Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 29 updates - #1585

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-fc26efe2d5
Open

chore(deps): bump the npm-minor-patch group across 1 directory with 29 updates#1585
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-fc26efe2d5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 29 updates in the / directory:

Package From To
@codemirror/language 6.12.4 6.13.1
@codemirror/legacy-modes 6.5.4 6.5.5
@codemirror/view 6.43.13 6.43.14
@tauri-apps/api 2.12.1 2.12.3
@tauri-apps/plugin-clipboard-manager 2.4.1 2.4.2
@tauri-apps/plugin-dialog 2.8.1 2.8.2
@tauri-apps/plugin-fs 2.6.0 2.7.0
@tauri-apps/plugin-log 2.10.0 2.10.1
@tauri-apps/plugin-notification 2.5.1 2.6.0
@tauri-apps/plugin-opener 2.7.0 2.7.1
@tauri-apps/plugin-updater 2.13.1 2.13.3
dompurify 3.4.16 3.4.17
i18next 26.4.2 26.4.4
lucide-react 1.52.0 1.56.0
react-i18next 17.0.15 17.0.16
smol-toml 1.9.0 1.9.1
zod 4.6.5 4.6.7
@hypothesi/tauri-mcp-server 0.13.0 0.13.1
@size-limit/file 14.1.0 14.2.0
@tauri-apps/cli 2.12.1 2.12.2
dependency-cruiser 18.5.0 18.6.0
jscpd 5.4.0 5.4.1
knip 6.39.0 6.41.0
playwright 1.63.0 1.64.0
size-limit 14.1.0 14.2.0
typescript-eslint 8.71.1 8.71.2
vite 8.3.2 8.3.4
@hono/node-server 2.1.3 2.1.4
playwright-chromium 1.63.0 1.64.0

Updates @codemirror/language from 6.12.4 to 6.13.1

Commits

Updates @codemirror/legacy-modes from 6.5.4 to 6.5.5

Commits

Updates @codemirror/view from 6.43.13 to 6.43.14

Commits

Updates @tauri-apps/api from 2.12.1 to 2.12.3

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

Bug Fixes

  • 0204f6f3a (#16244) Keep delivering Channel messages after the onmessage handler throws. The error is rethrown asynchronously so it is still reported as uncaught, instead of leaving every later message queued.
$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m911ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.3s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 239ms
📦 @tauri-apps/api@2.12.3 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=sigstore 200 81ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.3

@​tauri-apps/api v2.12.2

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.2]

... (truncated)

Commits
  • 5b23c82 apply version updates (#16243)
  • 05354a8 chore(deps): update swift-rs to 1.0.9
  • c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
  • eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
  • 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
  • 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
  • fd319dd chore(deps): update base64 to 0.23
  • 413cbdb Apply Version Updates From Current Changes (#16213)
  • 587ae48 chore: disable CODEOWNERS file (#16236)
  • a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-clipboard-manager from 2.4.1 to 2.4.2

Release notes

Sourced from @​tauri-apps/plugin-clipboard-manager's releases.

geolocation-js v2.4.2

[2.4.2]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-geolocation@2.4.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.8kB README.md
npm notice 3.9kB dist-js/index.cjs
npm notice 6.3kB dist-js/index.d.ts
npm notice 3.7kB dist-js/index.js
npm notice 662B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-geolocation
npm notice version: 2.4.2
npm notice filename: tauri-apps-plugin-geolocation-2.4.2.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 20.2 kB
npm notice shasum: 6d73ce4b1a0c3ffa8f19a7294fe68fa1768fe6dd
npm notice integrity: sha512-JLuLHiAyXMu24[...]FMhrjZh89m88w==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189612489
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-geolocation@2.4.2

geolocation v2.4.2

[2.4.2]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits
  • 2371804 publish new versions (#2888)
  • 90f9b93 chore: fix cli version in deep-link package.json
  • 1c58f33 chore(deps): update dependency rollup to v4.46.4 (v2) (#2935)
  • 75617a6 fix(mobile): deeplinks (#2870)
  • 5a963a0 chore(deps): update dependency @​tauri-apps/cli to v2.8.1 (#2930)
  • 76f4e7b chore(deps): update eslint monorepo to v9.33.0 (#2903)
  • 670ac1d chore(deps): update dependency typescript-eslint to v8.40.0 (#2923)
  • ed0deef chore(deps): update dependency @​tauri-apps/api to v2.8.0 (#2929)
  • 50cebdb chore(deps): update to tauri 2.8.0 (#2925)
  • dd2ea9c chore(deps): update dependency rollup to v4.46.3 (#2920)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.8.1 to 2.8.2

