chore(deps): update docker

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.11.21 → 0.11.23
block/goose	minor	v1.37.0 → v1.38.0
rust-nightly	patch	nightly-2026-06-15 → nightly-2026-06-21

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.11.23

Compare Source

Released on 2026-06-19.

Bug fixes

• Revert "Fix transparent Python upgrades in project environments" to mitigate unintended breakage in pre-commit-uv (#​19925)
• Restore old behavior where workspace members "hidden" by an intermediate pyproject.toml would be treated as standalone projects (#​19926)

v0.11.22

Compare Source

Released on 2026-06-18.

Enhancements

• Publish wheels before sdists in uv publish (#​19831)
• Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check (#​19821)

Preview features

• Allow configuring preview features in uv.toml and pyproject.toml (#​18437)
• Update the lockfile during uv check --no-sync (#​19909)
• Add --script to uv check and uv metadata (#​19860)
• Report workspace-exclusive dependency groups in workspace metadata (#​19862)
• Support SARIF as a uv audit output (#​19872)

Performance

• Use a more deadlock-resistant concurrent hashmap in the resolver (#​19532)

Bug fixes

• Update string marker ordering semantics to match upstream clarified rules (#​19808)
• Reject extras that have the same normalized name (#​19871)
• Reject dependency group include-group entries that have additional fields (#​19866)
• Reject invalid UTF-8 URL credentials (#​19814)
• Validate that PEP 517 backend-paths exist when building sdists (#​19834)
• Validate that pylock.toml files do not have an unsupported a lock-version (#​19869)
• Validate that the environment satisfies the packages.requires-python of a pylock.toml (#​19868)
• Allow uv to be recursively invoked by PEP 517 build hooks (#​19879)
• Allow empty credentials.toml files (#​19815)
• Fix transparent Python upgrades in project environments (#​19890)
• Handle non-file editable URLs in uv pip list (#​19867)
• Fix incorrect output from uv tree --invert (#​19910)
• Fix environment locking of uv venv in a project (#​19837)
• Fix handling of workspace-exclusive dependency groups in uv tree (#​19905)

Documentation

• Archive the 0.10.x changelog (#​19813)

Other changes

• Mark more tests as requiring network for vendors that need to run tests offline (#​19819)

block/goose (block/goose)

v1.38.0

Compare Source

✨ Features

• Opt-in ACP last message snippets for sessions #​9798
• Unified OTLP logging schema for cross-tool detection #​9713
• Canonical thinking modes across providers #​9743
• Custom ACP method to get session info #​9729
• ACP secret key support at goose serve endpoint #​9726
• Surface Anthropic stream refusals as visible errors #​9724
• ACP search session support in Desktop #​9717
• Steering messages with ACP #​9560
• ACP list sessions with keyword and type filter #​9695
• ACP thinking effort config option #​9711
• ACP session management in Desktop #​9687
• Image read tool #​9607
• ACP methods for config extensions #​9581
• Custom notifications only when ACP client specifies capability #​9596
• Minimal uniffi setup for cross-language SDK #​9593
• Hugging Face OAuth support with auth tab in settings #​9552
• Session import functionality #​9474
• Replay ACP images on session load #​9496
• Raw provider supported models over ACP #​9475
• ACP session system prompt setter #​9478
• Scholar Sidekick MCP extension #​9433
• TUI feature flag to gate tui command #​9428
• CLI to list skills with token counts #​9326
• xAI SuperGrok OAuth subscription provider #​9420
• Perplexity as declarative OpenAI-compatible provider #​9324
• Alibaba (Qwen via DashScope) declarative provider #​9443
• Configurable tool output size limit via GOOSE_MAX_TOOL_RESPONSE_SIZE #​9256
• /model slash command in CLI for session model switching #​8747
• Databricks AI Gateway provider #​9274
• TUI command on goose-cli #​9385
• Configurable MAX_CODE_BLOCK_LINES via env vars #​9301
• NEAR AI Cloud provider #​9352
• goose://resume session deep link #​9343
• Scaleway provider #​9254
• Honor GOOSE_FAST_MODEL env var in ModelConfig::with_fast #​9296
• goose review local code review command #​9114
• TUI diff viewer #​9260
• ACP paginate session list #​9199
• Structured per-provider config block, non-destructive provider switching #​8977
• Pass session cwd param to ACP providers #​9229
• gpt-5.5 added to known models #​9292
• Opt-in to Vercel AI Gateway leaderboard #​9259
• Harbor eval runner #​9138
• Slash commands (built-in, skill, recipe) in ACP server #​9238
• /goal command for agent self-evaluation before finishing #​9069
• Summon subagent instructions #​9325
• Open-plugins generalization with skills #​9112
• PreToolUse denial hook #​9304
• Optional api_key configuration for declarative openai-engine providers #​9202
• Login shell PATH flag #​9313
• Linux musl CLI builds #​9240
• goose://new-session deep link to open fresh chat #​9196
• GOOSE_DISABLE_TOOL_CALL_SUMMARY to opt out of per-tool-call summaries #​8947
• Recipe discovery and execution via ACP server #​8925
• GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri #​9209
• Proactive OAuth token refresh to avoid re-auth on every session #​8386
• Encrypted Nostr session sharing #​8922
• Simplified Chinese (zh-CN) translation #​8765
• Nushell terminal and completion support #​8628
• Optional --parameters for scheduled recipes #​8741
• GitHub Copilot /responses API #​9043
• Vercel AI Gateway provider #​9144
• Routstr declarative provider #​9175
• FuturMix provider #​8840
• oMLX declarative provider #​9177
• Strip chain-of-thought markers from custom provider output #​8635
• Quarterly option for scheduler #​9076
• Hooks system #​9093
• Atomic Chat as declarative OpenAI-compatible provider #​9210
• Projects as backend sources with system prompt injection #​8739
• Worktree-aware directory switcher #​8450
• Chat history search feature in navigation panel #​8448
• Expose built-in skills through sources list ACP calls #​9045
• ACP streamable HTTP spec compliance #​9034
• Move goose2 provider catalog behind ACP layer #​9030
• Group consecutive tool calls into one summarized chain card #​8995
• Replace raw config and secret methods in ACP #​9000
• Support Google model inventory refresh #​8913
• MCP Apps inline rendering in goose2 #​8877
• Goose2 custom providers support in UI and ACP #​8924
• Ollama host configurable in goose2 #​8912
• Skills added to chat composer #​8881
• MCP Apps hydrate and replay payloads in Goose2 #​8632
• Windows CUDA release artifacts #​8750

