Update all minor and patch updates

[pyck-renovate]

This PR contains the following updates:

Package	Update	Change	Pending
anomalyco/opencode	patch	1.18.25 → 1.18.26	v1.18.28 (+1)
astral-sh/uv	patch	0.12.8 → 0.12.9

---

Release Notes

anomalyco/opencode (anomalyco/opencode)

v1.18.26

Compare Source

Core

Bugfixes

• Claude 5 sessions now tolerate stale thinking blocks instead of failing after prompt or tool changes.
• Bedrock GPT-5.6 models now accept none reasoning effort.
• Bedrock reasoning and replay handling is more reliable. (@​pengzh1)
• Tool call timing now stays accurate when tools update their metadata while still running. (@​bartlettroscoe)
• apply_patch no longer emits an empty move path in permission metadata. (@​altendky)

Improvements

• Azure CLI sign-in now asks for the resource name directly instead of querying Azure management APIs.

Desktop

Bugfixes

• Session renames now save reliably from the title editor and tab context menu.

Thank you to 3 community contributors:

• @​altendky:
  • fix(opencode): omit empty apply patch move path (#​45329)
• @​pengzh1:
  • fix(core): bump @​ai-sdk/amazon-bedrock to 4.0.166 for reasoning and replay fixes (#​45520)
• @​bartlettroscoe:
  • fix(core): Fix for incorrect time.start reset in tool call logging (#​32574) (#​32596)

astral-sh/uv (astral-sh/uv)

v0.12.9

Compare Source

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#​21413, #​21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
• Report the exact command-line lock-mode flag in warnings and errors (#​21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 9am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.