chore(deps): bump the cargo group in /src-tauri with 11 updates

[dependabot]

Bumps the cargo group in /src-tauri with 11 updates:

Package	From	To
tauri-plugin-updater	2.10.1	2.12.0
tauri-plugin-opener	2.5.4	2.5.5
tauri-plugin-single-instance	2.4.2	2.4.5
serde	1.0.228	1.0.229
serde_json	1.0.150	1.0.151
uuid	1.23.3	1.26.1
tauri-plugin-dialog	2.7.1	2.7.3
window-vibrancy	0.6.0	0.8.1
tauri-build	2.6.2	2.6.3
rusqlite	0.32.1	0.40.2
thiserror	2.0.18	2.0.20

Updates tauri-plugin-updater from 2.10.1 to 2.12.0

Release notes

Sourced from tauri-plugin-updater's releases.

updater-js v2.12.0

[2.12.0]

• 1308bfa3 Breaking change: the allowDowngrades option was removed from the check command and is now read from the plugin configuration instead.

  Previously any code running in the webview could pass allowDowngrades: true to plugin:updater|check and relax the version check from "the update must be newer" to "the update must be different", overriding the comparator the application had configured on the Rust side. The flag is now an application-level setting:

  {
    "plugins": {
      "updater": {
        "allowDowngrades": true
      }
    }
  }

  It defaults to false, and is ignored when the application provides its own Builder::default_version_comparator, which continues to take precedence.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.12.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 3.2kB dist-js/index.cjs
npm notice 3.0kB dist-js/index.d.ts
npm notice 3.2kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.12.0
npm notice filename: tauri-apps-plugin-updater-2.12.0.tgz
npm notice package size: 3.9 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: f3b47d4bae20f5499efe043f4debb7c85f88b9b3
npm notice integrity: sha512-74+g7rSIHXQje[...]osT+6nphSa8Og==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2893838281
</tr></table> 

... (truncated)

Commits

• 5baf71a fix: pnpm audit
• 2393188 publish new versions (#3591)
• 1198a52 Merge commit from fork
• 1308bfa Merge commit from fork
• 690dcfd Merge commit from fork
• 67cd25a fix(single-instance): let the first instance come to front on Windows (#3592)
• 2df3d93 refactor(log): log webview location after double colon (#3574)
• 4b5c954 chore(deps): update dependency typescript-eslint to v8.70.0 (#3536)
• 3c5d267 publish new versions (#3567)
• c050e07 fix(store): apply_pending_auto_save can deadlock (#3572)
• Additional commits viewable in compare view

Updates tauri-plugin-opener from 2.5.4 to 2.5.5

Commits

• 6e2e7e4 publish new versions (#3070)
• 9a2c98f temp: remove updater changefiles
• 4a2ecb6 chore(deps): update rkyv, closes #3196
• 31415ef docs(shell): update example to include Encoding usage in Command::spawn (#3...
• 04b33ea chore(deps): update dependency typescript-eslint to v8.50.1 (#3181)
• 54e21f1 chore(deps): update dependency rollup to v4.54.0 (#3179)
• d528c88 chore(deps): update dependency rollup to v4.53.5 (#3172)
• 69146fa chore(deps): update dependency rollup to v4.53.4 (#3167)
• 9f68f2d chore(deps): update dependency typescript-eslint to v8.50.0 (#3170)
• 3d0d2e0 fix(opener): ignore inAppBrowser on desktop (#3163)
• Additional commits viewable in compare view

Updates tauri-plugin-single-instance from 2.4.2 to 2.4.5

Release notes

Sourced from tauri-plugin-single-instance's releases.

store-js v2.4.5

[2.4.5]

• c050e073 (#3572 by @​Legend-Master) Fix apply_pending_auto_save can deadlock the store

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-store@2.4.5
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.4kB README.md
npm notice 6.6kB dist-js/index.cjs
npm notice 8.5kB dist-js/index.d.ts
npm notice 6.4kB dist-js/index.js
npm notice 712B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-store
npm notice version: 2.4.5
npm notice filename: tauri-apps-plugin-store-2.4.5.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 27.5 kB
npm notice shasum: 1d062c60d051470f651e2d5af9f1ed72873d1370
npm notice integrity: sha512-bVD9riKzf+WKY[...]HOAEjqJ/kD9YQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2855150999
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-store@2.4.5

store v2.4.5

[2.4.5]