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

  • Upgraded to fs-js@2.7.0
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

  • Upgraded to fs-js@2.7.0

... (truncated)

Commits
  • 6bbd44d publish new versions (#3675)
  • fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
  • 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
  • 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
  • 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
  • 6772581 test(e2e): fix __name usage on FS test
  • 46f7c87 chore: fmt
  • a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
  • e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
  • 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.6.0 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.7.0

[2.7.0]

  • a934743b (#3637) Added the scopeDroppedPaths plugin config option (plugins > fs > scopeDroppedPaths in tauri.conf.json). Set it to false to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to true, the current behaviour.
  • 085a0283 (#3636) Fixed a panic on Android when a content provider returns no file descriptor for a content:// URI (e.g. virtual files). The fs command now fails with an error instead.
  • f81f0447 (#3635) Fixed reading uncompressed Android assets ($RESOURCE files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
  • e03dca60 (#3628) startAccessingSecurityScopedResource and stopAccessingSecurityScopedResource now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a file:// URL.
  • 5de7ebfc (#3634) Security: the open command no longer accepts a customFlags option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary open(2) flags (e.g. O_TRUNC) to files it may only read. OpenOptionsExt::custom_flags still works from Rust.
  • 5e6c023a (#3626) FileHandle.read no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
  • 3a900017 (#3627) Security: the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (writeFile, mkdir, create, rename, copyFile, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
  • 77d00a4f (#3633) FileHandle.seek now rejects a negative offset with SeekMode.Start instead of seeking to a huge position.
  • 5c144e74 (#3631) Fixed readTextFileLines with a UTF-16 encoding splitting lines on a 0x0A 0x00 (LE) or 0x00 0x0A (BE) byte sequence that is not aligned on a code unit, e.g. ਗĀ, which garbled every following line.
  • dcc8cb03 (#3629) Fixed writeFile with a ReadableStream leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless append is set, like when writing a buffer.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 39.9kB dist-js/index.cjs
npm notice 41.1kB dist-js/index.d.ts
npm notice 39.2kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-fs-2.7.0.tgz
npm notice package size: 25.6 kB
npm notice unpacked size: 124.3 kB
npm notice shasum: e76d4d07b05063de6911fd1c42948ab0264ac20e
npm notice integrity: sha512-8RQbPkuYuLZ2r[...]GdKJVqDokyDgQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189606635
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-fs@2.7.0

... (truncated)

Commits
  • 6bbd44d publish new versions (#3675)
  • fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
  • 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
  • 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
  • 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
  • 6772581 test(e2e): fix __name usage on FS test
  • 46f7c87 chore: fmt
  • a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
  • e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
  • 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-log from 2.10.0 to 2.10.1

Release notes

Sourced from @​tauri-apps/plugin-log's releases.

log-js v2.10.1

[2.10.1]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-log@2.10.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 8.4kB dist-js/index.cjs
npm notice 4.7kB dist-js/index.d.ts
npm notice 8.2kB dist-js/index.js
npm notice 716B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-log
npm notice version: 2.10.1
npm notice filename: tauri-apps-plugin-log-2.10.1.tgz
npm notice package size: 5.3 kB
npm notice unpacked size: 26.4 kB
npm notice shasum: 95971d58eca74f00402304def6d39bce4c2c0c2d
npm notice integrity: sha512-QYgxDunUZP+Cd[...]2vqUr3qwNfTTw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189628288
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-log@2.10.1

log v2.10.1

[2.10.1]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits
  • 6bbd44d publish new versions (#3675)
  • fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
  • 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
  • 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
  • 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
  • 6772581 test(e2e): fix __name usage on FS test
  • 46f7c87 chore: fmt
  • a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
  • e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
  • 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-notification from 2.5.1 to 2.6.0

Release notes

Sourced from @​tauri-apps/plugin-notification's releases.

notification-js v2.6.0

[2.6.0]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

feat

  • 46381516 (#3671) Report actions on desktop: a click on a notification (tap) or on one of the actions of its action type reaches onAction and the new Rust Notification::on_action, which also works on mobile. registerActionTypes, removeActive (Linux and the BSDs) and the listener commands no longer fail with "command not found" on desktop.

