[bootc-bot]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.13.0 → 0.13.1
block/goose	minor	v1.54.0 → v1.55.0
ossf/scorecard	minor	v5.5.0 → v5.6.0
rust-nightly	patch	nightly-2026-10-11 → nightly-2026-10-18

---

Release Notes

astral-sh/uv

v0.13.1

Compare Source

Released on 2026-10-14.

Enhancements

• Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict, consistent with resolution (#​22500)
• Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable (#​22463)
• Report missing trusted hashes in resolution errors (#​22241)

Python

• Add CPython 3.16.0a1 (#​22527)

Preview features

• Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled (#​22498)
• Add preliminary support for parsing PEP 825 variant labels in wheel filenames with wheel-variants (#​22039)

Performance

• Reduce uv's binary size (#​22429, #​22430, #​22432)
• Speed up Simple API parsing (#​22429)
• Reduce package metadata parsing overhead (#​22239)

Bug fixes

• Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories (#​22495)
• Restore support for source distributions containing hard links or full-length tar user or group names (#​22516, #​22522)
• Preserve device files and FIFOs used as uv pip compile or uv export output destinations (#​22496)
• Fix sys._base_executable detection for environments created from symlinked interpreters (#​22520)
• Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files (#​22399, #​22402, #​22403)
• Serialize concurrent project commands that reach the same environment through real and symlinked paths (#​22390)
• Prevent installs, syncs, and environment creation from failing when they race with uv cache clean (#​22387)
• Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled (#​22391)
• Persist changed upgrade settings even when uv tool upgrade leaves the tool version unchanged (#​22499)
• Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again (#​22464)

Documentation

• Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable (#​22424)
• Fix the .netrc format documentation link (#​22514)

Other changes

• Publish Python 3.15-based uv Docker images under stable tags (#​22503)

block/goose

v1.55.0

Compare Source

✨ Features

• AIgateway declarative provider #​12528
• Propagate W3C trace context from ACP prompts to MCP tool calls #​12697
• Surface provider x-request-id on responses and errors #​12587
• Honor supports_vision declared on custom provider models #​12769
• Use live model metadata for OpenAI reasoning and prefer the Responses API #​12568
• Cap auto-compaction at 225k tokens by default #​12790
• Improve askai bot relevance #​12728

🐛 Bug Fixes

• Adaptive thinking for Claude Sonnet and Haiku 5.5 #​12761
• Reject malformed GOOSE_MODE across ACP providers #​12846
• Bedrock: don't retry non-context ValidationException on converse_stream #​12710
• OpenRouter: do not set transforms field unconditionally #​11374
• Apply long-context price tiers to cost estimates #​12787
• Finish pending tools before enforcing max turns #​12702
• Not offer delegate to code-mode scripts #​12711
• Anthropic: forward unknown request_params to wire, mirroring openai engine #​12720
• Desktop: show copy button on messages with thinking blocks #​12726

🔧 Improvements

• Bind subagents by their parent's hooks, mode and approvals #​12802
• Lease a session's selection and start each extension on first use #​12775
• Make Stop end the run promptly and save what it produced #​12765
• Make tool operations own tool call checks #​12865
• Not infer or steer while a tool approval is pending #​12808
• Leave the login-shell PATH to whoever launches goose #​12799
• Build turns from the session record: derive recipe prompt parts, persist prompt, goal and container #​12730
• Add ProviderManager and route session providers through it #​12745
• Use typed structs for openai message formatting #​12725
• Remove background subagents and orchestrator; make Doctor session-only #​12729
• Avoid duplicate provider initialization for foreground subagents #​12705
• Refresh the model catalog on the blocking pool #​12727
• Remove false optionality in desktop props #​12776
• Delete the legacy agent loop #​12760

📚 Documentation

• Agentic State Machines #​12130

ossf/scorecard

v5.6.0

Compare Source

Scorecard Infrastructure Migration

v5.6.0 is the first Scorecard release since our hosted services moved! 🎉

The weekly batch scans and the REST API now run on AboutCode Foundation
infrastructure on AWS, operated in partnership with the Scorecard Steering Committee.

AboutCode is a public-benefit non-profit that already consumes Scorecard data and runs similar
large-scale data services, including PurlDB and
VulnerableCode.

The full announcement is in #​5208.

What this means for you:

• CLI and REST API users: nothing changes. The API endpoint and the tooling are the same.

• Scorecard Action users: Upgrade to
  v2.5.0 or later. Older versions
  pull images from gcr.io, which has been retired, and will fail.

• Container images: use ghcr.io/ossf/scorecard. Existing version tags were copied from
  gcr.io/openssf/scorecard with identical digests (v5.5.0 was already published to GHCR), so only
  the registry and namespace change:

  - gcr.io/openssf/scorecard:<tag>@sha256:<sha>
  + ghcr.io/ossf/scorecard:<tag>@sha256:<sha>

• BigQuery dataset users: the public dataset is no longer available.

• Weekly scan inventory: to add a repository to the weekly scans, follow
  ossf/scorecard-infra's contributing guide.
  The pipeline and its project lists moved there.

• Allstar users: the hosted Allstar GitHub App has been retired. Allstar continues as a
  Scorecard subproject; see the Allstar README for self-hosting.

Report infrastructure problems at ossf/scorecard-infra.

Thank you to AboutCode Foundation for giving Scorecard a new home, and to everyone who reported
migration issues and helped other projects update.

Action Required

• Workflow checks now read YAML aliases, so Pinned-Dependencies may report more findings. Steps
  reached through an alias (uses: *anchor, aliased run:) were previously skipped and are now
  checked by Pinned-Dependencies, Dangerous-Workflow and the other workflow-based checks. Each
  aliased step counts, so a repository that reuses unpinned actions this way and wasn't already at 0
  can lose score. by @​justaugustus in #​5287
• Library users: checks/fileparser signatures changed. Exported workflow helpers
  (GetJobName, AnyJobsMatch, IsPackagingWorkflow and others) now take Scorecard's own workflow
  types instead of github.com/rhysd/actionlint types, and some workflow parse error messages are
  worded differently. by @​justaugustus in #​5287
• Library users: cron/ has been removed. cron/data and cron/config are no longer
  importable; the batch-scan pipeline now lives in ossf/scorecard-infra (see Scorecard
  Infrastructure Migration). by @​justaugustus in #​5210
• Library users: Go 1.26.5 or later is required (go directive raised from 1.26.0). by
  @​justaugustus in #​5296

General

• Release container images are built with Go 1.27.2. by @​dependabot[bot] in #​5310
• --format=intoto output is now serialized with protojson, so field names match the in-toto
  specification. by @​puerco in #​5225
• On Windows, file paths from GitHub, GitLab and Azure DevOps repositories now use forward slashes,
  matching other platforms. by @​pujitha24 in #​5153

Azure DevOps

• Legacy Azure DevOps repository URLs are accepted and normalized to dev.azure.com. by @​JamieMagee
  in #​5128
• No workflow runs are returned, without querying every build, when the requested YAML pipeline
  doesn't exist. by @​JamieMagee in #​5129
• Language-aware checks fall back to all supported languages when language analytics are
  unavailable. by @​JamieMagee in #​5130
• A repository file larger than the archive extraction limit is now rejected instead of silently
  truncated. by @​Sahana2524 in #​5173

Checks

Packaging

• ko publishing workflows are detected with either imjasonh/setup-ko or ko-build/setup-ko;
  previously the matcher never fired. by @​arcaven in #​5134

Pinned-Dependencies

• Actions referenced from the same repository with GitHub's $/ prefix (for example uses: $/.github/actions/example) are treated like ./ local actions and no longer reported as
  unpinned. by @​trask with @​Kielek in #​5191

Vulnerabilities

• Python requirements files no longer trigger transitive dependency resolution, which could stall
  the check until it timed out. For library users, clients.ExperimentalLocalOSVClient no longer
  makes network requests for transitive resolution. osv-scanner is updated to v2.5.1. by
  @​justaugustus with @​adilalperenciftci in #​5296
• Maven dependencies whose version is an unresolved build placeholder (for example
  @project.version@ or ${revision}) are no longer reported. by @​justaugustus in
  #​5306

Probes

• The unsafeblock probe also detects Java's sun.misc.Unsafe and jdk.internal.misc.Unsafe
  classes. by @​thomasleplus in #​4849

Docs

• 📖 Set GitLab support for Code-Review and Dependency-Update-Tool by @​dvcorreia in
  #​4963
• 📖 docs: clarify partial credit logic for Branch-Protection tiers by @​aban-alazzeh in
  #​5010
• 📖 Validate Security Insights in CI (and fix the schema) by @​justaugustus in
  #​5298

Other

• 🌱 ci: use ginkgo --flake-attempts instead of nick-invision/retry for e2e tests by @​alliasgher in
  #​5013
• 🌱 update e2e test to account for new vulns by @​spencerschrock in
  #​5159
• 🌱 deps: Upgrade golang.org/x/crypto v0.50.0 => v0.56.0 by @​justaugustus in
  #​5223
• 🌱 e2e/fuzz: Account for Scorecard API repo migration by @​justaugustus in
  #​5253
• 🌱 workflows/stale: Stop closing stale pull requests by @​justaugustus in
  #​5259
• 🌱 dependabot: Add/fix broken exclude-patterns in gomod group by @​justaugustus in
  #​5260
• 🌱 dependabot: Exclude moby/buildkit and goreleaser from grouped updates by
  @​justaugustus in #​5263
• 🌱 dependabot: Exclude google/ko and go-git from grouped updates by @​justaugustus in
  #​5269
• 🌱 go.mod: Bump go-git, containerd, sigstore-go, slack-go, go-pkcs12 by @​justaugustus in
  #​5271
• 🌱 Bump github.com/prometheus/prometheus to v0.311.3 by @​justaugustus in
  #​5294
• 🌱 Bump golang.org/x/net from 0.58.0 to 0.60.0 by @​justaugustus in
  #​5311
• 🌱 Bump GoReleaser to v2.18.3 and pin it for releases by @​dependabot[bot] in
  #​5309

Known Issues

• GitLab: Vulnerabilities returns −1 for every GitLab repository
  (#​5056). A fix is planned for v5.7.0
  (#​5180).
• Vulnerabilities: npm bundled dependencies are not checked. Since the osv-scanner update,
  package-lock.json entries without a resolved URL, which includes bundled dependencies, are
  skipped when matching known vulnerabilities. This comes from osv-scalibr; we're following up
  upstream.
• Pinned-Dependencies: findings reached through a YAML alias point at the anchor's line, not the
  alias. How aliased steps are counted and attributed is tracked in
  #​5291.

New Contributors

• @​dvcorreia made their first contribution in #​4963
• @​aban-alazzeh made their first contribution in #​5010
• @​alliasgher made their first contribution in #​5013
• @​thomasleplus made their first contribution in #​4849
• @​pujitha24 made their first contribution in #​5153
• @​Sahana2524 made their first contribution in #​5173
• @​arcaven made their first contribution in #​5134

Full Changelog: ossf/scorecard@v5.5.0...v5.6.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.