• c050e073 (#3572 by @​Legend-Master) Fix apply_pending_auto_save can deadlock the store

... (truncated)

Commits

• 6e2e7e4 publish new versions (#3070)
• 9a2c98f temp: remove updater changefiles
• 4a2ecb6 chore(deps): update rkyv, closes #3196
• 31415ef docs(shell): update example to include Encoding usage in Command::spawn (#3...
• 04b33ea chore(deps): update dependency typescript-eslint to v8.50.1 (#3181)
• 54e21f1 chore(deps): update dependency rollup to v4.54.0 (#3179)
• d528c88 chore(deps): update dependency rollup to v4.53.5 (#3172)
• 69146fa chore(deps): update dependency rollup to v4.53.4 (#3167)
• 9f68f2d chore(deps): update dependency typescript-eslint to v8.50.0 (#3170)
• 3d0d2e0 fix(opener): ignore inAppBrowser on desktop (#3163)
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates uuid from 1.23.3 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

• Add ContextV7::with_additional_precision_bits by @​ChrisJr404 in uuid-rs/uuid#904
• Prepare for 1.26.0 release by @​KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

• Add a serde::bytes module that encodes a Uuid as a byte string by @​ChrisJr404 in uuid-rs/uuid#902
• Prepare for 1.25.0 release by @​KodrAus in uuid-rs/uuid#903

New Contributors

• @​ChrisJr404 made their first contribution in uuid-rs/uuid#902

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

• Fix non-ASCII character handling in parse diagnostics by @​questfever in uuid-rs/uuid#899
• Prepare for 1.24.1 release by @​KodrAus in uuid-rs/uuid#900

New Contributors

• @​questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

v1.24.0

What's Changed

• feat(fmt): support encoding into MaybeUninit buffers by @​weifanglab in uuid-rs/uuid#892
• Prepare for 1.24.0 release by @​KodrAus in uuid-rs/uuid#896

New Contributors

• @​weifanglab made their first contribution in uuid-rs/uuid#892

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

... (truncated)

Commits

• 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
• d4df8f0 prepare for 1.26.1 release
• 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
• fda00eb don't panic in overflowing Timestamp to SystemTime conversion
• c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
• ac065a6 Align the counter diagram
• 34ec102 Seat the v7 counter below the version nibble
• cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
• 34e4f49 don't test macros under miri
• d9e7242 update nightly used for miri
• Additional commits viewable in compare view

Updates tauri-plugin-dialog from 2.7.1 to 2.7.3

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates window-vibrancy from 0.6.0 to 0.8.1

Release notes

Sourced from window-vibrancy's releases.

window-vibrancy v0.8.1

[0.8.1]

• cf3390e Added the LiquidGlassOptions::interactive option, which sets NSGlassEffectView.effectIsInteractive (macOS 27.0+) to enable the glass' visual response to user interactions. Also added effectIsInteractive, setEffectIsInteractive and supportsEffectIsInteractive methods to NSGlassEffectViewTagged.
• e9f765a (#181) Relaxed windows-sys dependency to >=0.60, <=0.61 instead of 0.60

Cargo Publish

Updating crates.io index
   Packaging window-vibrancy v0.8.1 (/home/runner/work/window-vibrancy/window-vibrancy)
    Updating crates.io index
    Packaged 35 files, 1.5MiB (1.4MiB compressed)
   Uploading window-vibrancy v0.8.1 (/home/runner/work/window-vibrancy/window-vibrancy)
    Uploaded window-vibrancy v0.8.1 to registry `crates-io`
note: waiting for window-vibrancy v0.8.1 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published window-vibrancy v0.8.1 at registry `crates-io`

window-vibrancy v0.8.0

[0.8.0]

• a3a3ff3 (#205 by @​rhysd) propagate errors from DwmSetWindowAttribute() instead of ignoring it.
• 4b0899a (#199 by @​ahonn) Changed the apply_liquid_glass API to use a LiquidGlassOptions struct configured via the Builder pattern. Added content_view and opaque settings.

Cargo Publish

\` Updating crates.io index Packaging window-vibrancy v0.8.0 (/home/runner/work/window-vibrancy/window-vibrancy) Updating crates.io index Packaged 34 files, 1.5MiB (1.3MiB compressed) Uploading window-vibrancy v0.8.0 (/home/runner/work/window-vibrancy/window-vibrancy) Uploaded window-vibrancy v0.8.0 to registry crates-io note: waiting for window-vibrancy v0.8.0 to be available at registry crates-io help: you may press ctrl-c to skip waiting; the crate should be available shortly Published window-vibrancy v0.8.0 at registry crates-io \`

window-vibrancy v0.7.1

[0.7.1]

bug

• 65f5d28 (#196 by @​FabianLars) Increased objc2-app-kit version to 0.3.2. No user facing changes because cargo already resolves to that version because of the enabled features.

Cargo Publish

\` Updating crates.io index Packaging window-vibrancy v0.7.1 (/home/runner/work/window-vibrancy/window-vibrancy) Updating crates.io index

... (truncated)

Changelog

Sourced from window-vibrancy's changelog.

[0.8.1]

• cf3390e Added the LiquidGlassOptions::interactive option, which sets NSGlassEffectView.effectIsInteractive (macOS 27.0+) to enable the glass' visual response to user interactions. Also added effectIsInteractive, setEffectIsInteractive and supportsEffectIsInteractive methods to NSGlassEffectViewTagged.
• e9f765a (#181) Relaxed windows-sys dependency to >=0.60, <=0.61 instead of 0.60

[0.8.0]

• a3a3ff3 (#205 by @​rhysd) propagate errors from DwmSetWindowAttribute() instead of ignoring it.
• 4b0899a (#199 by @​ahonn) Changed the apply_liquid_glass API to use a LiquidGlassOptions struct configured via the Builder pattern. Added content_view and opaque settings.

[0.7.1]

bug

• 65f5d28 (#196 by @​FabianLars) Increased objc2-app-kit version to 0.3.2. No user facing changes because cargo already resolves to that version because of the enabled features.

[0.7.0]

enhance

• 5178609 (#191 by @​ahonn) Introduce macOS liquid glass support with apply_liquid_glass / clear_liquid_glass.

misc

• 5178609 (#191 by @​ahonn) Increased the MSRV to 1.77.

Commits

• 7421685 apply version updates (#226)
• cf3390e feat: add liquid glass interactive property (macOS 27+)
• e9f765a chore(deps): relax windows-sys versions to a range >=0.60, <=0.61 (#181)
• 25331c1 ci: ignore audits and bump actions (#225)
• 4756332 apply version updates (#206)
• f8e78af chore(deps): update bytes and crossbeam-channel in lockfile
• 4b0899a feat!: fix liquid_glass layering and add opaque background option (#199)
• a3a3ff3 fix(windows): Propagate errors from DwmSetWindowAttribute() (#205)
• 5e7ddd7 apply version updates (#197)
• 65f5d28 chore(deps): explicitly set objc2-app-kit to 0.3.2 (#196)
• Additional commits viewable in compare view

Updates tauri-build from 2.6.2 to 2.6.3

Release notes

Sourced from tauri-build's releases.

tauri-build v2.6.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1133 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1085 crate dependencies)
Crate:     atk
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0413
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0413
Crate:     atk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0416

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0416
Crate:     fxhash

Version:   0.2.1

Warning:   unmaintained

Title:     fxhash - no longer maintained

Date:      2025-09-05

ID:        RUSTSEC-2025-0057

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     gdk

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0412

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0412
Crate:     gdk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0418

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0418
Crate:     gdkwayland-sys

</tr></table>

... (truncated)