    The onAction callback is now typed with the new ActionPerformed interface, which is what every platform sends, instead of Options. Callbacks annotated with Options must be updated.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-notification@2.6.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 16.6kB dist-js/index.cjs
npm notice 26.1kB dist-js/index.d.ts
npm notice 16.2kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 663B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-notification
npm notice version: 2.6.0
npm notice filename: tauri-apps-plugin-notification-2.6.0.tgz
npm notice package size: 11.1 kB
npm notice unpacked size: 64.7 kB
npm notice shasum: 68f6090e06e17a92fd1803c7b40a01e4ee20cc7c
npm notice integrity: sha512-QvpsQ6L6uSGT/[...]J3c52S+1afsIw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189634908
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-notification@2.6.0

notification v2.6.0

... (truncated)

Commits

Updates @tauri-apps/plugin-opener from 2.7.0 to 2.7.1

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

  • 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits
  • 44293a5 Publish New Versions (v2) (#3689)
  • 7550f7c chore(deps): bump rustls to 0.23.46
  • 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
  • 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
  • 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
  • 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
  • 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
  • d80b1be feat: add torch plugin for iOS and Android (#3551)
  • c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
  • 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-updater from 2.13.1 to 2.13.3

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.13.3

[2.13.3]

  • 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.3
npm notice filename: tauri-apps-plugin-updater-2.13.3.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: fcd5b571631ca48f03eea01d6d1c0a0e776dc2f4
npm notice integrity: sha512-CtbA8CZ79WJry[...]/97ZjQ33dKUgg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189642273
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.3

updater v2.13.3

[2.13.3]

  • 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

... (truncated)

Commits
  • 6bbd44d publish new versions (#3675)
  • fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
  • 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
  • 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
  • 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
  • 6772581 test(e2e): fix __name usage on FS test
  • 46f7c87 chore: fmt
  • a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
  • e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
  • 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
  • Additional commits viewable in compare view

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies
Commits

Updates i18next from 26.4.2 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Changelog

Sourced from i18next's changelog.

26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Commits
  • f6a7746 26.4.4
  • 25988d5 build
  • c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
  • 0d2845a 26.4.3
  • a2dbe15 build
  • e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
  • edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
  • 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
  • Se...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 20, 2026
This was referenced Oct 20, 2026
Closed
Closed
Closed
@dependabot
chore(deps): bump the npm-minor-patch group across 1 directory with 2…
d1d62fb 
…9 updates

Bumps the npm-minor-patch group with 29 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@codemirror/language](https://github.com/codemirror/language) | `6.12.4` | `6.13.1` |
| [@codemirror/legacy-modes](https://github.com/codemirror/legacy-modes) | `6.5.4` | `6.5.5` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.13` | `6.43.14` |
| [@tauri-apps/api](https://github.com/tauri-apps/tauri) | `2.12.1` | `2.12.3` |
| [@tauri-apps/plugin-clipboard-manager](https://github.com/tauri-apps/plugins-workspace) | `2.4.1` | `2.4.2` |
| [@tauri-apps/plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.8.1` | `2.8.2` |
| [@tauri-apps/plugin-fs](https://github.com/tauri-apps/plugins-workspace) | `2.6.0` | `2.7.0` |
| [@tauri-apps/plugin-log](https://github.com/tauri-apps/plugins-workspace) | `2.10.0` | `2.10.1` |
| [@tauri-apps/plugin-notification](https://github.com/tauri-apps/plugins-workspace) | `2.5.1` | `2.6.0` |
| [@tauri-apps/plugin-opener](https://github.com/tauri-apps/plugins-workspace) | `2.7.0` | `2.7.1` |
| [@tauri-apps/plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.13.1` | `2.13.3` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.16` | `3.4.17` |
| [i18next](https://github.com/i18next/i18next) | `26.4.2` | `26.4.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.52.0` | `1.56.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.15` | `17.0.16` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.9.0` | `1.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@hypothesi/tauri-mcp-server](https://github.com/hypothesi/mcp-server-tauri/tree/HEAD/packages/mcp-server) | `0.13.0` | `0.13.1` |
| [@size-limit/file](https://github.com/ai/size-limit) | `14.1.0` | `14.2.0` |
| [@tauri-apps/cli](https://github.com/tauri-apps/tauri) | `2.12.1` | `2.12.2` |
| [dependency-cruiser](https://github.com/sverweij/dependency-cruiser) | `18.5.0` | `18.6.0` |
| [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `5.4.0` | `5.4.1` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.39.0` | `6.41.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |
| [size-limit](https://github.com/ai/size-limit) | `14.1.0` | `14.2.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.1` | `8.71.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.2` | `8.3.4` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.4` |
| [playwright-chromium](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |



Updates `@codemirror/language` from 6.12.4 to 6.13.1
- [Changelog](https://github.com/codemirror/language/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/language/commits)

Updates `@codemirror/legacy-modes` from 6.5.4 to 6.5.5
- [Changelog](https://github.com/codemirror/legacy-modes/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/legacy-modes/commits)

Updates `@codemirror/view` from 6.43.13 to 6.43.14
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `@tauri-apps/api` from 2.12.1 to 2.12.3
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.12.1...@tauri-apps/api-v2.12.3)

Updates `@tauri-apps/plugin-clipboard-manager` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.1...fs-v2.4.2)

Updates `@tauri-apps/plugin-dialog` from 2.8.1 to 2.8.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@http-v2.8.1...http-v2.8.2)

Updates `@tauri-apps/plugin-fs` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.6.0...fs-v2.7.0)

Updates `@tauri-apps/plugin-log` from 2.10.0 to 2.10.1
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.10.0...log-v2.10.1)

Updates `@tauri-apps/plugin-notification` from 2.5.1 to 2.6.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.5.1...fs-v2.6.0)

Updates `@tauri-apps/plugin-opener` from 2.7.0 to 2.7.1
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.7.0...fs-v2.7.1)

Updates `@tauri-apps/plugin-updater` from 2.13.1 to 2.13.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@updater-v2.13.1...updater-v2.13.3)

Updates `dompurify` from 3.4.16 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.16...3.4.17)

Updates `i18next` from 26.4.2 to 26.4.4
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.2...v26.4.4)

Updates `lucide-react` from 1.52.0 to 1.56.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.56.0/packages/lucide-react)

Updates `react-i18next` from 17.0.15 to 17.0.16
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.15...v17.0.16)

Updates `smol-toml` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.9.0...v1.9.1)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@hypothesi/tauri-mcp-server` from 0.13.0 to 0.13.1
- [Release notes](https://github.com/hypothesi/mcp-server-tauri/releases)
- [Changelog](https://github.com/hypothesi/mcp-server-tauri/blob/main/packages/mcp-server/CHANGELOG.md)
- [Commits](https://github.com/hypothesi/mcp-server-tauri/commits/v0.13.1/packages/mcp-server)

Updates `@size-limit/file` from 14.1.0 to 14.2.0
- [Release notes](https://github.com/ai/size-limit/releases)
- [Changelog](https://github.com/ai/size-limit/blob/main/CHANGELOG.md)
- [Commits](ai/size-limit@14.1.0...14.2.0)

Updates `@tauri-apps/cli` from 2.12.1 to 2.12.2
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.12.1...@tauri-apps/cli-v2.12.2)

Updates `dependency-cruiser` from 18.5.0 to 18.6.0
- [Release notes](https://github.com/sverweij/dependency-cruiser/releases)
- [Changelog](https://github.com/sverweij/dependency-cruiser/blob/main/CHANGELOG.md)
- [Commits](sverweij/dependency-cruiser@v18.5.0...v18.6.0)

Updates `jscpd` from 5.4.0 to 5.4.1
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Commits](https://github.com/kucherenko/jscpd/commits/v5.4.1/rust/jscpd)

Updates `knip` from 6.39.0 to 6.41.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.41.0/packages/knip)

Updates `playwright` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

Updates `size-limit` from 14.1.0 to 14.2.0
- [Release notes](https://github.com/ai/size-limit/releases)
- [Changelog](https://github.com/ai/size-limit/blob/main/CHANGELOG.md)
- [Commits](ai/size-limit@14.1.0...14.2.0)

Updates `typescript-eslint` from 8.71.1 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint)

Updates `vite` from 8.3.2 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `@hono/node-server` from 2.1.3 to 2.1.4
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.3...v2.1.4)

Updates `playwright-chromium` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

---
updated-dependencies:
- dependency-name: "@codemirror/language"
  dependency-version: 6.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@codemirror/legacy-modes"
  dependency-version: 6.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@hypothesi/tauri-mcp-server"
  dependency-version: 0.13.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@size-limit/file"
  dependency-version: 14.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/api"
  dependency-version: 2.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.12.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-clipboard-manager"
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-dialog"
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-fs"
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-log"
  dependency-version: 2.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-notification"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-opener"
  dependency-version: 2.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@tauri-apps/plugin-updater"
  dependency-version: 2.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: dependency-cruiser
  dependency-version: 18.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: i18next
  dependency-version: 26.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: jscpd
  dependency-version: 5.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: knip
  dependency-version: 6.41.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright-chromium
  dependency-version: 1.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: react-i18next
  dependency-version: 17.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: size-limit
  dependency-version: 14.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: typescript-eslint
  dependency-version: 8.71.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-fc26efe2d5 branch from bc15acb to d1d62fb Compare October 20, 2026 06:32

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants