[dependabot]

Bumps the cargo-minor-and-patch group in /src-tauri with 8 updates:

Package	From	To
tauri-plugin-dialog	2.8.1	2.8.2
tauri-plugin-opener	2.7.0	2.7.1
tauri-plugin-single-instance	2.5.2	2.5.3
serde_json	1.0.151	1.0.154
hyper	1.11.1	1.12.0
tokio-util	0.7.19	0.7.20
uuid	1.27.0	1.28.0
tauri-build	2.7.1	2.7.2

Updates tauri-plugin-dialog from 2.8.1 to 2.8.2

Release notes

Sourced from tauri-plugin-dialog's releases.

dialog-js v2.8.2

[2.8.2]

• 84895756 (#3665) Fix browser confirm fails with Uncaught dialog.confirm not allowed. Command not found
• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 7.1kB dist-js/index.cjs
npm notice 15.1kB dist-js/index.d.ts
npm notice 7.0kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-dialog-2.8.2.tgz
npm notice package size: 6.8 kB
npm notice unpacked size: 34.3 kB
npm notice shasum: a2564d620cd719fbb1fad1668900d7e509d25954
npm notice integrity: sha512-LFqp8OTx0bHOw[...]j/GxrU6cW8mXw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189609634
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-dialog@2.8.2

dialog v2.8.2

[2.8.2]

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates tauri-plugin-opener from 2.7.0 to 2.7.1

Release notes

Sourced from tauri-plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• e7a68fa publish new versions (#3068)
• b5550a3 chore: temp delete updater changefile
• 93426f8 fix: fix docsrs builds
• 4ee61e0 Revert "chore: temp delete updater changefile"
• 06124af publish new versions (#2972)
• 060219e chore(deps): update dependency @​rollup/plugin-typescript to v12.3.0 (#3067)
• c7e9766 chore(deps): update tauri monorepo (v2) (#3058)
• d4a8ce9 chore(deps): update rust crate tokio-tungstenite to 0.28 (#3016)
• cdc7eec chore(deps): update dependency @​rollup/plugin-typescript to v12.2.0 (#3066)
• 6314b00 chore: temp delete updater changefile
• Additional commits viewable in compare view

Updates tauri-plugin-single-instance from 2.5.2 to 2.5.3

Release notes

Sourced from tauri-plugin-single-instance's releases.

single-instance v2.5.3

[2.5.3]

• 818d2e04 (#3645) On Windows, a second instance no longer waits indefinitely for a first instance that stopped processing messages: it stops waiting after 10 seconds and exits. The first instance may still receive the arguments once it resumes processing messages.
• 323fe80d (#3644) A second instance no longer panics when a command-line argument is not valid Unicode: such an argument is forwarded with its invalid parts replaced by U+FFFD. A working directory that is not valid Unicode is now forwarded the same way instead of as an empty string.

Updating crates.io index
   Packaging tauri-plugin-single-instance v2.5.3 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Updating crates.io index
warning: package `yoke-derive v0.8.3` in Cargo.lock is yanked in registry `crates-io`
  |
  = help: consider updating to a version that is not yanked
    Packaged 15 files, 170.3KiB (46.5KiB compressed)
   Uploading tauri-plugin-single-instance v2.5.3 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Uploaded tauri-plugin-single-instance v2.5.3 to registry `crates-io`
note: waiting for tauri-plugin-single-instance v2.5.3 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-single-instance v2.5.3 at registry `crates-io`

Commits

• 06124af publish new versions (#2972)
• 060219e chore(deps): update dependency @​rollup/plugin-typescript to v12.3.0 (#3067)
• c7e9766 chore(deps): update tauri monorepo (v2) (#3058)
• d4a8ce9 chore(deps): update rust crate tokio-tungstenite to 0.28 (#3016)
• cdc7eec chore(deps): update dependency @​rollup/plugin-typescript to v12.2.0 (#3066)
• 6314b00 chore: temp delete updater changefile
• fb4c8ae chore(deps): update dependency typescript-eslint to v8.46.2 (#3060)
• fccc1cf chore(deps): update eslint monorepo to v9.38.0 (#3044)
• 3702308 chore(deps): update dependency rollup to v4.52.5 (#3043)
• c9c8b39 chore(deps): update dependency typescript-eslint to v8.46.1 (#3025)
• Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates hyper from 1.11.1 to 1.12.0

