Skip to content

chore(deps): update docker#132

Open
bootc-bot[bot] wants to merge 1 commit intomainfrom
bootc-renovate/docker
Open

chore(deps): update docker#132
bootc-bot[bot] wants to merge 1 commit intomainfrom
bootc-renovate/docker

Conversation

@bootc-bot
Copy link
Contributor

@bootc-bot bootc-bot bot commented Mar 8, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
astral-sh/uv patch 0.10.2 → 0.10.9
nushell/nushell minor 0.110.0 → 0.111.0
ossf/scorecard minor v5.1.1 → v5.4.0
rust-nightly patch nightly-2026-03-02 → nightly-2026-03-08

Release Notes

astral-sh/uv (astral-sh/uv)

v0.10.9

Compare Source

Released on 2026-03-06.

Enhancements
  • Add fbgemm-gpu, fbgemm-gpu-genai, torchrec, and torchtune to the PyTorch list (#​18338)
  • Add torchcodec to PyTorch List (#​18336)
  • Log the duration we took before erroring (#​18231)
  • Warn when using uv_build settings without uv_build (#​15750)
  • Add fallback to /usr/lib/os-release on Linux system lookup failure (#​18349)
  • Use cargo auditable to include SBOM in uv builds (#​18276)
Configuration
  • Add an environment variable for UV_VENV_RELOCATABLE (#​18331)
Performance
  • Avoid toml Document overhead (#​18306)
  • Use a single global workspace cache (#​18307)
Bug fixes
  • Continue on trampoline job assignment failures (#​18291)
  • Handle the hard link limit gracefully instead of failing (#​17699)
  • Respect build constraints for workspace members (#​18350)
  • Revalidate editables and other dependencies in scripts (#​18328)
  • Support Python 3.13+ on Android (#​18301)
  • Support cp3-none-any (#​17064)
  • Skip tool environments with broken links to Python on Windows (#​17176)
Documentation
  • Add documentation for common marker values (#​18327)
  • Improve documentation on virtual dependencies (#​18346)

v0.10.8

Compare Source

Released on 2026-03-03.

Python
  • Add CPython 3.10.20
  • Add CPython 3.11.15
  • Add CPython 3.12.13
Enhancements
  • Add Docker images based on Docker Hardened Images (#​18247)
  • Add resolver hint when --exclude-newer filters out all versions of a package (#​18217)
  • Configure a real retry minimum delay of 1s (#​18201)
  • Expand uv_build direct build compatibility (#​17902)
  • Fetch CPython from an Astral mirror by default (#​18207)
  • Download uv releases from an Astral mirror in installers by default (#​18191)
  • Add SBOM attestations to Docker images (#​18252)
  • Improve hint for installing meson-python when missing as build backend (#​15826)
Configuration
  • Add UV_INIT_BARE environment variable for uv init (#​18210)
Bug fixes
  • Prevent uv tool upgrade from installing excluded dependencies (#​18022)
  • Promote authentication policy when saving tool receipts (#​18246)
  • Respect exclusions in scripts (#​18269)
  • Retain default-branch Git SHAs in pylock.toml files (#​18227)
  • Skip installed Python check for URL dependencies (#​18211)
  • Respect constraints during --upgrade (#​18226)
  • Fix uv tree orphaned roots and premature deduplication (#​17212)
Documentation
  • Mention cooldown and tweak inline script metadata in dependency bots documentation (#​18230)
  • Move cache prune in GitLab to after_script (#​18206)

v0.10.7

Compare Source

Released on 2026-02-27.

Bug fixes
  • Fix handling of junctions in Windows Containers on Windows (#​18192)
Enhancements
  • Activate logging for middleware retries (#​18200)
  • Upload uv releases to a mirror (#​18159)

v0.10.6

Compare Source

Released on 2026-02-24.

Bug fixes
  • Apply lockfile marker normalization for fork markers (#​18116)
  • Fix Python version selection for scripts with a requires-python conflicting with .python-version (#​18097)
  • Preserve file permissions when using reflinks on Linux (#​18187)
Documentation
  • Remove verbose documentation from optional dependencies help text (#​18180)

v0.10.5

Compare Source

Released on 2026-02-23.

Enhancements
  • Add hint when named index is found in a parent config file (#​18087)
  • Add warning for uv lock --frozen (#​17859)
  • Attempt to use reflinks by default on Linux (#​18117)
  • Fallback to hardlinks after reflink failure before copying (#​18104)
  • Filter pylock.toml wheels by tags and requires-python (#​18081)
  • Validate wheel filenames are normalized during uv publish (#​17783)
  • Fix message when exclude-newer invalidates the lock file (#​18100)
  • Change the missing files log level to debug (#​18075)
Performance
  • Improve performance of repeated conflicts with an extra (#​18094)
Bug fixes
  • Fix --no-emit-workspace with --all-packages on single-member workspaces (#​18098)
  • Fix UV_NO_DEFAULT_GROUPS rejecting truthy values like 1 (#​18057)
  • Fix iOS detection (#​17973)
  • Propagate project-level conflicts to package extras (#​18096)
  • Use a global build concurrency semaphore (#​18054)
Documentation
  • Update documentation heading for environment variable files (#​18122)
  • Fix comment about uv export formats (#​17900)
  • Make it clear that Windows is supported in user- and system- level configuration docs (#​18106)

v0.10.4

Compare Source

Released on 2026-02-17.