🐛 Bug Fixes

• Desktop new chat shortcut #​9659
• Correctly map ollama_cloud to canonical provider and update max tokens #​9639
• Incorrect max tokens values for Groq provider #​9790
• Classify Bedrock ValidationException as ExecutionError #​9735
• Page through all Databricks AI Gateway v2 endpoints when listing models #​9753
• Preserve unparseable extension entries during config refresh #​9439
• goose-sdk release compat check with new schema #​9697
• Compatibility of config extension ACP call in TUI #​9683
• Intermittent missing extension override on UI #​9575
• Scheduled recipe session params #​9553
• Skip OTLP signals when protocol=grpc to avoid background-thread panic #​9512
• Forward ACP server context window size to clients #​9455
• Quote release PR search phrase in pre-release.sh #​9573
• Refresh provider list in Switch Models picker #​9408
• Start new chat in current window from recipe param modal #​9422
• Make Azure api-version query param optional #​9221
• Preserve pending env vars in Add Extension form #​9285
• Tolerate missing responses output #​9449
• Stricter GGUF requirements, auto detection of tool calling support, fixed thinking output parsing #​9442
• Build linux x86_64 standard inside manylinux_2_28 for glibc 2.28+ compat #​9415
• Stop desktop main window growing taller on every launch #​9409
• Desktop chat search session limiting #​9366
• Serialize per-session agent creation to stop duplicate MCP init #​9357
• Respect GOOSE_MAX_TURNS in gateway sessions #​9354
• Send empty object instead of null for Anthropic tool_use input #​9355
• Use context limit from /model/info for LiteLLM custom models #​9303
• Preserve thinking content for provider context #​9314
• Mention configurable timeout env vars in Ollama stream stall error #​9246
• Include full recipe parameter details in load/discovery output #​9233
• Remove unused fetch-metadata IPC handler (SSRF) #​9340
• Emit trace_output as span attribute instead of event #​9255
• Check file fallback when keyring has no entry #​9279
• Desktop ScheduleModal error message styling #​9278
• Align sidebar hamburger in macOS fullscreen #​9257
• Use current_exe() instead of PATH lookup when spawning goose #​9236
• Set TCP_USER_TIMEOUT on streamable HTTP clients #​9207
• Activate custom provider after adding via configure #​9213
• Reduce excessive MISSING_TRANSLATION warnings for fallback locales #​9294
• Eliminate cross-window deep link contamination #​9273
• Improve Telegram gateway error reporting and connection reliability #​9223
• Enable VT processing on Windows Console Host #​9248
• Zero out cost for local providers (ollama, local) #​9219
• Replace Venice custom provider with declarative config #​9234
• Widen MOIM allowlist to suppress expected fix_conversation warnings #​9226
• Use mkdir -p for self-test workspace initialization #​9247
• Re-apply canonical limits when delegate overrides model #​9183
• Report cumulative total_tokens in stream-json/json output #​8910
• Refresh GCP metadata server token on expiration #​8929
• Convert quoted numeric config values to numbers if needed #​8844
• Keep SSE reconnect loop alive on long disconnects #​8846
• Apply request_params to outgoing OpenAI API payload #​9151
• Add Gemini 3.x known_location Global routing and KNOWN_MODELS entries #​9142
• Coalesce streaming Thinking deltas + list available tools on not-found #​9162
• Honor Retry-After on 429 responses #​9161
• Preserve user-set session name for recipe-based chats #​9079
• Enforce exp independently of MAX_TOKEN_AGE_SECONDS in OIDC proxy #​8839
• Improve inline code contrast in light theme #​9058
• Omit max_tokens for OpenAI-compatible requests when unset #​9123
• Set correct mcp-app host capabilities #​9116
• Normalize nullable schemas for Vertex Gemini compatibility #​8930
• Isolate GitHub recipe temp paths #​8878
• Set X-Initiator header on GitHub Copilot requests #​8809
• Honor dynamic_models: false in declarative provider configs #​8795
• Cache trailing message for stable prefix across Bedrock agent turns #​8916
• Case-insensitive model name lookup for context_limit #​8906
• Emit cumulative token usage in stream-json/json complete event #​8870
• Return 400 instead of panicking on invalid CSP header value #​8810
• Coalesce streaming chunks under one message id in ACP #​8788
• Reuse goose2 vite server on port conflict #​8722
• Correct WSL2 OS detection by removing PWD-based Windows override #​8869
• Handle Bedrock ReasoningContent blocks gracefully #​8843
• Insert tool pair summaries at chronological position in conversation #​9087
• Enable SQLite foreign key enforcement in session pool #​9121
• Deleted chat session still appears in sidebar list #​8674
• Require extension_name on read_resource #​8989
• Queued message lost when clicking sending now #​9074
• Keep model picker and session config in sync in goose2 #​9048
• Read prompted file parameters in recipes #​8504
• Accept null tool_call arguments in streaming chunks #​9035
• Use python3 in developer extension instructions for macOS/Linux compatibility #​8784
• Synchronously reap ACP child to avoid SIGCHLD race #​9023
• Elicitation fixes #​8999
• SACP notifies clients of generated session names #​8983
• CRT linkage in Windows CUDA build #​8987
• Unscheduling a recipe should not delete them #​8978
• Seed provider handoff history in ACP #​8941
• Respect goose2 interface density settings #​8953
• Make goose2 respect accent color #​8952
• Preserve replay message timestamps #​8942
• Goose2 window minimum sizing #​8946
• Avoid transform-rasterized dialog text in goose2 #​8937
• Keep renamed skills open in detail view #​8935
• Gemini OAuth onboarding failure #​8905
• Model picker stays usable during provider loading #​8900
• Handle ACP requests concurrently #​8781
• Prevent tool-use marker leakage in toolshim output #​8310
• Exclude preprompt from session title generation #​8793
• Prevent login-shell PATH probe from suspending goose on startup #​8804

🔧 Improvements

• Mark stream decode errors retryable #​9723
• Validate desktop i18n catalogs #​9776
• Move formats/openai.rs into goose-providers crate #​9633
• Create goose-providers crate with canonical models and types #​9588
• ACP session setup refactor #​9488
• LRU cache for token counting #​9586
• Replace review subprocess timeout with turn limits #​9571
• Benchmarking infrastructure #​9465
• Honor blocking Stop hook decisions #​9468
• Forward custom headers through OAuth connect path #​9388
• Prefer goose aliases for Databricks v2 inventory #​9430
• Improve dependency hygiene #​9360
• Simplify UI customization #​9353
• Build summon instructions per turn #​9329
• Preserve selected branch across project chats #​9010
• Unified thinking effort control across all providers #​9242
• Linux desktop Vulkan packages #​9323
• Flush OTLP traces reliably on exit with configurable timeout #​9228
• Mount ACP in goosed server for iterative migration #​9097
• Use plain '> ' prompt instead of goose emoji in CLI #​9305
• Remove popular chat topics from new chat screen #​9307
• Stop killing goosed when a window closes #​9302
• Remove vendored Windows binaries #​9318
• Include request URL in provider error messages #​9232
• Ensure parallel tool image responses don't interleave for Databricks #​9241
• Surface resolved Databricks model metadata #​9206
• Better parsing of pasted HTML as markdown #​9190
• Persist accumulated cost in session DB to survive reload #​9191
• Prompt injection mitigation pattern updates #​9198
• TUI spacing/layout improvements #​9243
• Preserve thinking content for providers that require it #​8857
• Dynamically refresh skill instructions each turn #​9217
• Build non-vulkan Linux variants using ubuntu 22.04 #​9211
• Show tool name in approval prompt #​9216
• Localize hardcoded strings in provider settings UI #​8931
• Move settings into app shell #​9047
• Add Location column to CLI skills table #​8785
• Consolidate logging setup into shared helper #​8817
• Protocol cleanup #​9147
• Refresh onboarding when provider catalog loads #​9051
• Frontend extension session state and tool routes #​8464
• Remove threads layer, use sessions directly for ACP #​9078
• Install plugins to ~/.agents/plugins #​9088
• Use native arm64 runners for Linux artifact builds #​9075
• Linux Vulkan support for local inference #​9038
• Switch to official new rust-sdk for ACP #​9062
• Provider-first onboarding #​9039
• Replace artifact heuristics/regexes with protocol messages #​8996
• Fold UI refactor review into code review skill #​8982
• LM Studio declarative provider improvements #​8973
• Remove artifacts dir handling #​8945
• Install plugins support #​8949
• Redesign Extensions page, treat Extension Manager as core MCP enabler #​8940
• Goose2 settings headers cleanup #​8951
• Goose2 compact settings modal headers #​8950
• Break up acp/server.rs #​8932
• Goose2 skill refactor #​8897
• Polish sidebar navigation and project icons #​8896
• Update provider row after saving credentials #​8914
• Parallelize provider resolution and eagerly init SQLite pool #​8899
• Update goose2 credential management behind provider-scoped ACP/core API #​8887
• Deduplicate _goose/providers/list RPC call at startup #​8873
• Mergeable configs #​8378
• Agent provider to use explicit type states #​8879
• Translate ACP host capabilities into MCP initialization #​8623
• Redesign skills library #​8868
• Prompt injection mitigation enabled by default for internal users #​9612
• Re-adjust pattern-based detection confidence scores #​9690
• Pattern-based detection updates to reduce false positives #​9350
• Add directionality to egress logging #​9546

📚 Documentation

• Update ACP clients documentation #​9772
• Fix stale session navigation/delete docs #​9727
• Fix typo in MCP blog post #​9641
• Update analyze extension instructions #​9585
• Add Scaleway provider documentation #​9423
• Add Repology badge to README #​9245
• Document summon extension requirement for delegate and load tools #​9231
• Guide for connecting goose Desktop to remote goosed server #​9275
• SaladCloud AI Gateway documentation #​9253
• Hooks guide #​9288
• Blog post for hooks feature #​9227
• Fix internal documentation anchors #​9094
• Blog: orchestrating with goose #​9104
• Updated tunnel remote access documentation #​9077
• Blog: goose with peekaboo #​8884
• Built-in Local Inference blogpost #​8808
• Blog: findings with minimax and office QA benchmark #​8984
• Reorganize documentation #​9310
• Stats update #​9410

🌐 Localization

• Japanese locale support #​9768
• Hindi Desktop locale #​9733
• Russian language support #​9406
• Turkish desktop locale #​9392

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.