fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
aqua:astral-sh/uv	tools	patch	0.12.16 → 0.12.17
aqua:aws/aws-cli	tools	patch	2.36.48 → 2.36.49
aqua:opentofu/opentofu	tools	patch	1.12.5 → 1.12.6
pi-subagents	dependencies	minor	0.68.0 → 0.69.0
pipx:ansible-core	tools	patch	2.21.2 → 2.21.4
typebox	dependencies	patch	1.3.33 → 1.3.34

---

Release Notes

astral-sh/uv (aqua:astral-sh/uv)

v0.12.17

Compare Source

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#​21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#​21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#​20746)
• Keep uv workspace metadata read-only unless --sync is provided (#​21821)
• Apply uv check lock modes when retrieving workspace metadata (#​21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#​21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#​21810)

Bug fixes

• Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#​21825)

Documentation

• Clarify the 0.12.14 and 0.12.15 release notes (#​21817)

aws/aws-cli (aqua:aws/aws-cli)

v2.36.49

Compare Source

opentofu/opentofu (aqua:opentofu/opentofu)

v1.12.6

Compare Source

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#​4422)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#​4472)

Full Changelog: opentofu/opentofu@v1.12.5...v1.12.6

nicobailon/pi-subagents (pi-subagents)

v0.69.0

Compare Source

Highlights

• Gates can now return a JSON verdict. Point gate at a script that prints JSON, and its output becomes the child's structured output, so workflows can branch on a post-run check without the parent reading the child's report.
• Ghostty detection no longer misfires inside terminals like cmux that embed Ghostty, so you stop seeing AppleScript -1728/-2741 errors or the wrong window being targeted.
• Hosts without npm start up quietly instead of printing npm: command not found.

Added

• Typed gates: gate accepts { command, output: "json", schema?, timeoutMs? } alongside the plain string form. When the command passes, its JSON stdout becomes the child's structuredOutput (validated against schema when given). Empty, truncated, or invalid output fails the gate rather than silently dropping the verdict. Typed gates always run (they are never cached), and a run cannot combine one with an outputSchema. See docs/ for using command-runner agents as typed workflow steps and examples/typed-gate for a runnable example.

Fixed

• The Ghostty inspector only activates when the macOS host bundle id identifies the standalone Ghostty app. Terminals that embed Ghostty (such as cmux) set TERM_PROGRAM=ghostty too, which previously targeted an unrelated Ghostty window or emitted -1728/-2741 AppleScript errors; those hosts now fall back to the inspector.command hint. Thanks to @​wangpi26 for #​2281.
• Hosts without npm no longer print /bin/sh: npm: command not found during startup; global package-root discovery is optional and now stays silent when the package manager is missing. Thanks to @​PhrZer for #​2287.
• Fixed docs/tool-reference.md, which claimed a default maxOutput cap of 200 KB / 5,000 lines. The cap applies only when maxOutput is set.

sinclairzx81/typebox (typebox)

v1.3.34

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.