Release notes

Sourced from hyper's releases.

v1.12.0

Features

• http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Bug Fixes

• http1:
  • withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)
  • remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)
  • always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)
  • let a Connection close token win over a later keep-alive (#4201) (5dadff76)
  • preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)
• http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Everything

• docs: fix typo responsibile -> responsible by @​vaibhav8a in hyperium/hyper#4177
• style: replace single-character lifetime names with descriptive names by @​dox4 in hyperium/hyper#4173
• refactor(http1): resolve collapsible_match lint by @​nakaryo716 in hyperium/hyper#4178
• hyper Improvement Proposals by @​seanmonstar in hyperium/hyper#4131
• perf(body): simpler custom Incoming channel by @​seanmonstar in hyperium/hyper#4168
• docs(maintainers): add 0x676e67 as a collaborator by @​seanmonstar in hyperium/hyper#4184
• fix(ext): remove broken OriginalHeaderOrder doctest by @​cratelyn in hyperium/hyper#4188
• build(deps): remove unused futures-channel from http1 feature by @​0x676e67 in hyperium/hyper#4185
• chore(ci): update to cargo-check-external-types 0.5.0 by @​tottoto in hyperium/hyper#4189
• style(lib): address ignored_unit_patterns lint by @​nakaryo716 in hyperium/hyper#4193
• Preserve hop-by-hop when setting close or keep-alive by @​dtolnay in hyperium/hyper#4196
• fix(http2): do not reserve capacity for idle Upgraded streams by @​Dev-next-gen in hyperium/hyper#4198
• style(lib): Address clippy panics and missing_panics_doc lints by @​Siech0 in hyperium/hyper#4191
• docs: fix typos in capi README, MSRV and governance docs by @​toyeshhm in hyperium/hyper#4204
• style(lib): Address trivial, low quantity clippy lints. by @​Siech0 in hyperium/hyper#4190
• chore(clippy): allow clippy lints following 1.99.0 release by @​dswij in hyperium/hyper#4219
• style: remove useless_borrows_in_formatting from the clippy allowlist by @​ump45nose in hyperium/hyper#4220
• style(h1): mark partial Debug impls as non-exhaustive by @​badimalex in hyperium/hyper#4218
• style(lib): Address cast-possible-truncation clippy findings. by @​Siech0 in hyperium/hyper#4192
• feat(http1): add max_header_size limit for server and client by @​Aditya-9-6 in hyperium/hyper#4183
• fix(http1): let a Connection close token win over a later keep-alive by @​shoemoney in hyperium/hyper#4201
• fix(http1): always remove content-length if transfer-encoding is sent by @​seanmonstar in hyperium/hyper#4223
• fix(http1): remove invalid content-length if transfer-encoding is auto-added by @​seanmonstar in hyperium/hyper#4224
• fix(http1): withdraw a stale want when the client dispatcher takes a request by @​shodoco in hyperium/hyper#4208
• perf(body): skip waking a closed peer when a channel end drops by @​0x676e67 in hyperium/hyper#4225
• Prepare v1.12.0 by @​seanmonstar in hyperium/hyper#4226

New Contributors

• @​vaibhav8a made their first contribution in hyperium/hyper#4177
• @​dox4 made their first contribution in hyperium/hyper#4173
• @​dtolnay made their first contribution in hyperium/hyper#4196
• @​Dev-next-gen made their first contribution in hyperium/hyper#4198
• @​Siech0 made their first contribution in hyperium/hyper#4191
• @​toyeshhm made their first contribution in hyperium/hyper#4204

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.12.0 (2026-10-06)

Bug Fixes

• http1:
  • withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)
  • remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)
  • always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)
  • let a Connection close token win over a later keep-alive (#4201) (5dadff76)
  • preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)
• http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Features

• http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Commits

• 7f67699 v1.12.0
• 254bf12 perf(body): skip waking a closed peer when a channel end drops (#4225)
• c44f1cc fix(http1): withdraw a stale want when the client dispatcher takes a request ...
• 69396fd fix(http1): remove content-length if transfer-encoding is auto-added (#4224)
• a5d7fd7 fix(http1): always remove content-length if transfer-encoding is sent (#4223)
• 5dadff7 fix(http1): let a Connection close token win over a later keep-alive (#4201)
• d1cd14e feat(http1): add max_header_size limit for server and client (#4183)
• 714c7cf style(lib): address cast-possible-truncation clippy findings (#4192)
• 0d47440 style(lib): mark partial Debug impls as non-exhaustive (#4218)
• da3b1b1 style(lib): remove useless_borrows_in_formatting from the clippy allowlist (#...
• Additional commits viewable in compare view

Updates tokio-util from 0.7.19 to 0.7.20

Commits

• 5ec9e6b chore: prepare tokio-util v0.7.20 (#8608)
• afd1b26 docs: fix stray braces and broken links in rustdoc (#8605)
• 3eb95a4 wasm: use sleep on emscripten without JSPI (#8528)
• b22c802 wasm: link emscripten_promise_await for Emscripten 4.x compatibility (#8528)
• 16b1f9d ci: pin libc to 0.2.189 on FreeBSD (#8594)
• b263675 time: clean up stale Err(Invalid) doc and typo (#8590)
• 5d5cd8b Merge 'tokio-1.53.2' into 'master' (#8578)
• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• Additional commits viewable in compare view

Updates uuid from 1.27.0 to 1.28.0

Release notes

Sourced from uuid's releases.

v1.28.0

What's Changed

• Add optional serde format adapters by @​RanaPriyansh in uuid-rs/uuid#916
• Prepare for 1.28.0 release by @​KodrAus in uuid-rs/uuid#918

New Contributors

• @​RanaPriyansh made their first contribution in uuid-rs/uuid#916

Full Changelog: uuid-rs/uuid@v1.27.0...v1.28.0

Commits

• 276c236 Merge pull request #918 from uuid-rs/cargo/v1.28.0
• 4b3b9f5 prepare for 1.28.0 release
• cbf9c81 Merge pull request #916 from RanaPriyansh/fix/optional-serde-adapters-840
• 784a022 Inline expected tokens in optional compact serde test
• a5678c3 Simplify optional serde adapter tests to option tokens
• 638a518 Refactor optional serde adapter tests and share byte wrapper
• 654fa5b Add optional serde format adapters
• See full diff in compare view

Updates tauri-build from 2.7.1 to 2.7.2

Release notes

Sourced from tauri-build's releases.

tauri-build v2.7.2

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1296 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1092 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste

Version:   1.0.15

Warning:   unmaintained

Title:     paste - no longer maintained

Date:      2024-10-07

ID:        RUSTSEC-2024-0436

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustls-pemfile

Version:   2.2.0

Warning:   unmaintained

Title:     rustls-pemfile is unmaintained

Date:      2025-11-28

ID:        RUSTSEC-2025-0134

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134
Crate:     rustybuzz

Version:   0.20.1

Warning:   unmaintained

Title:     rustybuzz is unmaintained

Date:      2026-07-11

ID:        RUSTSEC-2026-0206

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser

Version:   0.25.1

Warning:   unmaintained

Title:     ttf-parser is unmaintained

Date:      2026-06-28

ID:        RUSTSEC-2026-0192

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 5 allowed warnings found

</tr></table>

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.