Enhancements
  • Remove duplicate references to the affected paths when showing uv python errors (#​18008)
  • Skip discovery of workspace members that contain only git-ignored files, including in sub-directories (#​18051)
Bug fixes
  • Don't panic when initialising a package at the filesystem root (e.g. uv init / --name foo) (#​17983)
  • Fix permissions on wheel and sdist files produced by the uv_build build backend (#​18020)
  • Revert locked file change to fix locked files on NFS mounts (#​18071)

v0.10.3

Compare Source

Released on 2026-02-16.

Python
  • Add CPython 3.15.0a6
Enhancements
  • Don't open file locks for writing (#​17956)
  • Make Windows trampoline error messages consistent with uv proper (#​17969)
  • Log which preview features are enabled (#​17968)
Preview features
  • Add support for ruff version constraints and exclude-newer in uv format (#​17651)
  • Fix script path handling when target-workspace-discovery is enabled (#​17965)
  • Use version constraints to select the default ruff version used by uv format (#​17977)
Bug fixes
  • Avoid matching managed Python versions by prefixes, e.g. don't match CPython 3.10 when cpython-3.1 is specified (#​17972)
  • Fix handling of --allow-existing with minor version links on Windows (#​17978)
  • Fix panic when encountering unmanaged workspace members (#​17974)
  • Improve accuracy of request timing (#​18007)
  • Reject u64::MAX in version segments to prevent overflow (#​17985)
Documentation
  • Reference Debian Trixie instead of Bookworm (#​17991)
nushell/nushell (nushell/nushell)

v0.111.0

Compare Source

This is the 0.111.0 release of Nushell. You can learn more about this release here: https://www.nushell.sh/blog/2026-02-28-nushell_v0_111_0.html

For convenience, we are providing full builds for Windows, Linux, and macOS. Be sure you have the requirements to enable all capabilities: https://www.nushell.sh/book/installation.html#dependencies

This release was made possible by PR contributions from @​132ikl, @​Ady0333, @​amaanq, @​andrewgazelka, @​app/dependabot, @​astral-l, @​ayax79, @​Bahex, @​benblank, @​blindFS, @​BluewyDiamond, @​cablehead, @​ChrisDenton, @​cptpiepmatz, @​cuiweixie, @​evolvomind, @​fdncred, @​fennewald, @​fmotalleb, @​hovancik, @​hustcer, @​InnocentZero, @​it-education-md, @​jlcrochet, @​Juhan280, @​kaathewisegit, @​KaiSforza, @​maxim-uvarov, @​monigarr, @​moooooji, @​NotTheDr01ds, @​pickx, @​pyz4, @​sgvictorino, @​smartcoder0777, @​stuartcarnie, @​teddygood, @​veeceey, @​weirdan, @​WindSoilder, @​ysthakur

ossf/scorecard (ossf/scorecard)

v5.4.0

Compare Source

What's Changed
General
  • ✨ Added CLI flags to scan multiple repositories --repos, or an entire GitHub organization --org (#​4793, @​gabrielsoltz)
Checks
Branch-Protection
  • 🐛 Fix branch-protection scoring so GitHub rulesets without include patterns are honored, eliminating false warnings for branches covered by those rulesets. (#​4835, @​trask)
Codeowners
Pinned-Dependencies
Vulnerabilities
Docs
Other
New Contributors

Full Changelog: ossf/scorecard@v5.3.0...v5.4.0

v5.3.0

Compare Source

What's Changed
General
  • 🐛 Scorecard now skips dangling symlinks and detects symlink path traversal when run on local files. Note: Scorecard has always skipped all symlinks when run against a remote repository. (#​4785, @​spencerschrock)
  • ✨ The scorecard serve command was refactored and fixed. It accepts HTTP requests, analyzes the repo, and returns the result over HTTP. by @​Fix3dP0int in #​4665
scorecard serve # will start serving on localhost:8080
curl http://localhost:8080?repo=github.com/ossf/scorecard&show_details=true
{"date":"2025-09-30T09:08:38-06:00","repo":{"name":"github.com/ossf/scorecard","commit":"c22063e786c11f9dd714d777a687ff7c4599b600"},"scorecard":{"version":"devel","commit":"unknown"},"score":9.5 # rest omitted
Checks
Branch-Protection
  • 🐛 Prevent ListReleases from failing a run for forges which don't support the operation (#​4677, @​JamieMagee)
  • 🐛 Skip tag-only rulesets during Branch-Protection by @​trask in #​4699
Contributors
  • 🐛 Fixed a nil pointer dereference in the Contributors check for GitHub repos analyzed with --file-mode=git (#​4705, @​spencerschrock)
Dangerous-Workflow
Fuzzing
Packaging
Pinned-Dependencies
SAST
Signed-Releases
Security-Policy
Token-Permissions
Docs
Other
New Contributors

Full Changelog: ossf/scorecard@v5.2.1...v5.3.0

v5.2.1

Compare Source

What's Changed
Checks
Pinned-Dependencies
Maintained
New Contributors

Full Changelog: ossf/scorecard@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed
General
Checks
CI-Tests
Contributors
  • ✨ Users listed in CODEOWNERS file in GitHub repos now contribute to Contributors check (#​4611, @​lharrison13)
SAST
Probes
  • ✨ Added independent probe that checks for ecosystem specific non-memory safety practices in the codebase and flags them. (#​4499, @​balteravishay)
Documentation
New Contributors

Configuration

📅 Schedule: Branch creation - "on sunday" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@bootc-bot bootc-bot bot force-pushed the bootc-renovate/docker branch 12 times, most recently from e3303d0 to 7d6af81 Compare March 9, 2026 15:30
@bootc-bot
chore(deps): update docker
bc8084c 
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/docker branch from 7d6af81 to bc8084c Compare March 9, 2026 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants