Update all dependencies

[missingcharacter]

This PR contains the following updates:

Package	Type	Update	Change
python	tools	minor	3.13.15 → 3.14.7
rclone	tools	patch	1.75.0 → 1.75.1
rust (source, changelog)	tools	patch	1.98.0 → 1.98.1
terraform	tools	minor	1.15.8 → 1.16.1
uv	tools	patch	0.12.9 → 0.12.10

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

python/cpython (python)

v3.14.7

Compare Source

v3.14.6

Compare Source

v3.14.5

Compare Source

v3.14.4

Compare Source

v3.14.3

Compare Source

v3.14.2

Compare Source

v3.14.1

Compare Source

v3.14.0

Compare Source

rclone/rclone (rclone)

v1.75.1: rclone v1.75.1

Compare Source

This is the v1.75.1 release of rclone.

Full details of the changes can be found in the changelog.

rust-lang/rust (rust)

v1.98.1

Compare Source

===========================

• rustc: fix miscompilation in generating vtables

hashicorp/terraform (terraform)

v1.16.1

Compare Source

1.16.1 (September 2, 2026)

BUG FIXES:

• cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations (#​38751)

• Support referencing modules containing dynamic sources in Terraform Test (#​38950)

• stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. (#​38829)

• Fix panic when import identity references sensitive value (#​39013)

• import: Fixed a bug where import blocks would be ignored when multiple imports targeted different instances of a resource config using for_each or count. (#​39068)

• state show: Fix a panic when given an attribute path instead of a resource instance address (#​39087)

• Fix create_before_destroy ordering in some combinations of changes (#​39091)

v1.16.0

Compare Source

1.16.0 (August 26, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#​37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#​38298)

• Providers can now use nested blocks as computed values (#​38305)

• import: import blocks inside modules are now supported. (#​38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#​38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#​38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#​23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#​38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#​38449)

• stacks: Action configurations now have access to a caller symbol containing the object value of the calling resource. (#​38668)

• Actions can now use before_destroy and after_destroy events. (#​38668)

• cloud: Terraform now displays a summary of policy evaluation outcomes for plan and apply runs against HCP Terraform. (#​38715)

• policy: Terraform now resolves policy plugin credentials from the configured cloud or remote backend during init, plan, and apply, rather than requiring the plugin to read credentials itself. (#​38716)

• graph: The terraform graph command can now output graphs in Mermaid format using the -format=mermaid flag. (#​38719)

• Child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#​38778)

• Resource lifecycle blocks now support destroy = false to prevent a resource from being destroyed. (#​38784)

• The contains() function can now test for null values. (#​38792)

• console: The terraform console command now accepts an optional -scope=<module address> flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#​31861)

• -invoke can now be combined with -target to specify the calling resource instance when multiple resources trigger the same action. (#​38845)

• The terraform stacks command now automatically infers the target hostname from the local credentials file (credentials.tfrc.json) when neither TF_STACKS_HOSTNAME nor TF_CLOUD_HOSTNAME is set (#​38896)

BUG FIXES:

• import blocks now correctly respect provider local names. (#​38338)

• terraform apply no longer panics when the plan contains a no-op change for a deposed resource that has lifecycle.precondition or lifecycle.postcondition blocks. (#​38586)

• workspace: Terraform now raises an error if an invalid workspace name becomes selected due to out-of-band changes. (#​38594)

• test: Terraform now raises a warning when a file referenced via the -filter flag does not exist. (#​38603)

• init: Terraform no longer removes locks from the dependency lock file for providers configured as dev_override. (#​38634)

• init: Terraform now warns when unmanaged providers are in use and may impact provider installation. (#​38656)

• Actions are now invoked with respect to all resource dependencies. (#​38668)

• Terraform now returns the correct error when an import target exists in state but has no corresponding configuration. (#​38782)

• The merge() function no longer panics when passed null objects. (#​38792)

• Allow underscores in provider source address namespaces, so private registry provider addresses are no longer rejected as invalid (#​38894)

• test: Optional ephemeral values do not have to be set at plan time (#​38974)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#​38561)

UPGRADE NOTES:

• bastion_host_key is now correctly applied by provisioners. Review your provisioner configurations to verify the configured key is correct before upgrading. (#​38318)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.15.9

Compare Source

1.15.9 (August 19, 2026)

BUG FIXES:

• validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#​38994)

NOTES:

• Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#​39036)

astral-sh/uv (uv)

v0.12.10

Compare Source

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#​21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#​21455)
• Show terminal dependency cycles in uv tree --invert output (#​21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#​21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#​21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#​21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#​19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#​21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#​21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#​21453)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.