Commits

• 6f6ab12 apply version updates (#15409)
• 728c8d4 fix(cli): skip building bundles when using tauri android run (#15473)
• e25f45c refactor: remove impl clone on inner menus (#15553)
• fbcf1b0 chore(deps): update dependency eslint-plugin-security to v4.0.1 (#15545)
• 828f710 fix(cli): respect src/bin required-features (fix: #15325) (#15427)
• ed8fd41 chore(cli): lesser verbose ureq_proto log (#15552)
• 50b0237 fix(android): escape special characters in strings.xml (#15549)
• 800223d docs: fix some missing and wrong docs (#15548)
• 5075c81 fix: check is_maximizable in internal_toggle_maximize (#15550)
• 532c22a chore(deps-dev): bump vite from 8.0.5 to 8.0.16 (#15547)
• Additional commits viewable in compare view

Updates rusqlite from 0.32.1 to 0.40.2

Release notes

Sourced from rusqlite's releases.

0.40.2

What's Changed

• Lower MSRV to 1.88.0

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.40.2

0.40.1

What's Changed

• Fix clippy warnings #1852
• Bump bundled SQLite version to 3.53.2 #1853
• Bump hashlink version #1855
• Fix SQL injection when SAVEPOINT name is tainted #1854

Full Changelog: rusqlite/rusqlite@v0.40.0...v0.40.1

0.40.0

What's Changed

• Breaking changes: Replace VTab macros by constructors #1823
• Breaking changes: Fix VTab::best_index #1824
• Asserts on VTab::connect aux and args #1825
• Breaking changes: Fix VTab::connect / create #1826
• Breaking changes: Allow opting out of using sqlite-wasm-rs on wasm32-unknown-unknown #1828, #1829
• Derive Default for SeriesTabCursor/ArrayTabCursor #1830
• Update link to pre-update hook #1831
• Breaking changes: Fix VTab::connect #1832
• impl From for FromSqlError #1833
• Breaking changes: Fix vtab::dequote #1835
• Bump bundled SQLCipher to version 4.14.0 #1837
• sqlite3_set_errmsg #1752
• Bump sqlite3-parser version #1838
• Fix UB in ToSqlOutput::from_rc #1839
• Ensure miri doesn't complain #1840
• Bump to actions/checkout@v6 #1842
• Add support to UtcDateTime #1843, #1844
• Bump bundled SQLite version to 3.53.1 #1848
• Replace some cfg(not by cfg_select #1850

Full Changelog: rusqlite/rusqlite@v0.39.0...v0.40.0

0.39.0

What's Changed

• Fix constraints on VTab Aux data #1778, #1771
• Fix docs.rs generation #1779
• Fix a small typo in rollback_hook docstring #1780
• Fix some warnings from Intellij #1781
• Minimal doc for features #1783
• Clear hooks only for owning connections #1785, #1784
• Fix link to SQLite C Interface, Prepare Flags #1787
• Comment functions which are not usable from a loadable extension #1789
• Factorize code #1792

... (truncated)

Commits

• e88f112 Prepare release
• d11c76e Update main.yml
• c922ca5 Lower MSRV to 1.88.0
• 6d3c282 Merge pull request #1856 from gwenn/0.40.1
• 2ba28b7 Prepare next release
• a021dc7 Merge pull request #1854 from gwenn/savepoint
• 534a149 Merge pull request #1855 from gwenn/hashlink
• 6d9764f Bump hashlink version
• fa574eb Use sqlite3_keyword_check
• 15385cc Fix SQL injection when SAVEPOINT name is tainted
• Additional commits viewable in compare view

Updates thiserror from 2.0.18 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

• Suppress redundant_field_names clippy lint in generated code (#454)

2.0.19

• Update to syn 3

Commits

• b1d5db5 Release 2.0.20
• c4c3ebd Merge pull request #454 from dtolnay/clippy
• 2266152 Suppress redundant_field_names clippy lint
• 2901cfd Raise minimum tested compiler to rust 1.88
• aa9d91f Update ui tests for version 2.0.19
• e13a785 Release 2.0.19
• 0a0e76c Update to syn 3
• ec42ea7 Update actions/upload-artifact@v6 -> v7
• 4178c4a Update actions/checkout@v6 -> v7
• 7214e0e Ignore items_after_statements pedantic clippy lint in test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions