[dependabot]

Bumps the cargo-dependencies group with 8 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
tauri	2.11.5	2.12.3
tauri-plugin-dialog	2.7.2	2.8.2
tauri-plugin-updater	2.10.1	2.13.3
tauri-build	2.6.3	2.7.3
libc	0.2.189	0.2.190
rustix	1.1.4	1.1.5
rusqlite	0.40.1	0.40.2

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates tauri from 2.11.5 to 2.12.3

Release notes

Sourced from tauri's releases.

tauri v2.12.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1296 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1092 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste

Version:   1.0.15

Warning:   unmaintained

Title:     paste - no longer maintained

Date:      2024-10-07

ID:        RUSTSEC-2024-0436

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustls-pemfile

Version:   2.2.0

Warning:   unmaintained

Title:     rustls-pemfile is unmaintained

Date:      2025-11-28

ID:        RUSTSEC-2025-0134

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134
Crate:     rustybuzz

Version:   0.20.1

Warning:   unmaintained

Title:     rustybuzz is unmaintained

Date:      2026-07-11

ID:        RUSTSEC-2026-0206

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser

Version:   0.25.1

Warning:   unmaintained

Title:     ttf-parser is unmaintained

Date:      2026-06-28

ID:        RUSTSEC-2026-0192

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 5 allowed warnings found

</tr></table>

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates tauri-plugin-dialog from 2.7.2 to 2.8.2

Release notes

Sourced from tauri-plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates tauri-plugin-updater from 2.10.1 to 2.13.3

Release notes

Sourced from tauri-plugin-updater's releases.

updater-js v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.3
npm notice filename: tauri-apps-plugin-updater-2.13.3.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: fcd5b571631ca48f03eea01d6d1c0a0e776dc2f4
npm notice integrity: sha512-CtbA8CZ79WJry[...]/97ZjQ33dKUgg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189642273
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.3

updater v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

... (truncated)

Commits

• See full diff in compare view

Updates tauri-build from 2.6.3 to 2.7.3

Release notes

Sourced from tauri-build's releases.

tauri-build v2.7.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1314 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1045 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     rustybuzz is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     ttf-parser is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 4 allowed warnings found

[2.7.3]

Enhancements

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view

Updates libc from 0.2.189 to 0.2.190

Release notes

Sourced from libc's releases.

0.2.190

There is now a single config for enabling 64-bit time_t: libc_unstable_time64. This can be set unconditionally; it opts in to 64-bit time_t on the following platforms that use 32-bit by default:

• 32-bit Linux-GNU
• 32-bit Linux-uClibc
• 32-bit Linux-musl. Note that setting this flag also enables some other changes that happend in musl v1.2.
• 32-bit Windows-GNU
• ESP-IDF (all targets with this environment are 32-bit)

Most other 32-bit platforms are either already using 64-bit time_t, or are considered legacy and will not be gaining support from their upstream maintainers.

You can enable this using RUSTFLAGS:

RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...

Note that there may still be some changes to features gated by this config option, hence "unstable" in its name. In the near future we will rename it to just libc_time64. Until then, please test it out and report any bugs you find!

Support

• Add initial support for HelenOS (#4355)

Added

We are slowly filling out the Default implementations, to reduce the need for mem::zeroed() in user code:

• Unix: Implement Default for a number of structs, especially on Apple platforms (#5576)
• Linux, NetBSD: Give statvfs a Default impl (#5583)
• Linux: Add Default to a linux/can.rs structs (#5257)

Other additions:

• Expose the libc_unstable_time64 cfg (#5411)
• Android, Glibc: Add pthread_gettid_np (#5359)
• Android: Add RTLD_NEXT (#5323)
• Android: Add reuseport BPF socket options (#5366)
• Apple: Add TCP header flags, options and SACK limits (#5358)
• Apple: Add NET_RT_DUMP2 (#5442)
• Apple: Add posix_spawn_file_actions_add(f)chdir(_np) (#5558)
• BSD: Add BPF_WORDALIGN (#5320)
• BSD: Add lchmod and lchflags where supported (#5400)
• BSD: Add minherit and related constants (#4849)
• Docs: Add more links to public headers and manual pages (#5407), (#5485)

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.190 - 2026-10-02

There is now a single config for enabling 64-bit time_t: libc_unstable_time64. This can be set unconditionally; it opts in to 64-bit time_t on the following platforms that use 32-bit by default:

• 32-bit Linux-GNU
• 32-bit Linux-uClibc
• 32-bit Linux-musl. Note that setting this flag also enables some other changes that happend in musl v1.2.
• 32-bit Windows-GNU
• ESP-IDF (all targets with this environment are 32-bit)

Most other 32-bit platforms are either already using 64-bit time_t, or are considered legacy and will not be gaining support from their upstream maintainers.

You can enable this using RUSTFLAGS:

RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...

Note that there may still be some changes to features gated by this config option, hence "unstable" in its name. In the near future we will rename it to just libc_time64. Until then, please test it out and report any bugs you find!

Support

• Add initial support for HelenOS (#4355)

Added

We are slowly filling out the Default implementations, to reduce the need for mem::zeroed() in user code:

• Unix: Implement Default for a number of structs, especially on Apple platforms (#5576)
• Linux, NetBSD: Give statvfs a Default impl (#5583)
• Linux: Add Default to a linux/can.rs structs (#5257)

Other additions:

• Expose the libc_unstable_time64 cfg (#5411)
• Android, Glibc: Add pthread_gettid_np (#5359)
• Android: Add RTLD_NEXT (#5323)
• Android: Add reuseport BPF socket options (#5366)
• Apple: Add TCP header flags, options and SACK limits (#5358)
• Apple: Add NET_RT_DUMP2 (#5442)
• Apple: Add posix_spawn_file_actions_add(f)chdir(_np) (#5558)
• BSD: Add BPF_WORDALIGN (#5320)
• BSD: Add lchmod and lchflags where supported (#5400)
• BSD: Add minherit and related constants (#4849)

... (truncated)

Commits

• 7b0ab55 ci: Rename publish_0.2.yml to release.yaml
• ac85dde ci: Sync release permissions with main
• 8f8cd20 libc: Release 0.2.190
• 052c6e6 changelog: Fix an incorrect commit link
• ea19fd7 test: Remove explicit libc version
• 6dbf3a2 dragonfly: Move INHERIT_ZERO to the freebsd module
• 8a64766 apple: add posix_spawn_file_actions_add(f)chdir(_np)
• 28de514 linux, netbsd: Give statvfs a Default impl
• a58a95f cygwin: Change POSIX_SPAWN_* flags to c_short
• d175264 apple: timeval32 is exhaustive
• Additional commits viewable in compare view

Updates rustix from 1.1.4 to 1.1.5

Commits

• 287214b chore: Release rustix version 1.1.5
• 0cea188 fix(bug): ns->us overflow handling (#1655)
• a99fd26 build: Remove OUT_DIR probe artifact (#1628)
• 1e2954a fix build errors for horizon target (#1671)
• 4cecb72 Mangle the name of rustix::runtime to discourage users. (#1633)
• ded795b Fix compile errors for next libc version (#1676)
• 9640071 Expose the O_SYMLINK & O_NOFOLLOW_ANY flags on Apple platforms (#1666)
• cf67411 Fix debug printing of abstract socket addrs (#1615)
• aab9464 Completely remove rustc_attrs. (#1663)
• a9620e8 ci: fix syn pin (#1647)
• Additional commits viewable in compare view

Updates rusqlite from 0.40.1 to 0.40.2

Release notes

Sourced from rusqlite's releases.

0.40.2

What's Changed

• Lower MSRV to 1.88.0

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.40.2

Commits

• e88f112 Prepare release
• d11c76e Update main.yml
• c922ca5 Lower MSRV to 1.88.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.