Update all dependencies

[missingcharacter]

This PR contains the following updates:

Package	Type	Update	Change
opencode	tools	major	1.18.29 → 2.0.3
python	tools	minor	3.13.15 → 3.14.7
ruby (source)	tools	patch	4.0.6 → 4.0.7
sbt	tools	patch	2.0.8 → 2.0.9
terraform	tools	minor	1.15.8 → 1.16.2
uv	tools	patch	0.12.13 → 0.12.15

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anomalyco/opencode (opencode)

v2.0.3

Compare Source

v2.0.2

Compare Source

v2.0.1

Compare Source

v2.0.0

Compare Source

v1.18.31

Compare Source

Core

Bugfixes

• Restored ACP session model, effort, mode, and reasoning chunk boundaries when loading, resuming, or forking sessions. (@​JacobNWolf)

TUI

Bugfixes

• Show remote config authentication errors during startup and exit with a failure status.

Extensions

Improvements

• Request summarized adaptive thinking for GitHub Copilot models.

Thank you to 4 community contributors:

• @​heimoshuiyu:
  • feat(console): add batch workspace block endpoints (#​48491)
• @​JacobNWolf:
  • fix(acp): restore session options and reasoning boundaries (#​48225)
• @​R-Taneja:
  • chore(deps): bump @​ai-sdk/gateway to 3.0.191 (#​48710)
• @​MatthewFeroz:
  • fix(ui): add Merge Gateway logo (#​42015)

v1.18.30

Compare Source

Core

Improvements

• Added the Astra system prompt for GPT-6 models.

Bugfixes

• Preserved Bedrock DeepSeek model IDs, including ARN-based IDs, so they resolve correctly. (@​YeEmrick)
• Updated the Azure provider SDK to pick up compatibility fixes.
• Updated the OpenAI provider SDK to pick up compatibility fixes.
• Added reasoning effort variants for supported GitLab GPT and Claude models. (@​far-ouq)

Thank you to 3 community contributors:

• @​heimoshuiyu:
  • fix(console): openai usage normalization and tier threshold config (#​47342)
• @​far-ouq:
  • fix(opencode): add GitLab reasoning variants (#​47306)
• @​YeEmrick:
  • fix: preserve Bedrock DeepSeek model ids (#​34441)

python/cpython (python)

v3.14.7

Compare Source

v3.14.6

Compare Source

v3.14.5

Compare Source

v3.14.4

Compare Source

v3.14.3

Compare Source

v3.14.2

Compare Source

v3.14.1

Compare Source

v3.14.0

Compare Source

ruby/ruby (ruby)

v4.0.7: 4.0.7

Compare Source

What's Changed

• Bug #​22188: addr2line doesn't find symbols when compiled with GCC LTO - Ruby - Ruby Issue Tracking System
• Bug #​22210: Check if issue #​19969 is still reproducible / re-opened in 4.0.x - Ruby - Ruby Issue Tracking System
• Bug #​22217: Segmentation fault when resuming execution with Coverage.start and ruby/debug - Ruby - Ruby Issue Tracking System
• Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request #​18206
• Bug #​22200: ObjectSpace._id2ref can return a different object than the id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic fields) - Ruby - Ruby Issue Tracking System
• Bug #​22123: Ruby::Box + BUNDLER_SETUP can evaluate gemspecs before main-box RubyGems initialization - Ruby - Ruby Issue Tracking System
• Bump ERB to 6.0.7 by k0kubun · Pull Request #​18282
• Bug #​22237: GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub - Ruby - Ruby Issue Tracking System
• Bug #​22243: Change fork behavior when Process._fork raises an exception during fork with a block argument - Ruby - Ruby Issue Tracking System
• Bug #​22223: Socket.tcp with connect_timeout returns a phantom "connected" socket for a refused connection on macOS 27 (kernel answers EISCONN on connect retry; SO_ERROR never consulted) - Ruby - Ruby Issue Tracking System
• Bug #​22220: Performance regression when requiring aws-sdk-ec2 in Ruby 4.0.6 - Ruby - Ruby Issue Tracking System
• Bug #​22218: Line TracePoint misses executed loop condition after a guard - Ruby - Ruby Issue Tracking System
• Bug #​22198: win32: heap overflow in Kernel#system - Ruby - Ruby Issue Tracking System
• Bug #​22196: Heap-use-after-free in fiber_switch with transfer-terminated async tasks on 3.4.10 - Ruby - Ruby Issue Tracking System
• Bug #​22190: Class#subclasses does not include clones of classes that include modules - Ruby - Ruby Issue Tracking System
• Bug #​11438: native_thread_init_stack() get machine.stack_start unequal to thread's stack start address, x86 win32 - Ruby - Ruby Issue Tracking System
• Bug #​22257: Prepending a module to an already-included module leaves stale super caches - Ruby - Ruby Issue Tracking System
• Bug #​22242: SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg / def_iseq_ptr) on Ruby 4.0.6 — Rails CI - Ruby - Ruby Issue Tracking System
• Bug #​22269: Coverage.line_stub clobbers already-collected coverage data - Ruby - Ruby Issue Tracking System
• Bug #​22290: Adding instance variables to anonymous object may bloat all future classes - Ruby - Ruby Issue Tracking System
• Bug #​22292: YJIT/ZJIT: Struct accessor crashes after an instance variable is set on a Struct that exactly fills the largest GC slot - Ruby - Ruby Issue Tracking System
• Bug #​20958: fix ENV.keys encoding on windows - Ruby - Ruby Issue Tracking System
• Bug #​22259: Arrays sharding a buffer segfault when concatenating with each other - Ruby - Ruby Issue Tracking System
• Bug #​22264: Warning missing from parse.y hash literals - Ruby - Ruby Issue Tracking System
• Bug #​22303: EncodingError from interpolating symbol crashes whole process - Ruby - Ruby Issue Tracking System
• Bug #​22224: YJIT: rb_yjit_invalidate_ep_is_bp takes the VM lock stopping Ractors on every Proc materialization; multi-Ractor throughput collapses (up to ~150x) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

sbt/sbt (sbt)

v2.0.9: 2.0.9

Compare Source

🐛 bug fixes

• fix: Fixes AccessDeniedException on Windows by creating JAR in situ by @​eed3si9n in sbt/io#558
• fix: Fixes unhermetic semanticdbTargetRoot in the compile cache key by @​christianharrington in #​9711
• fix: Fixes pipelined build with Java sources by @​anatoliykmetyuk in #​9574
• fix: Keep macro subprojects off the pipelined classpath by @​stasimus in #​9719
• fix: Fixes sbt runner script not starting on openSUSE by @​alexasl in #​9753
• Update to sbtn 2.1.0-M1 #​9755

Full Changelog: sbt/sbt@v2.0.8...v2.0.9

hashicorp/terraform (terraform)

v1.16.2

Compare Source

1.16.2 (September 9, 2026)

BUG FIXES:

• Fix panic in module installation when encoutering invalid module calls (#​39129)

v1.16.1

Compare Source

1.16.1 (September 2, 2026)

BUG FIXES:

• cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations (#​38751)

• Support referencing modules containing dynamic sources in Terraform Test (#​38950)

• stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. (#​38829)

• Fix panic when import identity references sensitive value (#​39013)

• import: Fixed a bug where import blocks would be ignored when multiple imports targeted different instances of a resource config using for_each or count. (#​39068)

• state show: Fix a panic when given an attribute path instead of a resource instance address (#​39087)

• Fix create_before_destroy ordering in some combinations of changes (#​39091)

v1.16.0

Compare Source

1.16.0 (August 26, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#​37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#​38298)

• Providers can now use nested blocks as computed values (#​38305)

• import: import blocks inside modules are now supported. (#​38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#​38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#​38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#​23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#​38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#​38449)

• stacks: Action configurations now have access to a caller symbol containing the object value of the calling resource. (#​38668)

• Actions can now use before_destroy and after_destroy events. (#​38668)

• cloud: Terraform now displays a summary of policy evaluation outcomes for plan and apply runs against HCP Terraform. (#​38715)

• policy: Terraform now resolves policy plugin credentials from the configured cloud or remote backend during init, plan, and apply, rather than requiring the plugin to read credentials itself. (#​38716)

• graph: The terraform graph command can now output graphs in Mermaid format using the -format=mermaid flag. (#​38719)

• Child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#​38778)

• Resource lifecycle blocks now support destroy = false to prevent a resource from being destroyed. (#​38784)

• The contains() function can now test for null values. (#​38792)

• console: The terraform console command now accepts an optional -scope=<module address> flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#​31861)

• -invoke can now be combined with -target to specify the calling resource instance when multiple resources trigger the same action. (#​38845)

• The terraform stacks command now automatically infers the target hostname from the local credentials file (credentials.tfrc.json) when neither TF_STACKS_HOSTNAME nor TF_CLOUD_HOSTNAME is set (#​38896)

BUG FIXES:

• import blocks now correctly respect provider local names. (#​38338)

• terraform apply no longer panics when the plan contains a no-op change for a deposed resource that has lifecycle.precondition or lifecycle.postcondition blocks. (#​38586)

• workspace: Terraform now raises an error if an invalid workspace name becomes selected due to out-of-band changes. (#​38594)

• test: Terraform now raises a warning when a file referenced via the -filter flag does not exist. (#​38603)

• init: Terraform no longer removes locks from the dependency lock file for providers configured as dev_override. (#​38634)

• init: Terraform now warns when unmanaged providers are in use and may impact provider installation. (#​38656)

• Actions are now invoked with respect to all resource dependencies. (#​38668)

• Terraform now returns the correct error when an import target exists in state but has no corresponding configuration. (#​38782)

• The merge() function no longer panics when passed null objects. (#​38792)

• Allow underscores in provider source address namespaces, so private registry provider addresses are no longer rejected as invalid (#​38894)

• test: Optional ephemeral values do not have to be set at plan time (#​38974)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#​38561)

UPGRADE NOTES:

• bastion_host_key is now correctly applied by provisioners. Review your provisioner configurations to verify the configured key is correct before upgrading. (#​38318)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.15.9

Compare Source

1.15.9 (August 19, 2026)

BUG FIXES:

• validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#​38994)

NOTES:

• Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#​39036)

astral-sh/uv (uv)

v0.12.15

Compare Source

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
uv pip install --system in python:* docker images or when using uv pip install --target .. (#​21699)

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#​21675)

Bug fixes

• Revert "Reject symlinked wheel installation destinations" (#​21699)

v0.12.14

Compare Source

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. (#​17110, #​21599, #​21603)

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. (#​17110)

Enhancements

• Resume interrupted downloads with HTTP Range requests when supported (#​21570)
• Show underlying causes and hints in user warnings (#​21565)
• Show resolver hints for failed uv tool upgrade operations (#​21566)

Preview features

• Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#​21618)

Performance

• Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#​21619)
• Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#​21593)
• Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#​21621)

Bug fixes

• Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#​21672)
• Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#​21625)
• Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#​21639)
• Redact credentials and signatures from missing-path-segment URL errors (#​21616)
• Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#​21640)
• Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#​21559)
• Suppress managed-Python fallback warnings under --quiet (#​21565)
• Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#​21566)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.