chore(deps): update 3 dependencies (uv, Moshi, Docker)

[github-actions]

Update 3 pinned dependencies in versions.

Merging this PR triggers the image publish workflow on main. Existing pods are not restarted by this updater.

Dependency	Current	Proposed	Change	Source
uv	0.12.23	0.12.24	patch	Upstream
Moshi	0.4.21	0.4.23	patch	Upstream
Docker	29.8.2	29.9.0	minor	Upstream

Review

• Check upstream notes for compatibility changes and required configuration.
• Confirm the proposed versions, then merge when ready.
• Check the image publish result after merging.

Version lookup succeeded. The proposed image has not been built or validated by this updater.

Release notes

Upstream notes are reproduced without AI rewriting. Missing notes and lookup limits are marked below.

uv: 0.12.23 → 0.12.24

Upstream source

0.12.24: ## Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#22171)
• Accept PEP 508 marker operators directly before grouped expressions (#22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#22362)
• Identify the invalid source URL in Python mirror errors (#22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)

Configuration

• Support custom installation mirrors for GraalPy (#22269)
• Support custom installation mirrors for Pyodide (#22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#22144)
• Reduce Python download error formatting code size by sharing its formatter (#22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#22291)
• Allow uv auth login over IPv6 loopback addresses (#22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#22280)
• Preserve trailing spaces and tabs in passwords returned by subp

Notes are truncated. See the upstream source for the full text.

Moshi: 0.4.21 → 0.4.23

Upstream source

0.4.23: Release notes unavailable; inspect source link.
https://cdn.getmoshi.app/hook/latest/version.txt

Docker: 29.8.2 → 29.9.0

Upstream source

29.9.0: ## 29.9.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.9.0 milestone
• moby/moby, 29.9.0 milestone

Security

The Go runtime update fixes the following security vulnerabilities in Docker Engine:

• CVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867
• CVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857
• CVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743
• CVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742
• CVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739

The golang.org/x/net update to v0.60.0 applies the same HTTP/2 fixes to the deprecated /grpc endpoint and to the gRPC server that BuildKit runs for frontend containers, such as images referenced by a # syntax= directive.

Bug fixes and enhancements

• containerd image store: Add the lazy-pull daemon feature to control whether docker pull skips downloading layer content that the snapshotter already provides. Lazy pulls are enabled by default for known remote snapshotters (nydus, overlaybd, soci, stargz). moby/moby#53877
• containerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615
• Fix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid name length. moby/moby#53484
• Fix a connection leak to the RootlessKit API socket on every GET /version request in rootless mode. moby/moby#53836
• Improve Windows service registration and unregistration cleanup, including making service unregistration (--unregister-service) idempotent. moby/moby#53845

Packaging updates

• Update BuildKit to v0.34.0. moby/moby#53882
• Update Go runtime to 1.26.9. docker/cli#7363
• Update containerd (static binaries) to v2.4.1. moby/moby#53773

Networking

• Allow IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching the existing IPv4 behaviour. moby/moby#53723
• Fix docker ps and GET /containers/json omitting published ports for networks using routed gateway mode. moby/moby#53693
• Fix a bug where a restarted daemon could be dropped from a peer's service discovery and load balancing until it rejoined the gossip cluster. moby/moby#53688
• Fix a published port being unreachable from another containe

Notes are truncated. See the upstream source for the full text.

Update policy and provenance

• Only versions changes. Major upgrades and prereleases are excluded.
• Runtime and kubectl minor series remain pinned; devcontainers and VS Code CLI use fixed commits.
• Agent entries set to latest stay unchanged and are reinstalled by their image build stages.
• Source lookup failures prevent partial updates. This updater never merges or deploys.

Inputs outside this update:

• apt packages and transitive dependencies.
• PHP helper scripts fetched from master and Node signing keys fetched from main.
• runtime dotfiles, extensions and persistent tool directories.

Base: 5326529

Run: GitHub Actions