chore(deps): bump the minor-patch group in /supervisor/tauri/src-tauri with 3 updates

[dependabot]

Bumps the minor-patch group in /supervisor/tauri/src-tauri with 3 updates: tauri-plugin-updater, tauri-plugin-shell and tokio.

Updates tauri-plugin-updater from 2.13.1 to 2.13.2

Release notes

Sourced from tauri-plugin-updater's releases.

updater-js v2.13.2

[2.13.2]

• 2a9c29e0 (#3578 by @​alii13) On macOS, a failed install no longer deletes the installed app. The bundles are swapped atomically where the file system supports it; otherwise the previous app is restored, or kept as <name> (previous version).app and reported through the new Error::PreviousAppNotRestored. Also fixes installing apps on a volume other than the temp directory's, and the bundle root's permissions (0755).

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.2
npm notice filename: tauri-apps-plugin-updater-2.13.2.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: d23b7a261022dee1fb74da3e29540a0e49c6ed3b
npm notice integrity: sha512-ekGlOBis1gztz[...]ShdQczCM50SZQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3135040742
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.2

updater v2.13.2

[2.13.2]

• 2a9c29e0 (#3578 by @​alii13) On macOS, a failed install no longer deletes the installed app. The bundles are swapped atomically where the file system supports it; otherwise the previous app is restored, or kept as <name> (previous version).app and reported through the new Error::PreviousAppNotRestored. Also fixes installing apps on a volume other than the temp directory's, and the bundle root's permissions (0755).

... (truncated)

Commits

• 7eb8246 publish new versions (#3673)
• 65ce65b fix(ci): Android e2e flakes, shell Terminated sent before output (#3672)
• cbd691b chore(examples): update Android project for API example
• 974bbdc publish new versions (#3667)
• 3113a54 chore(deps): update urlpattern to 0.6 (#3670)
• b443d6b fix(http): release the request's resources once fetch_send settles (#3669)
• 2a9c29e fix(updater): restore the current app when a macOS install fails (fix #3505, ...
• d4835d0 publish new versions (#3660)
• 569ee82 fix: mobile docs.rs builds
• 25f3874 chore(deps): update dependency eslint-plugin-security to v4.1.0 (#3661)
• Additional commits viewable in compare view

Updates tauri-plugin-shell from 2.4.0 to 2.4.1

Release notes

Sourced from tauri-plugin-shell's releases.

geolocation-js v2.4.1

[2.4.1]

• 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-geolocation@2.4.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.8kB README.md
npm notice 3.9kB dist-js/index.cjs
npm notice 6.3kB dist-js/index.d.ts
npm notice 3.7kB dist-js/index.js
npm notice 662B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-geolocation
npm notice version: 2.4.1
npm notice filename: tauri-apps-plugin-geolocation-2.4.1.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 20.2 kB
npm notice shasum: 0113f207fe25a8779e5d4d31e789ffa7397532f2
npm notice integrity: sha512-XYZwcB8Azz9dJ[...]oOVoNEnUDxoDA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3028122996
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-geolocation@2.4.1

geolocation v2.4.1

[2.4.1]

• 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.

... (truncated)

Commits

• d66aa6f publish new versions (#2822)
• 6f34587 fix(single-instance): disable dbus name replacement (#2860)
• 708fa4e chore(deps): update dependency eslint-config-prettier to v10.1.8 (#2858)
• b729203 fix(upload): fix download() locks main thread on Android (#2838)
• 2f9c71a chore(deps): update dependency rollup to v4.45.1 (#2850)
• 80d4d8e chore(deps): update eslint monorepo to v9.31.0 (v2) (#2839)
• e7a98b0 chore(deps): update dependency typescript-eslint to v8.37.0 (#2848)
• 44a1f65 fix(fs): writeFile create file by default (#2846)
• 6210cd3 chore(deps): update dependency rollup to v4.45.0 (#2841)
• 467f07b chore(deps): update dependency vite to v7 (v2) (#2800)
• Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[agentautofix-fixer]

AgentAutofix AI Review

claude

PASSED

No findings.

codex

PASSED

No findings.

agy

advisory -- not part of the gate decision

INFRA FAILURE: reviewer CLI reported quota exhaustion

Result: Both AI reviewers passed

Reviewer models (requested pin, not independently confirmed):

• claude: claude-haiku-4-5-20251001 (requested pin, not independently confirmed)
• codex: gpt-5.5 (requested pin, not independently confirmed)