build(deps): bump anomalyco/opencode/github from 1.17.19 to 1.18.15

[dependabot]

Bumps anomalyco/opencode/github from 1.17.19 to 1.18.15.

Release notes

Sourced from anomalyco/opencode/github's releases.

v1.18.15

Core

Bugfixes

• Chronological message ordering now stays correct even when imported or legacy message IDs are out of order.
• Revert and fork actions now use real message chronology instead of message ID ordering.
• Truncation cleanup now removes stale files by file timestamp more reliably.
• Repeated compaction now keeps earlier tool-call history in summaries instead of dropping orphaned results.
• Blob-based attachments now load correctly in the web UI. (@​rexdotsh)

Desktop

Improvements

• Added much broader locale coverage across the desktop app.
• Export full session transcripts as JSON from the UI.

Bugfixes

• Session timelines now respect chronological message boundaries more reliably.
• Stored messages now stay ordered by creation time.
• Session lists now sort by persisted activity time more reliably.
• Language names now stay native in the locale picker.
• Filled in missing translations across existing locales.

Thank you to 3 community contributors:

• @​rexdotsh:
  • fix(server): allow blob attachments in web UI (#40692)
• @​ayubun:
  • fix(tui): support copying over ssh with set-clipboard on tmux config (#30472)
• @​dangooddd:
  • feat(tui): add cursor style configuration (#32295)

v1.18.14

Core

Improvements

• Simplified xAI login to a single device-code flow that works better in headless and remote environments.

Bugfixes

• Preserved structured mid-stream provider errors so compatible providers can retry failed responses.
• Retried more transient provider and network errors instead of failing immediately.
• Counted cache writes in ACP usage totals.
• Logged remote workspace 5xx response bodies in the host logs to make proxy failures easier to debug. (@​jamesmurdza)
• Stopped sending the host directory path to remote workspaces so prompts resolve from the remote project root. (@​jamesmurdza)
• Waited for queued ACP session updates before ending a turn.

... (truncated)

Commits

• d7b115f release: v1.18.15
• 3255297 sync
• 741244b feat(app): add global locale coverage (#40992)
• 4abddbb feat(go): promote DeepSeek V4 Flash usage (#40988)
• 5aa5cb3 fix(app): use chronological message boundaries (#41006)
• 9113255 fix(app): order stored messages by creation time (#41001)
• 23cc677 fix(tui): order messages by creation time (#40994)
• 28bcc0e fix(app): sort sessions by persisted time (#41000)
• 8bf5062 feat(tui): add cursor style configuration (#32295)
• 20750c3 fix(web): order shared messages by creation time (#40995)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

[afonsoft]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Both workflows pinned to same new SHA consistently

The bump updates the pinned commit SHA and the version comment consistently in both .github/workflows/opencode.yml:35 and .github/workflows/opencode-auto-fix.yml:28; no other reference to the old SHA remains in the repo. Inputs (model, agent, use_github_token, prompt) are unchanged — worth confirming these input names are still supported in v1.18.x, since a minor bump of an action can rename/deprecate inputs and GitHub Actions silently ignores unknown with: keys for JS/composite actions rather than failing.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Qodana Community for .NET

10 new problems were found

Inspection name	Severity	Problems
Access to a static member of a type via a derived type	🔶 Warning	4
Local variable hides member	🔶 Warning	4
Member can be made private: Non-private accessibility	◽️ Notice	2

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.1.3
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[dependabot]

Superseded by #115.