chore(deps): update docker

[bootc-bot]

This PR contains the following updates:

Package	Type	Update	Change
block/goose		minor	v1.31.0 → v1.32.0
docker.io/library/ubuntu	final	major	24.04 → 26.04
ossf/scorecard		minor	v5.4.0 → v5.5.0
rust-nightly		patch	nightly-2026-04-19 → nightly-2026-04-25

---

Release Notes

block/goose (block/goose)

v1.32.0

Compare Source

✨ Features

• Exa AI-powered search tool #​8487
• Desktop notification when goose finishes a task #​8647
• @​agent mention support in chat #​8571
• /skills command #​8600
• Associate threads with projects #​8745
• Auto-compaction for goose2 context window UX #​8721
• Message bubble + action tray in goose2 #​8720
• Voice dictation via direct-ACP pattern in goose2 #​8609
• Context window usage in goose2 chat input #​8613
• Unix domain socket transport for StreamableHttp MCP #​7860
• Cash App extension in Extensions Library #​8622
• /edit command for on-demand prompt editing #​8566
• Novita AI as declarative provider #​8432
• Kimi Code provider with OAuth device flow authentication #​8466
• Extension management screen in TUI #​8536
• Extensions settings page and context panel widget #​8540
• Client ID Metadata Document (CIMD) support for OAuth #​8550
• Context window usage inline in status bar #​7607
• Chat attachments in goose2 #​8534
• Husky git hooks for ui/goose2 #​8577

🐛 Bug Fixes

• Cache TLS cert to disk to avoid slow startup on first launch #​8174
• Preprompt would show after loading session #​8744
• Handle missing delta field in streaming chunks #​8700
• Accept streaming chunks with both reasoning fields in OpenAI provider #​8715
• strict:false for Responses API tools and gpt-5.4 to known models #​8636
• Correct grammar in apps view description #​8679
• Links in chat could not be opened #​8544
• Run shell tool under bash/sh regardless of login shell #​8659
• Append /chat/completions for prefixed v1 base URLs #​8521
• Align Kimicode model metadata with live Kimi Code API #​8588
• Stop idle 300ms re-render loop that could OOM the TUI #​8616
• Chat loading-state model placeholder #​8431
• Expand tool calls by default when Response Style is Detailed #​8478
• Create logs dir before writing LLM request log #​8522
• Enable token usage tracking and configurable stream timeout for Ollama provider #​8493
• Use sqlx chrono decode for thread timestamps instead of manual parsing #​8575
• Remove double border on content in chat #​8545
• Accept self-signed certs from configured external goosed host #​8400
• Sync sidebar sessions after chat history deletion #​7707
• Prevent session hang when tool approval required in headless mode #​7915
• Eliminate ~5s delay when opening Switch Models panel with local provider #​8626
• Removed hardcoded dependency of goose-acp-macro #​8753
• Stop load openai fast model for openapi compatible custom endpoint #​8644

🔧 Improvements

• Split agent setup into staged phases to reduce startup blocking #​8746
• Extensions management migrated to ACP+ #​8733
• Harden code review skill for async state and default-resolution bugs #​8740
• Persist and reliably apply chat model selection #​8734
• Overhaul provider inventory and agent/model selection #​8652
• Consolidate provider ACP methods onto inventory #​8710
• Manage skills as sources over ACP #​8675
• Extract shared OAuth device-flow helper #​8619
• Full width assistant message in goose2 #​8760
• TUI improvements #​8736
• Goose2 agent management flows #​8737
• Sidebar polish: search copy, dividers, project reorder, DnD fixes #​8568
• Sidebar activity indicators, placeholder token, and search field refinements #​8606
• Warm shell PATH lookup during session init #​8631
• Gate perf logs and dedup build_config_update on first message #​8627
• Use default fallback provider and model if default are set #​8650
• Show individual untracked files in git changes widget #​8574
• Goose2 session working dir #​8624
• Update rmcp to 1.5.0 #​8618
• Merge goose-acp crate into goose #​8726
• Upgrade goose SDK and TUI to be compatible with the latest agentclientprotocol/sdk package #​8667
• Declare and enforce MSRV of 1.91.1 #​8670
• Pass globally unique conversation identifier as sessionId in Databricks API call #​8576
• Move agent skills to repo root for tool discoverability #​8535
• Reset ChatGPT Codex auth during OAuth setup #​8569
• Isolate gym scenario Cargo projects from parent workspace #​8640

📚 Documentation

• AGENTS.md section on goose2 desktop backend architecture #​8732
• Rendex MCP Server extension tutorial #​8541
• Blog post about Mesh LLM provider option #​8655
• Remove stale gemini-acp references #​8572
• Replace deprecated Claude ACP package links #​8625

v1.31.1

Compare Source

ossf/scorecard (ossf/scorecard)

v5.5.0

Compare Source

What's Changed

General

• The official Scorecard docker images are hosted on GitHub Container Registry starting with v5.5.0.
  Older releases will be brought over from Google Container/Artifact Registry, before being discontinued.(@​spencerschrock in #​4885)
• Scorecard will now skip checks that don't apply to the current repo type by @​JamieMagee in #​5000.
  If any checks no longer run that previously ran, and you think are supported by the underlying forge please file an issue.

Checks

Branch-Protection

• 🌱 Use rulesets if one exists when classic branch protection rule is inaccessible by @​trask in #​4853

CII-Best-Practices

• ✨ Support custom CII_Best_Practices_URL via environment variable. by @​kash2104 in #​4882

Dangerous-Workflow

• 🐛 detect toJSON(github.event) in Dangerous-Workflow check by @​heathdutton in #​4898

Contributors

• 🐛 Skip CODEOWNERS file in contributors check if there is a parsing error by @​juanis2112 in #​4851

Dependency-Update-Tool

• ✨ Removing pyup checks by @​colinosullivan-ie in #​4877

Fuzzing

• ✨ Detect .NET property-based fuzz testing by @​martincostello in #​4860

Docs

• 📖 Add Security Insights file and update maintainer affiliation by @​justaugustus in #​4863
• 📖 doc: add CDN design to repository by @​spencerschrock in #​4932
• 📖 Scorecard v6: OSPS Baseline conformance proposal and 2026 roadmap by @​justaugustus in #​4952

Other

• 🌱 cron: remove error wrapping workaround by @​alexandear in #​4864
• 🌱 deps: switch from gopkg.in/yaml.vX to go.yaml.in/yaml/vX by @​scop in #​4895
• 🌱 ci: use smaller repo for gitlab e2e tests to avoid timeouts by @​spencerschrock in #​4924
• 🌱 Bump go-github to v82 by @​Kielek in #​4923
• 🌱 ci: remove all e2e test references to gitlab.com/gitlab-org/gitlab by @​spencerschrock in #​4927
• 🌱 cron: Add ability to purge cached results from a CDN by @​spencerschrock in #​4928
• 🌱 cron: enable CDN purging in prod weekly scans by @​spencerschrock in #​4931
• 🌱 Set OSV User-Agent for scorecard cli and cron workers. by @​kash2104 in #​4883
• 🌱 Fix PR verifier by replacing deprecated Docker action by @​justaugustus in #​4972
• 🌱 e2e: add Azure DevOps tests by @​JamieMagee in #​4993
• 🌱 Fix PR template formatting by @​martincostello in #​5003
• 🌱 Add Jamie Magee as a maintainer for Azure DevOps by @​JamieMagee in #​5024

New Contributors

• @​juanis2112 made their first contribution in #​4851
• @​alexandear made their first contribution in #​4864
• @​colinosullivan-ie made their first contribution in #​4877
• @​kash2104 made their first contribution in #​4882
• @​heathdutton made their first contribution in #​4898
• @​Kielek made their first contribution in #​4923

Full Changelog: ossf/scorecard@v5.4.0...v5.5.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.