider readiness #​12240
• Write PATH to login shell files idempotently in installer #​12072
• De-duplicate @​radix-ui packages to fix pointer-events stranded on body #​11792
• Drive pre-key model lists from the canonical registry #​11475
• Make todo opt-in and soften its prompts #​12123
• Prevent updates to unsupported macOS versions #​12115
• Require recipe consent before session/new spawns extensions #​12094
• Skills follow working directory updates #​11443
• Create updater staging atomically #​11741
• Require opt-in for roaming TCP bridge #​11701
• Omit unsupported socket MCP servers #​11417
• Let recipe settings outrank GOOSE_SUBAGENT_MODEL/PROVIDER #​12070
• Send session usage updates after each provider call #​12006
• Start a chat with no extensions when the user selects none #​11908
• Databricks GLM-5.3 and Kimi K3 reasoning effort #​12079
• Avoid splitting graphemes in skills list #​12074
• Keep the subagent prompt prefix cacheable #​12062
• Install libclang and cmake in devcontainer #​12091

🔧 Improvements

• Redesign settings as a full-screen view #​12163
• Split extension transports out of ExtensionManager #​12088
• Compress canonical_models.json #​12385
• Resolve data_dir from Paths::data_dir() instead of config #​12203

📚 Documentation

• Use the real developer tool names in the hooks guide #​12260
• Fix stale declarative provider file paths in providers.md #​12192
• Clarify public crate APIs #​12186
• Remove Rube extension documentation (service discontinued) #​12116

nextest-rs/nextest (nextest-rs/nextest)

v0.9.146: cargo-nextest 0.9.146

Compare Source

Fixed

• Updated chacha20 and der to non-yanked versions.

nushell/nushell (nushell/nushell)

v0.116.0

Compare Source

This is the 0.116.0 release of Nushell. You can learn more about this release here: https://www.nushell.sh/blog/2026-09-26-nushell_v0_116_0.html

For convenience, we are providing full builds for Windows, Linux, and macOS. Be sure you have the requirements to enable all capabilities: https://www.nushell.sh/book/installation.html#dependencies

This release was made possible by PR contributions from @​app/dependabot, @​aron-intframe, @​ayax79, @​bobisageek, @​catlover-bot, @​costajohnt, @​cptpiepmatz, @​cuishuang, @​Developer1010x, @​Dheebz, @​dilr, @​Dorumin, @​fdncred, @​fly1d, @​hexbinoct, @​hustcer, @​i-api, @​Jorge-Polanco-Roque, @​KaiSforza, @​kronberger-droid, @​LouisDeconinck, @​luangucun, @​magnify035, @​maxim-uvarov, @​mikehasa, @​mkatychev, @​Mrfiregem, @​mrhard9090, @​neveroNiwe, @​nos1dot618, @​pheenty, @​philocalyst, @​pickx, @​ronisbr, @​rvhelden, @​sebaschi, @​sidsri14, @​surma, @​user93390, @​windlandneko, @​zozo123

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.